package app

import (
	"testing"

	"github.com/stretchr/testify/require"
)

func TestAppInstallationRequestPublicGitHubConfigUsesSafeAllowlist(t *testing.T) {
	stored := map[string]any{
		githubConfigAppIDKey:         "4242",
		githubConfigAppSlugKey:       " agentteam-github ",
		githubConfigAppNameKey:       " AgentTeam GitHub ",
		githubConfigHTMLURLKey:       " https://github.com/apps/agentteam-github ",
		githubConfigClientIDKey:      " Iv1.client-id ",
		githubConfigClientSecretKey:  `{"_storage":"aes-gcm-v1","ciphertext":"client-secret-ciphertext"}`,
		githubConfigPrivateKeyPEMKey: "",
		githubConfigWebhookSecretKey: map[string]any{"ciphertext": "structured-webhook-secret"},
		githubConfigOwnerLoginKey:    " pingcap ",
		githubConfigOwnerIDKey:       "0",
		"unknown_secret":             "must-not-leak",
		"future_execution_state":     map[string]any{"ciphertext": "future-secret-ciphertext"},
	}

	require.Equal(t, map[string]any{
		githubConfigAppIDKey:         "4242",
		githubConfigAppSlugKey:       "agentteam-github",
		githubConfigAppNameKey:       "AgentTeam GitHub",
		githubConfigHTMLURLKey:       "https://github.com/apps/agentteam-github",
		githubConfigClientIDKey:      "Iv1.client-id",
		githubConfigClientSecretKey:  githubConfigMaskedSecret,
		githubConfigPrivateKeyPEMKey: "",
		githubConfigWebhookSecretKey: githubConfigMaskedSecret,
		githubConfigOwnerLoginKey:    "pingcap",
		githubConfigOwnerIDKey:       "0",
	}, appInstallationRequestPublicGitHubConfig(stored))
}

func TestAppInstallationRequestPublicGitHubConfigDropsStructuredMetadata(t *testing.T) {
	stored := map[string]any{
		githubConfigAppNameKey: map[string]any{"ciphertext": "nested-secret"},
		githubConfigAppIDKey:   "004242",
		githubConfigOwnerIDKey: float64(1234),
		"unknown":              "secret",
	}

	require.Empty(t, appInstallationRequestPublicGitHubConfig(stored))
	require.Empty(t, appInstallationRequestPublicGitHubConfig(nil))
}