import { describe, expect, it } from "vitest";

import { safeDiagnosticText } from "./safeDiagnosticText";

describe("safeDiagnosticText", () => {
  it("redacts raw credentials, host internals, sockets, process ids, DSNs, and private endpoints", () => {
    const unsafe = [
      "Bearer live-token-value",
      "apiKey=sk-super-secret-value",
      "secret://providers/production",
      "/Users/operator/private/config.json",
      "PID=48192",
      "unix:///var/run/platform.sock",
      "postgres://operator:password@db.internal/platform",
      "RCON_PASSWORD=hunter2",
      "http://127.0.0.1:18197/run/control"
    ].join(" | ");

    const result = safeDiagnosticText(unsafe) ?? "";
    for (const forbidden of ["live-token", "sk-super", "providers/production", "/Users/", "48192", "/var/run/", "operator:password", "hunter2", "127.0.0.1"]) {
      expect(result).not.toContain(forbidden);
    }
  });

  it("preserves safe operational wording instead of matching labels alone", () => {
    const safe = "密钥状态已配置；Base URL 由平台托管；token 不会下发；RCON 数据不会下发。";
    expect(safeDiagnosticText(safe)).toBe(safe);
  });
});