import { describe, it, expect, jest, beforeEach } from '@jest/globals';
import { SafeLogger, sanitizeObject } from '../src/utils/safe-logger.js';
import { logger } from '../src/utils/logger.js';

// Mock the logger module before it's used
jest.mock('../src/utils/logger', () => ({
  logger: {
    debug: jest.fn(),
    info: jest.fn(),
    warn: jest.fn(),
    error: jest.fn(),
  },
}));

describe('sanitizeObject', () => {
  describe('primitive types', () => {
    it('should return null as-is', () => {
      expect(sanitizeObject(null)).toBe(null);
    });

    it('should return undefined as-is', () => {
      expect(sanitizeObject(undefined)).toBe(undefined);
    });

    it('should return numbers as-is', () => {
      expect(sanitizeObject(42)).toBe(42);
      expect(sanitizeObject(0)).toBe(0);
      expect(sanitizeObject(-1.5)).toBe(-1.5);
    });

    it('should return booleans as-is', () => {
      expect(sanitizeObject(true)).toBe(true);
      expect(sanitizeObject(false)).toBe(false);
    });

    it('should return regular strings as-is', () => {
      expect(sanitizeObject('hello world')).toBe('hello world');
      expect(sanitizeObject('')).toBe('');
    });

    it('should redact long base64-like strings', () => {
      // Pattern matches: alphanumeric + base64 chars (+/=), length > 20
      const sensitiveString = 'abcdefghijklmnopqrstuvwxyz123456789ABCD';
      const result = sanitizeObject(sensitiveString);
      expect(result).toMatch(/\[REDACTED:\d+chars\]/);
    });

    it('should not redact normal long strings', () => {
      const normalLongString = 'This is a normal sentence that is longer than 20 characters.';
      expect(sanitizeObject(normalLongString)).toBe(normalLongString);
    });
  });

  describe('arrays', () => {
    it('should recursively sanitize array elements', () => {
      const input = ['hello', { apiKey: 'secret123' }, 42];
      const result = sanitizeObject(input) as unknown[];

      expect(result[0]).toBe('hello');
      expect((result[1] as Record<string, unknown>).apiKey).toMatch(/\[REDACTED/);
      expect(result[2]).toBe(42);
    });

    it('should handle empty arrays', () => {
      expect(sanitizeObject([])).toEqual([]);
    });

    it('should handle nested arrays', () => {
      const input = [[{ password: 'secret' }]];
      const result = sanitizeObject(input) as unknown[][];

      expect((result[0][0] as Record<string, unknown>).password).toMatch(/\[REDACTED/);
    });
  });

  describe('objects', () => {
    it('should redact sensitive fields', () => {
      const sensitiveFields = [
        'password',
        'apiKey',
        'api_key',
        'token',
        'secret',
        'auth',
        'authorization',
        'cookie',
        'session',
        'private_key',
        'privateKey',
        'client_secret',
        'clientSecret',
      ];

      for (const field of sensitiveFields) {
        const input = { [field]: 'sensitive_value' };
        const result = sanitizeObject(input) as Record<string, unknown>;
        expect(result[field]).toMatch(/\[REDACTED/);
      }
    });

    it('should redact fields matching patterns', () => {
      const input = {
        userPassword: 'secret',
        awsSecretAccessKey: 'key123',
        authToken: 'tok123',
        sessionCookie: 'cookie123',
      };

      const result = sanitizeObject(input) as Record<string, unknown>;

      expect(result.userPassword).toMatch(/\[REDACTED/);
      expect(result.awsSecretAccessKey).toMatch(/\[REDACTED/);
      expect(result.authToken).toMatch(/\[REDACTED/);
      expect(result.sessionCookie).toMatch(/\[REDACTED/);
    });

    it('should not redact non-sensitive fields', () => {
      const input = {
        username: 'john',
        email: 'john@example.com',
        id: 123,
      };

      const result = sanitizeObject(input) as Record<string, unknown>;

      expect(result.username).toBe('john');
      expect(result.email).toBe('john@example.com');
      expect(result.id).toBe(123);
    });

    it('should handle nested objects', () => {
      const input = {
        user: {
          credentials: {
            password: 'secret',
          },
        },
      };

      const result = sanitizeObject(input) as Record<string, unknown>;
      const nested = (result.user as Record<string, unknown>).credentials as Record<string, unknown>;

      expect(nested.password).toMatch(/\[REDACTED/);
    });

    it('should include length for string sensitive values', () => {
      const input = { password: 'secret123' };
      const result = sanitizeObject(input) as Record<string, unknown>;

      expect(result.password).toBe('[REDACTED:9chars]');
    });

    it('should use simple REDACTED for non-string sensitive values', () => {
      const input = { password: 12345, apiKey: null, token: undefined };
      const result = sanitizeObject(input) as Record<string, unknown>;

      expect(result.password).toBe('[REDACTED]');
      expect(result.apiKey).toBe('[REDACTED]');
      expect(result.token).toBe('[REDACTED]');
    });

    it('should use simple REDACTED for empty string sensitive values', () => {
      const input = { password: '' };
      const result = sanitizeObject(input) as Record<string, unknown>;

      expect(result.password).toBe('[REDACTED]');
    });
  });

