package logger

import (
	"bytes"
	"errors"
	"log/slog"
	"strings"
	"testing"
)

func TestSecretsRedactedInMessagesErrorsAttributesAndGroups(t *testing.T) {
	RegisterSecrets("SENTINEL_PRIVATE_KEY")
	var buffer bytes.Buffer
	log := slog.New(redactingHandler{slog.NewJSONHandler(&buffer, nil)})
	log.With("token", "BOUND_SECRET").Info("provider echoed SENTINEL_PRIVATE_KEY", "error", errors.New("Authorization: Bearer UNKNOWN_SECRET"), "payload", map[string]string{"config": "MAP_SECRET"}, "group", slog.GroupValue(slog.String("apiKey", "GROUP_SECRET")))
	for _, secret := range []string{"SENTINEL_PRIVATE_KEY", "BOUND_SECRET", "UNKNOWN_SECRET", "MAP_SECRET", "GROUP_SECRET"} {
		if strings.Contains(buffer.String(), secret) {
			t.Fatalf("leaked secret %s", secret)
		}
	}
}