import { describe, it, expect } from 'vitest';
import { redactSecrets } from './redact.js';

describe('redactSecrets', () => {
  it('masks access_token and refresh_token', () => {
    expect(redactSecrets({ access_token: 'abc', data: 'keep' })).toEqual({
      access_token: '***',
      data: 'keep',
    });
    expect(redactSecrets({ refresh_token: 'abc' })).toEqual({ refresh_token: '***' });
  });
  it('masks Authorization header variations', () => {
    expect(redactSecrets({ Authorization: 'Bearer xyz' })).toEqual({ Authorization: '***' });
    expect(redactSecrets({ authorization: 'Bearer xyz' })).toEqual({ authorization: '***' });
  });
  it('masks nested objects and arrays', () => {
    const out = redactSecrets({ outer: { code_verifier: 'v', inner: [{ code: 'c' }] } });
    expect(out).toEqual({ outer: { code_verifier: '***', inner: [{ code: '***' }] } });
  });
  it('returns non-object inputs unchanged', () => {
    expect(redactSecrets('hello')).toBe('hello');
    expect(redactSecrets(42)).toBe(42);
    expect(redactSecrets(null)).toBe(null);
  });
  it('handles client_secret and id_token', () => {
    expect(redactSecrets({ client_secret: 's', id_token: 't' })).toEqual({
      client_secret: '***',
      id_token: '***',
    });
  });
});
