package logredact

import (
	"bytes"
	"log"
	"log/slog"
	"strings"
	"testing"
)

func TestStringRedactsEmailAndSecrets(t *testing.T) {
	t.Parallel()
	in := `user demo@example.com Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.aaa.bbb sk_live_abc123XYZ api_key=supersecret postgres://user:pass@localhost:5432/db`
	out := String(in)
	for _, forbidden := range []string{
		"demo@example.com",
		"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9",
		"sk_live_abc123XYZ",
		"supersecret",
		"user:pass@",
	} {
		if strings.Contains(out, forbidden) {
			t.Fatalf("expected %q redacted, got %q", forbidden, out)
		}
	}
	if !strings.Contains(out, Redacted) {
		t.Fatalf("expected %s in %q", Redacted, out)
	}
	if !strings.Contains(out, "postgres://") {
		t.Fatalf("expected scheme preserved, got %q", out)
	}
}

func TestSlogJSONHandlerRedacts(t *testing.T) {
	t.Parallel()
	var buf bytes.Buffer
	logger := slog.New(NewJSONHandler(&buf, &slog.HandlerOptions{Level: slog.LevelInfo}))
	logger.Info("login", "email", "ops@descrybe.test", "token", "sk_test_abcdef")
	got := buf.String()
	if strings.Contains(got, "ops@descrybe.test") || strings.Contains(got, "sk_test_abcdef") {
		t.Fatalf("PII leaked: %s", got)
	}
	if !strings.Contains(got, Redacted) {
		t.Fatalf("expected redaction marker: %s", got)
	}
}

func TestWriterRedactsStdlog(t *testing.T) {
	t.Parallel()
	var buf bytes.Buffer
	l := log.New(Writer(&buf), "", 0)
	l.Printf("mail to alice@example.com failed")
	got := buf.String()
	if strings.Contains(got, "alice@example.com") {
		t.Fatalf("email leaked: %s", got)
	}
	if !strings.Contains(got, Redacted) {
		t.Fatalf("expected redaction: %s", got)
	}
}