import { describe, expect, it } from 'vitest'
import { createLogger } from '../src/log/logger.js'

function capture() {
  const lines: string[] = []
  return { lines, sink: (l: string) => lines.push(l) }
}

describe('redacting logger (INV9)', () => {
  it('never emits secret meta values', () => {
    const { lines, sink } = capture()
    const log = createLogger('debug', sink)
    log.log('info', 'enrolled', {
      privateKey: 'SECRET-PRIV-KEY',
      cert: 'SECRET-CERT',
      pairingCode: 'ABCD-1234',
      agentToken: 'tok-xyz',
    })
    const joined = lines.join('\n')
    expect(joined).not.toContain('SECRET-PRIV-KEY')
    expect(joined).not.toContain('SECRET-CERT')
    expect(joined).not.toContain('ABCD-1234')
    expect(joined).not.toContain('tok-xyz')
    expect(joined).toContain('[REDACTED]')
  })

  it('passes non-secret meta (nonce) through', () => {
    const { lines, sink } = capture()
    const log = createLogger('debug', sink)
    log.log('debug', 'frame', { nonce: 'abc123', streamId: 7 })
    expect(lines[0]).toContain('abc123')
    expect(lines[0]).toContain('7')
  })

  it('drops messages below the threshold level', () => {
    const { lines, sink } = capture()
    const log = createLogger('warn', sink)
    log.log('debug', 'noisy')
    log.log('error', 'boom')
    expect(lines).toHaveLength(1)
    expect(lines[0]).toContain('boom')
  })
})