package bus

import (
	"encoding/json"
	"testing"
)

// A value naming a credential anywhere in it is found (novox/hq ADR 0201) — the guard against the
// ordinary mistake — and a value that only mentions tokens as a count is not.
func TestACredentialNamedFieldIsFoundAnywhereInAValue(t *testing.T) {
	for value, want := range map[string]string{
		`{"url":"http://x","headers":{"Authorization":"Bearer s"}}`: "Authorization",
		`[{"name":"a","env":{"API_KEY":"s"}}]`:                      "API_KEY",
		`{"refresh_token":"s"}`:                                     "refresh_token",
		`{"clientSecret":"s"}`:                                      "clientSecret",
		`{"maxTokens":4096,"name":"a","generation":3}`:              "",
		`"just a string"`:                                           "",
		// Issue 1126: a placement binds the provision "secret" to the vault; only an exact provider reference passes.
		`{"bindings":{"secret":{"node":"anchor","module":"mesh-vault"}}}`: "",
		`{"secret":{"value":"s"}}`:                                       "secret",
		`{"secret":{"node":"anchor","module":"mesh-vault","value":"s"}}`: "secret",
		`{"secret":{"node":"anchor","module":7}}`:                        "secret",
		`{"secret":{"node":"anchor","module":"hunter2 Bearer s3cr3t"}}`:  "secret",
		`{"secret":["s"]}`:                      "secret",
		`{"bindings":{"secret":{"token":"s"}}}`: "secret",
	} {
		if got := credentialField(json.RawMessage(value)); got != want {
			t.Errorf("%s: found %q, want %q", value, got, want)
		}
	}
}