package services

import "testing"

// TestPromtailConfigForHostRejectsForbiddenDefaultLogPath 敏感路径防护不得只覆盖 ScrapeJobs 分支:
// 默认 LogPath 填 /etc/shadow、/root/.ssh/id_rsa 同样必须被拒绝(否则主机凭据被采进日志平台)。
func TestPromtailConfigForHostRejectsForbiddenDefaultLogPath(t *testing.T) {
	bad := []string{"/etc/shadow", "/root/.ssh/id_rsa", "/proc/self/mem", "/etc/ssh/ssh_host_rsa_key"}
	for _, path := range bad {
		_, err := PromtailConfigForHost(HostPromtailOptions{
			Hostname: "h1",
			LogPath:  path,
		})
		if err == nil {
			t.Errorf("默认 LogPath=%q 应被拒绝(敏感路径)", path)
		}
	}
	// 正常业务路径不受影响
	if _, err := PromtailConfigForHost(HostPromtailOptions{
		Hostname: "h1",
		LogPath:  "/var/log/app/*.log",
	}); err != nil {
		t.Errorf("正常 LogPath 不应报错: %v", err)
	}
}