import { describe, expect, it } from "vitest";
import {
  renderApprovalReasonForHistory,
  renderShellArgvForHistory,
  summarizeCapabilityRequestForHistory,
  toHistorySafeCapabilityRequest,
} from "./capability-history.js";

describe("capability history", () => {
  it("redacts secret-like tokens in short shell display text", () => {
    const rendered = renderShellArgvForHistory([
      "curl",
      "-H",
      "Authorization: Bearer sk-1234567890abcdef",
      "https://api.example.com",
    ]);

    expect(rendered).toContain("curl");
    expect(rendered).toContain("Bearer [secret-redacted]");
    expect(rendered).not.toContain("sk-1234567890abcdef");
  });

  it("redacts short shell secrets from history-safe capability requests", () => {
    const safe = toHistorySafeCapabilityRequest({
      argv: ["curl", "-H", "Authorization: Bearer sk-1234567890abcdef"],
      cwd: "/repo",
      group: "shell",
      reason: "Command includes Bearer sk-1234567890abcdef",
    });

    expect(JSON.stringify(safe)).not.toContain("sk-1234567890abcdef");
    expect(JSON.stringify(safe)).toContain("Bearer [secret-redacted]");
  });

  it("redacts split bearer tokens in history-safe capability request argv", () => {
    const safe = toHistorySafeCapabilityRequest({
      argv: ["curl", "-H", "Authorization: Bearer", "abcdefghijklmnop1234"],
      cwd: "/repo",
      group: "shell",
    });

    expect(JSON.stringify(safe)).not.toContain("abcdefghijklmnop1234");
    expect(JSON.stringify(safe)).toContain("[secret-redacted]");
  });

  it("redacts basic authorization tokens in short shell display text", () => {
    const rendered = renderShellArgvForHistory([
      "curl",
      "-H",
      "Authorization: Basic dXNlcjpwYXNz",
      "https://api.example.com",
    ]);

    expect(rendered).toContain("Basic [secret-redacted]");
    expect(rendered).not.toContain("dXNlcjpwYXNz");
  });

  it("redacts three-part split authorization bearer tokens", () => {
    const requests = [
      ["curl", "-H", "Authorization:", "Bearer", "abcdefghijklmnop1234"],
      ["curl", "-H", "Authorization", "Bearer", "abcdefghijklmnop1234"],
      ["curl", "-H", "Authorization:", "Basic", "dXNlcjpwYXNz"],
      ["curl", "-H", "Authorization:", "Token", "abcdefghijklmnop1234"],
    ];

    for (const argv of requests) {
      const safe = toHistorySafeCapabilityRequest({
        argv,
        cwd: "/repo",
        group: "shell",
      });

      expect(JSON.stringify(safe)).not.toContain("abcdefghijklmnop1234");
      expect(JSON.stringify(safe)).toContain("[secret-redacted]");
    }
  });

  it("redacts split api key headers in history-safe shell argv", () => {
    const safe = toHistorySafeCapabilityRequest({
      argv: ["curl", "-H", "X-API-Key:", "abc123"],
      cwd: "/repo",
      group: "shell",
    });

    expect(JSON.stringify(safe)).not.toContain("abc123");
    expect(JSON.stringify(safe)).toContain("[secret-redacted]");
  });

  it("redacts inline api key headers in short shell display text", () => {
    const rendered = renderShellArgvForHistory(["curl", "-H", "API_KEY=abc123"]);

    expect(rendered).not.toContain("abc123");
    expect(rendered).toContain("API_KEY=[secret-redacted]");
  });

  it("redacts secrets from non-shell capability request reasons", () => {
    const safe = toHistorySafeCapabilityRequest({
      group: "network",
      host: "api.example.com",
      reason: "Uses Authorization: Bearer sk-1234567890abcdef",
    });

    expect(JSON.stringify(safe)).not.toContain("sk-1234567890abcdef");
    expect(JSON.stringify(safe)).toContain("Bearer [secret-redacted]");
  });

  it("redacts secret-like non-shell identity fields from history-safe requests", () => {
    expect(
      JSON.stringify(
        toHistorySafeCapabilityRequest({
          group: "network",
          host: "api.example.com?token=sk-12345678",
        }),
      ),
    ).not.toContain("sk-12345678");
    expect(
      JSON.stringify(
        toHistorySafeCapabilityRequest({
          action: "read",
          group: "filesystem",
          path: "/tmp/sk-12345678",
          roots: ["/tmp/sk-12345678"],
        }),
      ),
    ).not.toContain("sk-12345678");
  });

  it("redacts short approval reason secrets", () => {
    const rendered = renderApprovalReasonForHistory(
      "Command curl -H 'Authorization: Bearer sk-1234567890abcdef' requires approval",
    );

    expect(rendered).toContain("Bearer [secret-redacted]");
    expect(rendered).not.toContain("sk-1234567890abcdef");
  });

  it("redacts secrets from capability history summaries", () => {
    expect(
      summarizeCapabilityRequestForHistory({
        group: "network",
        host: "api.example.com?token=sk-12345678",
      }),
    ).not.toContain("sk-12345678");
    expect(
      summarizeCapabilityRequestForHistory({
        action: "read",
        group: "filesystem",
        path: "/tmp/sk-12345678",
      }),
    ).not.toContain("sk-12345678");
  });
});
