use std::collections::BTreeMap;

use remora_credentials::{SecretMaterial, VaultConfig};

#[test]
fn secret_material_debug_and_display_redact_values() {
    let material = SecretMaterial::BearerToken {
        token: "super-secret-token-value".into(),
    };
    let debug = format!("{material:?}");
    let display = format!("{material}");
    assert!(!debug.contains("super-secret-token-value"));
    assert!(debug.contains("REDACTED"));
    assert!(!display.contains("super-secret-token-value"));
    assert_eq!(display, "SecretMaterial(bearer_token)");

    let headers = SecretMaterial::HttpHeaders {
        headers: BTreeMap::from([("x-api-key".into(), "header-secret".into())]),
    };
    let debug = format!("{headers:?}");
    assert!(!debug.contains("header-secret"));
    assert!(debug.contains("REDACTED"));
}

#[test]
fn vault_config_debug_redacts_token() {
    let config = VaultConfig {
        address: "http://vault:8200".into(),
        token: "synthetic-vault-token".into(),
        mount: "secret".into(),
        path_prefix: "remora/lane-0".into(),
        timeout: std::time::Duration::from_secs(1),
    };
    let debug = format!("{config:?}");
    assert!(!debug.contains("synthetic-vault-token"));
    assert!(debug.contains("REDACTED"));
}

#[test]
fn error_messages_never_embed_secret_literals() {
    let material = SecretMaterial::BasicAuth {
        username: "alice".into(),
        password: "p@ssw0rd-should-not-leak".into(),
    };
    let err = remora_credentials::CredentialError::InvalidInput(format!(
        "validated kind {}",
        material.kind().as_str()
    ));
    let text = err.to_string();
    assert!(!text.contains("p@ssw0rd-should-not-leak"));
    assert!(err.is_safe_for_logs());
}

#[test]
fn material_validation_rejects_empty_and_forbidden_headers() {
    let empty = SecretMaterial::BearerToken {
        token: String::new(),
    };
    assert!(empty.validate().is_err());

    let forbidden = SecretMaterial::HttpHeaders {
        headers: BTreeMap::from([("authorization".into(), "Bearer x".into())]),
    };
    assert!(forbidden.validate().is_err());
}