package config

import (
	"testing"

	"gitea.maximumdirect.net/eric/notarius/internal/framework/pipeline"
)

func TestRedactedConfigRemovesAPIKeyValues(t *testing.T) {
	cfg := Default()
	cfg.LLMProfiles[pipeline.DefaultLLMProfile] = LLMProfile{
		Provider:       "openai-compatible",
		BaseURL:        "https://example.invalid/v1",
		Model:          "test-model",
		APIKey:         "secret",
		APIKeyEnv:      "NOTARIUS_TEST_API_KEY",
		TimeoutSeconds: 600,
		MaxRetries:     3,
		MaxConcurrency: 1,
	}
	cfg.LLMProfiles["other"] = LLMProfile{APIKey: "other-secret", Model: "other-model"}

	redacted := cfg.Redacted()

	if redacted.LLMProfiles[pipeline.DefaultLLMProfile].APIKey != redactedSecret {
		t.Fatalf("expected default API key redacted, got %+v", redacted.LLMProfiles[pipeline.DefaultLLMProfile])
	}
	if redacted.LLMProfiles["other"].APIKey != redactedSecret {
		t.Fatalf("expected other API key redacted, got %+v", redacted.LLMProfiles["other"])
	}
	if redacted.LLMProfiles[pipeline.DefaultLLMProfile].Model != "test-model" {
		t.Fatalf("expected non-secret fields preserved, got %+v", redacted.LLMProfiles[pipeline.DefaultLLMProfile])
	}
	if cfg.LLMProfiles[pipeline.DefaultLLMProfile].APIKey != "secret" {
		t.Fatalf("redaction mutated original config")
	}
}