import { redactValue } from "../lib/observability/redaction";

const raw = {
  apiKey: "sk-live-secret-value",
  password: "plain-password",
  token: "oauth-token-value",
  Authorization: "Bearer abc.def.ghi",
  Cookie: "session=secret",
  callbackUrl: "https://example.com/callback?code=abc&token=def",
  base64: `data:image/png;base64,${"a".repeat(160)}`,
  nested: {
    prompt: "draw a private prompt",
    imageUrl: "https://cdn.example.com/private/image.png?signature=secret",
  },
};

const output = JSON.stringify(redactValue(raw));
const forbidden = [
  "sk-live-secret-value",
  "plain-password",
  "oauth-token-value",
  "Bearer abc.def.ghi",
  "session=secret",
  "code=abc",
  "signature=secret",
  "a".repeat(80),
];

const leaked = forbidden.filter((value) => output.includes(value));
if (leaked.length > 0) {
  throw new Error(`Redaction leaked sensitive values: ${leaked.join(", ")}`);
}

console.log("Log redaction checks passed.");