import { describe, expect, it } from 'bun:test'
import { redactEnv } from './env-redact'

describe('redactEnv, Router credentials (v2)', () => {
  it('removes every OG_ROUTER_* secret variant', () => {
    const { env, removed } = redactEnv({
      OG_ROUTER_SK: 'sk-secret',
      OG_ROUTER_MK: 'mk-secret',
      OG_ROUTER_TOKEN: 'jwt-secret',
      OG_ROUTER_JWT: 'jwt-secret',
      OG_ROUTER_MANAGEMENT_KEY: 'mk-secret',
      OG_ROUTER_BEARER: 'sk-secret',
      OG_ROUTER_API_KEY: 'sk-secret',
    })
    expect(Object.keys(env)).toHaveLength(0)
    expect(removed.sort()).toEqual(
      [
        'OG_ROUTER_API_KEY',
        'OG_ROUTER_BEARER',
        'OG_ROUTER_JWT',
        'OG_ROUTER_MANAGEMENT_KEY',
        'OG_ROUTER_MK',
        'OG_ROUTER_SK',
        'OG_ROUTER_TOKEN',
      ].sort(),
    )
  })

  it('still passes through benign vars', () => {
    const { env, removed } = redactEnv({ PATH: '/usr/bin', HOME: '/home/x', TERM: 'xterm' })
    expect(env).toEqual({ PATH: '/usr/bin', HOME: '/home/x', TERM: 'xterm' })
    expect(removed).toEqual([])
  })

  it('keeps redacting the existing floors (privkey, generic API_KEY)', () => {
    const { env, removed } = redactEnv({
      ANIMA_AGENT_PRIVKEY: 'x',
      OG_PRIVKEY: 'x',
      SOME_API_KEY: 'x',
      OPENAI_API_KEY: 'x',
      KEEP_ME: 'ok',
    })
    expect(env).toEqual({ KEEP_ME: 'ok' })
    expect(removed.sort()).toEqual(
      ['ANIMA_AGENT_PRIVKEY', 'OG_PRIVKEY', 'OPENAI_API_KEY', 'SOME_API_KEY'].sort(),
    )
  })

  it('OG_ROUTER_MK / _TOKEN would NOT match the generic catch-all alone (regression guard)', () => {
    // The generic rule only catches *_API_KEY/_SECRET/etc; the dedicated
    // /^OG_ROUTER_/i rule is what removes _MK / _TOKEN / _JWT. Removing the
    // dedicated rule would leak these, assert they are gone.
    const { env } = redactEnv({ OG_ROUTER_MK: 'mk-x', OG_ROUTER_TOKEN: 't', OG_ROUTER_JWT: 'j' })
    expect(env).toEqual({})
  })
})