package guardrail

import (
	"strings"
	"testing"
)

func TestSanitizeTextMasksCommonSecrets(t *testing.T) {
	input := "Authorization: Bearer abcdefghijklmnopqrstuvwxyz password=secret123 mysql://root:pass@db/prod"
	got := SanitizeText(input)
	for _, leak := range []string{"abcdefghijklmnopqrstuvwxyz", "secret123", "root:pass@db"} {
		if strings.Contains(got, leak) {
			t.Fatalf("敏感信息未脱敏: %s in %s", leak, got)
		}
	}
	if !strings.Contains(got, "[REDACTED]") {
		t.Fatalf("脱敏标记缺失: %s", got)
	}
}

func TestSanitizeJSONMasksSensitiveKeys(t *testing.T) {
	got := SanitizeJSON(`{"command":"echo ok","password":"p1","nested":{"api_key":"k1"}}`)
	for _, leak := range []string{"p1", "k1"} {
		if strings.Contains(got, leak) {
			t.Fatalf("JSON 敏感字段未脱敏: %s in %s", leak, got)
		}
	}
	if !strings.Contains(got, `"command":"echo ok"`) {
		t.Fatalf("非敏感字段不应被改写: %s", got)
	}
}