package logging

import (
	"bytes"
	"errors"
	"strings"
	"testing"
)

func TestJSONLoggerRedactsSensitiveAttributesAndErrorText(t *testing.T) {
	var output bytes.Buffer
	logger := NewJSONLogger(&output)
	logger.Error("provider fetch failed",
		"password", "password-marker",
		"apiToken", "token-marker",
		"provider_url", "https://user:proxy-secret@example.test/path?api_key=query-secret",
		"error", errors.New("unmarked-secret authorization=header-secret bearer bearer-secret"),
	)

	text := output.String()
	for _, secret := range []string{"password-marker", "token-marker", "proxy-secret", "query-secret", "unmarked-secret", "header-secret", "bearer-secret"} {
		if strings.Contains(text, secret) {
			t.Fatalf("structured log leaked %q: %s", secret, text)
		}
	}
	if !strings.Contains(text, "[REDACTED]") || !strings.Contains(text, `"msg":"provider fetch failed"`) {
		t.Fatalf("structured log did not preserve message and redaction: %s", text)
	}
}

func TestWriteProcessErrorProducesStructuredRedactedEvent(t *testing.T) {
	var output bytes.Buffer
	WriteProcessError(&output, "proxy-controller", errors.New("unmarked-secret"))
	text := output.String()
	if strings.Contains(text, "unmarked-secret") {
		t.Fatalf("process error was not redacted: %s", text)
	}
	if !strings.Contains(text, `"msg":"process failed"`) || !strings.Contains(text, `"component":"proxy-controller"`) {
		t.Fatalf("process error is not structured: %s", text)
	}
}