using Omika.Core.Observability.Outbox;

namespace Omika.Tests.Observability.Outbox;

/// <summary>Tests de la liste noire inverse du transport diagnostic (§29).</summary>
public class DiagnosticForbiddenDataTests
{
    [Theory]
    [InlineData("password")]
    [InlineData("Password")]
    [InlineData("PASSWORD")]
    [InlineData("connectionString")]
    [InlineData("requestBody")]
    [InlineData("smtpPassword")]
    [InlineData("advertisingId")]
    [InlineData("authorization")]
    public void IsForbiddenKey_DetectsForbiddenTokensCaseInsensitive(string key)
    {
        Assert.True(DiagnosticForbiddenData.IsForbiddenKey(key));
    }

    [Theory]
    [InlineData("method")]
    [InlineData("routeTemplate")]
    [InlineData("statusCode")]
    [InlineData("entityType")]
    [InlineData("")]
    [InlineData(null)]
    public void IsForbiddenKey_AllowsSafeKeys(string? key)
    {
        Assert.False(DiagnosticForbiddenData.IsForbiddenKey(key));
    }

    [Fact]
    public void ContainsForbiddenValue_DetectsSecretsInFreeText()
    {
        Assert.True(DiagnosticForbiddenData.ContainsForbiddenValue("Authorization=Bearer abc"));
        Assert.True(DiagnosticForbiddenData.ContainsForbiddenValue("server=prod;password=hidden"));
        Assert.False(DiagnosticForbiddenData.ContainsForbiddenValue("échec de connexion"));
        Assert.False(DiagnosticForbiddenData.ContainsForbiddenValue(""));
        Assert.False(DiagnosticForbiddenData.ContainsForbiddenValue(null));
    }
}