package audit

import (
	"bytes"
	"os"
	"path/filepath"
	"strings"
	"testing"
)

func TestLoggerRedactsSecrets(t *testing.T) {
	path := filepath.Join(t.TempDir(), "agent.log")
	var console bytes.Buffer
	l, err := New(&console, path, false)
	if err != nil {
		t.Fatal(err)
	}
	l.AddSecret("sk-supersecretvalue123", "sk-sup...123")
	l.Infof("connecting with key sk-supersecretvalue123")
	l.Warnf("warn sk-supersecretvalue123")
	l.Action("task", "cli", "command", "curl -H 'Bearer sk-supersecretvalue123'")
	l.Debugf("hidden debug")
	l.Close()

	data, _ := os.ReadFile(path)
	all := string(data) + console.String()
	if strings.Contains(all, "sk-supersecretvalue123") {
		t.Fatalf("secret leaked:\n%s", all)
	}
	if !strings.Contains(string(data), "sk-sup...123") || !strings.Contains(string(data), "ACTION task=\"cli\"") {
		t.Errorf("log content:\n%s", data)
	}
	if strings.Contains(all, "hidden debug") {
		t.Error("DEBUG must be hidden without --verbose")
	}
	if strings.Contains(console.String(), "connecting") {
		t.Error("INFO must not reach console without --verbose")
	}
	st, _ := os.Stat(path)
	if st.Mode().Perm() != 0o600 {
		t.Errorf("perm = %o", st.Mode().Perm())
	}
}