package safediagnostic

import (
	"strings"
	"testing"
	"unicode/utf8"

	"github.com/stretchr/testify/require"
)

func TestSanitizeSecretsURLsAndUTF8(t *testing.T) {
	raw := "\x1b[31m" + `{"apiKey":"json-secret","authorization":"Bearer json-bearer","token":"json-token"}` +
		` apiKey=plain-secret HTTPS://user:pass@example.test/v1?token=query#frag sk-1234567890 界界界`
	result := Sanitize(raw, 200)

	for _, secret := range []string{"json-secret", "json-bearer", "json-token", "plain-secret", "user:pass", "query", "frag", "sk-1234567890"} {
		require.NotContains(t, result, secret)
	}
	require.Contains(t, result, "https://example.test/v1")
	require.True(t, utf8.ValidString(result))
}

func TestSanitizePlainQuotedSecretsAsCompleteValues(t *testing.T) {
	raw := `apiKey="two word secret" token:'single quoted secret' password = "space pass" api_key="escaped \"secret\" value"`
	result := Sanitize(raw, 500)

	for _, secret := range []string{"two word secret", "word secret", "single quoted secret", "quoted secret", "space pass", `escaped \"secret\" value`} {
		require.NotContains(t, result, secret)
	}
	require.Equal(t, `apiKey=<redacted> token:<redacted> password = <redacted> api_key=<redacted>`, result)
}

func TestSanitizeTruncatesByRune(t *testing.T) {
	result := Sanitize(strings.Repeat("界", 10), 4)
	require.Equal(t, "界界界界… [display truncated]", result)
}