package redact

import (
	"strings"
	"testing"

	agent "github.com/tidbcloud/dataflow-service/dataflow-agent-ng/idl/pbgen/proto/ng_agent"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

func TestRedactKeysToJSON_CheckAliOSSAccessReq(t *testing.T) {
	req := &agent.CheckAliOSSAccessReq{
		OssUri:         "oss://bucket/prefix",
		OssAccessKeyId: "AKIDEXAMPLE",
		OssAccessKeySecret: &agent.EncryptedData{
			Data: []byte("ciphertext"),
			Pem:  []byte("-----BEGIN PUBLIC KEY-----"),
		},
		Endpoint: "oss-cn-hangzhou.aliyuncs.com",
	}
	payload, err := RedactKeysToJSON(PasswordFields, req)
	require.NoError(t, err)
	out := string(payload)
	assert.Contains(t, out, `"oss_access_key_id":"redacted"`)
	assert.NotContains(t, out, "AKIDEXAMPLE")
	assert.NotContains(t, out, "ciphertext")
	assert.True(t, strings.Contains(out, `"oss_access_key_secret":null`) ||
		strings.Contains(out, `"oss_access_key_secret":{}`))
}

func TestRedactKeysToJSON_PrecheckImportS3AccessKeySecret(t *testing.T) {
	req := &agent.PrecheckImportJobReq{
		Source: &agent.ImportSource{
			Type: agent.ImportSourceType_S3,
			Source: &agent.ImportSource_S3{
				S3: &agent.S3Source{
					Uri:      "s3://bucket/prefix",
					AuthType: agent.ImportS3AuthType_ACCESS_KEY,
					Auth: &agent.S3Source_AccessKey_{
						AccessKey: &agent.S3Source_AccessKey{
							Id:     "AKIAEXAMPLE",
							Secret: "super-secret",
						},
					},
				},
			},
		},
	}
	payload, err := RedactKeysToJSON(PasswordFields, req)
	require.NoError(t, err)
	assert.NotContains(t, string(payload), "super-secret")
}