"use strict";
/**
 * test_gateway_telegram_guardrails.ts — Story 4.3
 *
 * Asserts the v1.3 Telegram guardrails on Gateway:
 *   1. Gateway.redactBotToken() masks token-shaped strings in any text
 *   2. Gateway.validateBotToken() returns {ok:false, error:'token_missing'}
 *      when env is unset
 *   3. Gateway.validateBotToken() returns {ok:false} with a fake token
 *      (no network call to api.telegram.org will succeed)
 */
Object.defineProperty(exports, "__esModule", { value: true });
const Gateway_1 = require("./orchestrator/Gateway");
function assertTrue(cond, label) {
    if (!cond)
        throw new Error(`ASSERT_FAILED[${label}]`);
}
async function main() {
    // ── Scenario 1: redactBotToken masks secret half ───────────────────
    const sample = 'Calling https://api.telegram.org/bot123456789:ABCdef0123_HIJ-KLMNOpqrstUvwxyz0123 with parameter foo';
    const redacted = Gateway_1.Gateway.redactBotToken(sample);
    assertTrue(!redacted.includes('ABCdef0123_HIJ-KLMNOpqrstUvwxyz0123'), 'token body removed');
    assertTrue(redacted.includes('123456789:[REDACTED]'), 'numeric prefix kept, body masked');
    console.log('[4.3] redactBotToken masks the secret ✓');
    // ── Scenario 2: validateBotToken returns token_missing when unset ──
    const origToken = process.env.TELEGRAM_BOT_TOKEN;
    delete process.env.TELEGRAM_BOT_TOKEN;
    const gw = new Gateway_1.Gateway();
    const r1 = await gw.validateBotToken({ timeoutMs: 1000 });
    assertTrue(!r1.ok && r1.error === 'token_missing', 'token_missing on unset env');
    console.log('[4.3] validateBotToken: token_missing on unset env ✓');
    // ── Scenario 3: validateBotToken returns non-ok with fake token ────
    process.env.TELEGRAM_BOT_TOKEN = '000000:fake_token_for_test_purposes_only_xxxxxxxxxx';
    const gw2 = new Gateway_1.Gateway();
    const r2 = await gw2.validateBotToken({ timeoutMs: 3000 });
    assertTrue(!r2.ok, `validateBotToken returns non-ok with fake token (got ${JSON.stringify(r2)})`);
    // Don't assert the exact error code — could be 401 (real Telegram response)
    // or 408 (timeout) or getme_exception (offline). Just non-ok is the contract.
    console.log(`[4.3] validateBotToken: fake token rejected (${r2.ok ? 'ok' : r2.error}) ✓`);
    // Restore env
    if (origToken !== undefined) {
        process.env.TELEGRAM_BOT_TOKEN = origToken;
    }
    else {
        delete process.env.TELEGRAM_BOT_TOKEN;
    }
    console.log('TEST_GATEWAY_TELEGRAM_GUARDRAILS_OK');
}
main().catch((err) => {
    console.error('[gateway-guardrails] FAILED:', err instanceof Error ? err.message : err);
    process.exit(1);
});
