package server

import (
	"context"
	"encoding/json"
	"os"
	"path/filepath"
	"strings"
	"testing"

	"github.com/stretchr/testify/require"

	"github.com/tidbcloud/AgentTeam/internal/config"
	"github.com/tidbcloud/AgentTeam/internal/observability/logging"
)

func TestNoopDeliveryCredentialsDoNotEnterOperationalFileLog(t *testing.T) {
	logPath := filepath.Join(t.TempDir(), "agentteam.jsonl")
	logConfig := config.DefaultLogConfig()
	logConfig.Output = config.LogOutputFile
	logConfig.FilePath = logPath
	logConfig.Compression = config.LogCompressionNone
	pipeline, err := logging.Open(logConfig, nil)
	require.NoError(t, err)
	t.Cleanup(func() { require.NoError(t, pipeline.Close()) })

	runtimeConfig := config.Config{
		PublicBaseURL: "https://agentteam.example.invalid",
		Mail:          config.MailConfig{Driver: "noop"},
		MobileVerify:  config.MobileVerifyConfig{Driver: "noop"},
	}
	mailService, err := buildMailer(context.Background(), runtimeConfig, pipeline.Logger(), nil)
	require.NoError(t, err)
	smsSender, err := buildMobileVerificationSender(runtimeConfig, pipeline.Logger(), nil)
	require.NoError(t, err)

	ctx := context.Background()
	require.NoError(t, mailService.SendVerificationEmail(ctx, "sensitive-user@example.invalid", "verify-secret-token"))
	require.NoError(t, mailService.SendPasswordResetEmail(ctx, "reset-user@example.invalid", "reset-secret-token"))
	require.NoError(t, mailService.SendWorkspaceInviteEmail(ctx, "workspace-user@example.invalid", "Secret Workspace", "workspace-invite-token"))
	require.NoError(t, mailService.SendOrganizationInviteEmail(ctx, "organization-user@example.invalid", "Secret Organization", "organization-invite-token"))
	_, err = smsSender.Send(ctx, "+15551234567", "918273")
	require.NoError(t, err)
	pipeline.Logger().Info("delivery fixture completed")
	require.NoError(t, pipeline.Flush())

	contents, err := os.ReadFile(logPath)
	require.NoError(t, err)
	for _, line := range strings.Split(strings.TrimSpace(string(contents)), "\n") {
		require.True(t, json.Valid([]byte(line)))
	}
	require.Contains(t, string(contents), `"msg":"delivery fixture completed"`)
	for _, sensitive := range []string{
		"sensitive-user@example.invalid", "reset-user@example.invalid", "workspace-user@example.invalid", "organization-user@example.invalid",
		"+15551234567", "verify-secret-token", "reset-secret-token", "workspace-invite-token", "organization-invite-token", "918273",
		"verify-email", "reset-password", "accept-invite", "Secret Workspace", "Secret Organization",
	} {
		require.NotContains(t, string(contents), sensitive)
	}
}