import test from 'node:test';
import assert from 'node:assert/strict';
import { maskCrudRowSensitiveFields } from './crud.js';

test('maskCrudRowSensitiveFields masks password and related login identifier fields in credential-like rows', () => {
  const rows = [
    {
      service_name: 'legacy-admin',
      login_id: 'admin-master',
      password: 'super-secret-password',
      note: 'keep this as-is',
    },
  ];

  const masked = maskCrudRowSensitiveFields(rows);

  assert.deepEqual(masked, [
    {
      service_name: 'legacy-admin',
      login_id: 'ad********er',
      password: 'su*****************rd',
      note: 'keep this as-is',
    },
  ]);
});

test('maskCrudRowSensitiveFields keeps generic ids unchanged when no credential secret field exists', () => {
  const rows = [
    {
      id: 12,
      user_id: 'owner-01',
      title: 'normal business row',
    },
  ];

  const masked = maskCrudRowSensitiveFields(rows);

  assert.deepEqual(masked, rows);
});

test('maskCrudRowSensitiveFields masks nested secret values recursively', () => {
  const payload = {
    profile: {
      username: 'how2ice',
      access_token: 'tok_1234567890',
    },
  };

  assert.deepEqual(maskCrudRowSensitiveFields(payload), {
    profile: {
      username: 'ho***ce',
      access_token: 'to**********90',
    },
  });
});
