const { test } = require('node:test');
const assert = require('node:assert/strict');
const fs = require('node:fs');
const path = require('node:path');

function read(relativePath) {
  return fs.readFileSync(path.join(__dirname, '..', relativePath), 'utf8');
}

test('redactor removes PHI and common secret patterns from logs', () => {
  const { redact } = require('../src/utils/redact');
  const input = 'Authorization: Bearer abc.def.ghi password=secret123 token=tok_1234567890 email test@example.com MRN 123456789';
  const output = redact(input);

  assert.doesNotMatch(output, /abc\.def\.ghi/);
  assert.doesNotMatch(output, /secret123/);
  assert.doesNotMatch(output, /tok_1234567890/);
  assert.doesNotMatch(output, /test@example\.com/);
  assert.doesNotMatch(output, /123456789/);
  assert.match(output, /\[REDACTED\]|\[JWT\]/);
});

test('URL safety helper blocks private network targets', () => {
  const { isPrivateIp } = require('../src/utils/urlSafety');

  assert.equal(isPrivateIp('127.0.0.1'), true);
  assert.equal(isPrivateIp('10.0.0.5'), true);
  assert.equal(isPrivateIp('172.16.0.1'), true);
  assert.equal(isPrivateIp('192.168.1.10'), true);
  assert.equal(isPrivateIp('169.254.169.254'), true);
  assert.equal(isPrivateIp('100.64.0.1'), true);
  assert.equal(isPrivateIp('::1'), true);
  assert.equal(isPrivateIp('fe80::1'), true);
  assert.equal(isPrivateIp('8.8.8.8'), false);
  assert.equal(isPrivateIp('2606:4700:4700::1111'), false);
});

test('Nextcloud/WebDAV routes enforce SSRF guard and redirect blocking', () => {
  const nextcloud = read('src/routes/nextcloud.js');
  const learningAI = read('src/routes/learningAI.js');

  assert.match(nextcloud, /assertSafeHttpsUrl\(cleanUrl, 'Nextcloud URL'\)/);
  assert.match(nextcloud, /assertSafeHttpsUrl\(user\.nextcloud_url, 'Nextcloud URL'\)/);
  assert.match(nextcloud, /maxRedirects: 0/);
  assert.match(nextcloud, /encodeURIComponent\(username\)/);
  assert.match(learningAI, /assertSafeHttpsUrl\(user\.nextcloud_url, 'Nextcloud URL'\)/);
  assert.match(learningAI, /maxRedirects: 0/);
  assert.match(learningAI, /encodeURIComponent\(user\.nextcloud_user\)/);
});

test('logs and audits avoid unbounded limits and PHI-prone details', () => {
  const logs = read('src/routes/logs.js');
  const encounters = read('src/routes/encounters.js');
  const documents = read('src/routes/documents.js');
  const learningAI = read('src/routes/learningAI.js');

  assert.match(logs, /function clampLimit/);
  assert.match(logs, /clampLimit\(req\.query\.limit, 50, 200\)/);
  assert.match(logs, /logger\.warn\('client_error'/);
  assert.match(logs, /redact\(trimField\(e\.stack, 1200\)\)/);
  assert.doesNotMatch(logs, /console\.error\('\[CLIENT ERROR\]'/);

  assert.doesNotMatch(encounters, /Saved encounter: ' \+ \(label/);
  assert.doesNotMatch(encounters, /Loaded encounter: ' \+ \(row\.label/);
  assert.doesNotMatch(documents, /Uploaded: ' \+ \(req\.file/);
  assert.doesNotMatch(learningAI, /Char context/);
});