using System.Collections.Generic;
using ZB.MOM.WW.MxGateway.Worker.Bootstrap;

namespace ZB.MOM.WW.MxGateway.Worker.Tests.Bootstrap;

public sealed class WorkerLogRedactorTests
{
    /// <summary>
    /// Verifies sensitive fields are redacted in log dictionaries.
    /// </summary>
    [Fact]
    public void RedactFields_RedactsNonceSecretPasswordTokenCredentialAndApiKeyFields()
    {
        Dictionary<string, object?> fields = new()
        {
            ["nonce"] = "nonce-secret",
            ["client_secret"] = "secret",
            ["password"] = "password",
            ["auth_token"] = "token",
            ["credential_value"] = "credential",
            ["api_key"] = "key",
            ["session_id"] = "session-1",
        };

        Dictionary<string, object?> redacted = WorkerLogRedactor.RedactFields(fields);

        Assert.Equal("[redacted]", redacted["nonce"]);
        Assert.Equal("[redacted]", redacted["client_secret"]);
        Assert.Equal("[redacted]", redacted["password"]);
        Assert.Equal("[redacted]", redacted["auth_token"]);
        Assert.Equal("[redacted]", redacted["credential_value"]);
        Assert.Equal("[redacted]", redacted["api_key"]);
        Assert.Equal("session-1", redacted["session_id"]);
    }

    /// <summary>
    /// Verifies <see cref="WorkerLogRedactor.RedactValue"/> redacts individual
    /// credential-bearing fields before they reach a log sink.
    /// </summary>
    [Fact]
    public void RedactValue_WithCredentialBearingFieldNames_ReturnsRedactedValue()
    {
        Assert.Equal(WorkerLogRedactor.RedactedValue, WorkerLogRedactor.RedactValue("credential_value", "secret"));
        Assert.Equal(WorkerLogRedactor.RedactedValue, WorkerLogRedactor.RedactValue("password_value", "secret"));
        Assert.Equal(WorkerLogRedactor.RedactedValue, WorkerLogRedactor.RedactValue("secured_write_token", "secret"));
    }
}
