package bus

import (
	"encoding/json"
	"testing"
)

// A value naming a credential anywhere in it is found (novox/hq ADR 0201) — the guard against the
// ordinary mistake — and a value that only mentions tokens as a count is not.
func TestACredentialNamedFieldIsFoundAnywhereInAValue(t *testing.T) {
	for value, want := range map[string]string{
		`{"url":"http://x","headers":{"Authorization":"Bearer s"}}`: "Authorization",
		`[{"name":"a","env":{"API_KEY":"s"}}]`:                      "API_KEY",
		`{"refresh_token":"s"}`:                                     "refresh_token",
		`{"clientSecret":"s"}`:                                      "clientSecret",
		`{"maxTokens":4096,"name":"a","generation":3}`:              "",
		`"just a string"`:                                           "",
		// Issue 1126: a placement binds the provision "secret" to the vault; the name holds a structure, not a value.
		`{"bindings":{"secret":{"node":"anchor","module":"mesh-vault"}}}`: "",
		`{"secret":{"value":"s"}}`:              "",
		`{"secret":["s"]}`:                      "secret",
		`{"bindings":{"secret":{"token":"s"}}}`: "token",
	} {
		if got := credentialField(json.RawMessage(value)); got != want {
			t.Errorf("%s: found %q, want %q", value, got, want)
		}
	}
}