package guardrail

import (
	"strings"
	"testing"
)

func TestSanitizeTextMasksCommonSecrets(t *testing.T) {
	input := "Authorization: Bearer abcdefghijklmnopqrstuvwxyz password=secret123 mysql://root:pass@db/prod AKIA1234567890ABCDEF"
	got := SanitizeText(input)
	for _, leak := range []string{"abcdefghijklmnopqrstuvwxyz", "secret123", "root:pass@db", "AKIA1234567890ABCDEF"} {
		if strings.Contains(got, leak) {
			t.Fatalf("敏感信息未脱敏: %s in %s", leak, got)
		}
	}
	if !strings.Contains(got, "[REDACTED]") {
		t.Fatalf("脱敏标记缺失: %s", got)
	}
}

func TestSanitizeJSONMasksSensitiveKeys(t *testing.T) {
	got := SanitizeJSON(`{"command":"echo ok","password":"p1","nested":{"api_key":"k1"}}`)
	for _, leak := range []string{"p1", "k1"} {
		if strings.Contains(got, leak) {
			t.Fatalf("JSON 敏感字段未脱敏: %s in %s", leak, got)
		}
	}
	if !strings.Contains(got, `"command":"echo ok"`) {
		t.Fatalf("非敏感字段不应被改写: %s", got)
	}
}

func TestSanitizeMapReturnsMaskedCopy(t *testing.T) {
	input := map[string]interface{}{
		"command": "curl -H 'Authorization: Bearer abcdefghijklmnop' https://example.test",
		"nested":  map[string]interface{}{"password": "plain-secret"},
	}

	got := SanitizeMap(input)
	if got["command"] == input["command"] {
		t.Fatal("命令中的令牌未脱敏")
	}
	nested := got["nested"].(map[string]interface{})
	if nested["password"] != "[REDACTED]" {
		t.Fatalf("密码字段未脱敏: %#v", nested["password"])
	}
	if input["nested"].(map[string]interface{})["password"] != "plain-secret" {
		t.Fatal("脱敏不得修改原始参数")
	}
}