import assert from 'node:assert/strict';
import test from 'node:test';
import { sanitizeAuditData } from '../../src/audit/audit-sanitizer';

test('sanitizeAuditData redacts sensitive keys at every level', () => {
  const input = {
    username: 'inspector',
    password: 'hidden',
    nested: {
      password_hash: 'hidden',
      refresh_token: 'hidden',
      safe: 'visible',
    },
    entries: [{ Authorization: 'Bearer hidden' }],
  };

  assert.deepEqual(sanitizeAuditData(input), {
    username: 'inspector',
    password: '[REDACTED]',
    nested: {
      password_hash: '[REDACTED]',
      refresh_token: '[REDACTED]',
      safe: 'visible',
    },
    entries: [{ Authorization: '[REDACTED]' }],
  });
});

test('sanitizeAuditData handles circular data without throwing', () => {
  const input: Record<string, unknown> = { value: 1 };
  input.self = input;
  assert.deepEqual(sanitizeAuditData(input), {
    value: 1,
    self: '[CIRCULAR]',
  });
});