namespace ZB.MOM.WW.ScadaBridge.ManagementService.Tests;

public class ConfigSecretScrubberTests
{
    [Fact]
    public void Scrub_RedactsPasswordFields_AtAnyDepth()
    {
        var json = """{"Endpoint":"opc.tcp://x","UserIdentity":{"Username":"u","Password":"p"},"CertificatePassword":"cp"}""";
        var (scrubbed, had) = ConfigSecretScrubber.Scrub(json);
        Assert.True(had);
        Assert.DoesNotContain("\"p\"", scrubbed);
        Assert.DoesNotContain("\"cp\"", scrubbed);
        Assert.Contains(ConfigSecretScrubber.Sentinel, scrubbed);
        Assert.Contains("opc.tcp://x", scrubbed); // non-secrets untouched
    }

    [Fact]
    public void Scrub_NoSecrets_ReturnsFalseFlag()
    {
        var (_, had) = ConfigSecretScrubber.Scrub("""{"Endpoint":"opc.tcp://x"}""");
        Assert.False(had);
    }

    [Theory]
    [InlineData(null)]
    [InlineData("")]
    [InlineData("not-json{")]
    public void Scrub_NullEmptyOrMalformed_PassesThrough(string? input)
    {
        var (scrubbed, had) = ConfigSecretScrubber.Scrub(input);
        Assert.Equal(input, scrubbed);
        Assert.False(had);
    }

    [Fact]
    public void MergeSentinels_RestoresStoredSecrets_KeepsEdits()
    {
        var stored = """{"Endpoint":"old","UserIdentity":{"Password":"real"}}""";
        var incoming = $$$"""{"Endpoint":"new","UserIdentity":{"Password":"{{{ConfigSecretScrubber.Sentinel}}}"}}""";
        var merged = ConfigSecretScrubber.MergeSentinels(incoming, stored)!;
        Assert.Contains("\"new\"", merged);
        Assert.Contains("\"real\"", merged);
        Assert.DoesNotContain(ConfigSecretScrubber.Sentinel, merged);
    }
}