package domain

import (
	"encoding/json"
	"strings"
	"testing"
)

func TestPreparedRunJSONDoesNotIncludeSecretValues(t *testing.T) {
	const envName = "SCRIPTORIUM_TEST_API_KEY"
	const secret = "super-secret-value"
	t.Setenv(envName, secret)

	prepared := PreparedRun{
		PromptID:          "prompt.id",
		PromptVersion:     "v1",
		PromptHash:        "prompt-hash",
		SelectedProfileID: "local-fast",
		EffectiveModelParams: ExecutionTarget{
			Endpoint:  "http://llm/v1",
			Model:     "gpt-test",
			APIKeyEnv: envName,
		},
		InputHashes:        map[string]string{"transcript": "hash-1"},
		RenderedPromptHash: "rendered-hash",
		Messages: []RenderedMessage{
			{Role: "system", Content: "You are helpful."},
			{Role: "user", Content: "Summarize this."},
		},
	}

	b, err := json.Marshal(prepared)
	if err != nil {
		t.Fatalf("marshal failed: %v", err)
	}

	out := string(b)
	if strings.Contains(out, secret) {
		t.Fatalf("prepared run JSON unexpectedly contains secret value: %s", out)
	}
	if !strings.Contains(out, `"api_key_env":"`+envName+`"`) {
		t.Fatalf("prepared run JSON should include api_key_env name: %s", out)
	}

	var top map[string]any
	if err := json.Unmarshal(b, &top); err != nil {
		t.Fatalf("unmarshal failed: %v", err)
	}

	for _, forbidden := range []string{"raw_output", "validation", "artifact"} {
		if _, ok := top[forbidden]; ok {
			t.Fatalf("prepared run JSON should not include %q", forbidden)
		}
	}
}