package cmd

import (
	"strings"
	"testing"
)

// redact must not reveal any secret material — only the non-secret prefix that
// identifies the credential type.
func TestRedactRevealsNoSecretMaterial(t *testing.T) {
	const secret = "rickub_pat_S3CRETMATERIAL"
	got := redact(secret)
	if got != "rickub_pat_…" {
		t.Errorf("redact = %q, want %q", got, "rickub_pat_…")
	}
	if rest := strings.TrimPrefix(secret, tokenPrefix); strings.Contains(got, rest[:1]) {
		t.Errorf("redact leaked secret material: %q", got)
	}
	if got := redact("short"); got != "****" {
		t.Errorf("redact(non-PAT) = %q, want ****", got)
	}
	if got := redact(""); got != "****" {
		t.Errorf("redact(empty) = %q, want ****", got)
	}
}

// A URL handed to the platform opener must be a plain web address: the opener
// launches whatever handler is registered for a scheme.
func TestCheckBrowserURLRejectsNonWebSchemes(t *testing.T) {
	ok := []string{
		"https://rickub.com/login/device?code=ABCD",
		"http://localhost:3000/login/device",
	}
	for _, u := range ok {
		if err := checkBrowserURL(u); err != nil {
			t.Errorf("checkBrowserURL(%q) = %v, want nil", u, err)
		}
	}

	bad := []string{
		"file:///etc/passwd",
		"javascript:alert(1)",
		"data:text/html,<script>alert(1)</script>",
		"ssh://evil.example/x",
		"vscode://evil",
		"/login/device",
		"https://",
		"",
		"ht tp://bad",
	}
	for _, u := range bad {
		if err := checkBrowserURL(u); err == nil {
			t.Errorf("checkBrowserURL(%q) = nil, want an error", u)
		}
	}
}