package audit

import (
	"testing"

	"github.com/bytedance/sonic"

	"github.com/break/junhong_cmp_fiber/pkg/constants"
)

// TestSecurityActionsRegistered 验证账号安全动作不会绕过注册表。
func TestSecurityActionsRegistered(t *testing.T) {
	registry := NewRegistry()
	for _, code := range []string{
		constants.AuditActionAccountPasswordReset,
		constants.AuditActionAccountPasswordChanged,
		constants.AuditActionAccountWeComBound,
		constants.AuditActionAuthLogin,
		constants.AuditActionAuthLogout,
		constants.AuditActionAuthTokenRefreshed,
	} {
		action, ok := registry.Action(code)
		if !ok {
			t.Fatalf("安全动作未注册：%s", code)
		}
		if action.PrimaryResource != constants.AuditResourceAccount || action.Category != constants.AuditCategorySecurity {
			t.Fatalf("安全动作注册错误：%s", code)
		}
	}
}

// TestSecurityAuditRemovesCredentials 验证安全凭据不会进入审计 JSON。
func TestSecurityAuditRemovesCredentials(t *testing.T) {
	encoded, err := safeObject(map[string]any{
		"password":               "secret",
		"verification_code":      "123456",
		"access_token":           "token",
		"cookie":                 "session=value",
		"credentials_configured": true,
		"state":                  "changed",
	})
	if err != nil {
		t.Fatalf("清理审计 JSON 失败：%v", err)
	}
	var value map[string]any
	if err := sonic.Unmarshal(encoded, &value); err != nil {
		t.Fatalf("解析审计 JSON 失败：%v", err)
	}
	for _, field := range []string{"password", "verification_code", "access_token", "cookie"} {
		if _, exists := value[field]; exists {
			t.Fatalf("安全凭据未删除：%s", field)
		}
	}
	if value["credentials_configured"] != true || value["state"] != "changed" {
		t.Fatalf("安全业务事实被错误删除：%v", value)
	}
}