  describe('max depth handling', () => {
    it('should stop at max depth and return placeholder', () => {
      const deepObject = {
        l1: { l2: { l3: { l4: { l5: { l6: 'too deep' } } } } },
      };

      const result = sanitizeObject(deepObject) as Record<string, unknown>;
      const l5 = (
        (((result.l1 as Record<string, unknown>).l2 as Record<string, unknown>).l3 as Record<string, unknown>)
          .l4 as Record<string, unknown>
      ).l5 as string;

      expect(l5).toBe('[Max depth exceeded]');
    });

    it('should respect custom max depth', () => {
      const object = { l1: { l2: { l3: 'value' } } };

      const result = sanitizeObject(object, 2) as Record<string, unknown>;
      const l2 = (result.l1 as Record<string, unknown>).l2 as string;

      expect(l2).toBe('[Max depth exceeded]');
    });
  });

  describe('edge cases', () => {
    it('should handle functions (return as-is)', () => {
      const fn = () => 'test';
      expect(sanitizeObject(fn)).toBe(fn);
    });

    it('should handle symbols (return as-is)', () => {
      const sym = Symbol('test');
      expect(sanitizeObject(sym)).toBe(sym);
    });
  });
});

describe('SafeLogger', () => {
  // The SafeLogger methods internally call the logger and sanitizeObject
  // We test the sanitization logic separately; here we just ensure the methods don't throw

  describe('logging methods', () => {
    it('should call debug without throwing', () => {
      expect(() => SafeLogger.debug('test message')).not.toThrow();
      expect(() => SafeLogger.debug('test', { data: 'value' })).not.toThrow();
    });

    it('should call info without throwing', () => {
      expect(() => SafeLogger.info('info message')).not.toThrow();
      expect(() => SafeLogger.info('info', { data: 'value' })).not.toThrow();
    });

    it('should call warn without throwing', () => {
      expect(() => SafeLogger.warn('warning message')).not.toThrow();
      expect(() => SafeLogger.warn('warning', { data: 'value' })).not.toThrow();
    });

    it('should call error without throwing', () => {
      expect(() => SafeLogger.error('error message')).not.toThrow();
      expect(() => SafeLogger.error('error', { data: 'value' })).not.toThrow();
    });
  });
});

describe('SafeLogger.sanitizeToolArgs', () => {
  it('should sanitize regular sensitive fields', () => {
    const args = { password: 'secret', query: 'SELECT *' };
    const result = SafeLogger.sanitizeToolArgs(args) as Record<string, unknown>;

    expect(result.password).toMatch(/\[REDACTED/);
    expect(result.query).toBe('SELECT *');
  });

  it('should sanitize Unix file paths with usernames', () => {
    const args = { path: '/Users/johndoe/Documents/file.txt' };
    const result = SafeLogger.sanitizeToolArgs(args) as Record<string, unknown>;

    expect(result.path).toBe('/Users/[USER]/Documents/file.txt');
  });

  it('should sanitize Windows file paths with usernames', () => {
    const args = { path: '\\Users\\johndoe\\Documents\\file.txt' };
    const result = SafeLogger.sanitizeToolArgs(args) as Record<string, unknown>;

    expect(result.path).toBe('\\Users\\[USER]\\Documents\\file.txt');
  });

  it('should sanitize URLs with credentials', () => {
    const args = { url: 'https://admin:password123@api.example.com/data' };
    const result = SafeLogger.sanitizeToolArgs(args) as Record<string, unknown>;

    expect(result.url).toBe('https://[USER]:[REDACTED]@api.example.com/data');
  });

  it('should handle URLs without credentials', () => {
    const args = { url: 'https://api.example.com/data' };
    const result = SafeLogger.sanitizeToolArgs(args) as Record<string, unknown>;

    expect(result.url).toBe('https://api.example.com/data');
  });

  it('should handle non-object input', () => {
    expect(SafeLogger.sanitizeToolArgs('string')).toBe('string');
    expect(SafeLogger.sanitizeToolArgs(123)).toBe(123);
    expect(SafeLogger.sanitizeToolArgs(null)).toBe(null);
  });

  it('should handle object without path or url', () => {
    const args = { query: 'SELECT * FROM users' };
    const result = SafeLogger.sanitizeToolArgs(args) as Record<string, unknown>;

    expect(result.query).toBe('SELECT * FROM users');
  });
});

describe('SafeLogger.createApprovalMessage', () => {
  it('should create approval message with sanitized args', () => {
    const message = SafeLogger.createApprovalMessage(
      'TestDuck',
      'filesystem',
      'read_file',
      { path: '/Users/john/document.txt', password: 'mysecretpassword' }
    );

    expect(message).toContain('TestDuck');
    expect(message).toContain('filesystem:read_file');
    expect(message).toContain('[USER]');
    expect(message).toContain('[REDACTED');
    expect(message).not.toContain('john');
    expect(message).not.toContain('mysecretpassword');
  });

  it('should format args as JSON', () => {
    const message = SafeLogger.createApprovalMessage(
      'Duck',
      'server',
      'tool',
      { simple: 'value' }
    );

    expect(message).toContain('"simple"');
    expect(message).toContain('"value"');
  });
});