#![allow(clippy::expect_used, clippy::panic)]

use super::*;

#[test]
fn debug_and_display_never_reveal_the_value() {
    let secret = Secret::new("super-secret-value");
    assert!(!format!("{secret:?}").contains("super-secret-value"));
    assert!(!format!("{secret}").contains("super-secret-value"));
    assert_eq!(format!("{secret}"), "[redacted]");
    // The value is still reachable when deliberately exposed.
    assert_eq!(secret.expose(), "super-secret-value");
}

#[test]
fn blank_detects_unconfigured_credentials() {
    assert!(Secret::new("").is_blank());
    assert!(Secret::new("   ").is_blank());
    assert!(!Secret::new("x").is_blank());
}

#[test]
fn redact_userinfo_only_touches_credentials() {
    assert_eq!(
        redact_userinfo("https://a:b@host/x"),
        "https://[redacted]@host/x"
    );
    assert_eq!(
        redact_userinfo("https://host/nmsapi"),
        "https://host/nmsapi"
    );
    // A bare `@` in a path (no scheme before it) is left alone.
    assert_eq!(redact_userinfo("host/a@b"), "host/a@b");
}

#[test]
fn redact_userinfo_confines_to_the_authority() {
    // A password containing a literal `@` must not leak its tail: redaction
    // runs to the LAST `@` in the authority.
    assert_eq!(
        redact_userinfo("https://user:p@ss@host/x"),
        "https://[redacted]@host/x"
    );
    // A `@` in the path or query is not userinfo — leave it untouched.
    assert_eq!(redact_userinfo("https://host/p@th"), "https://host/p@th");
    assert_eq!(
        redact_userinfo("https://host:8080/x?u=a@b"),
        "https://host:8080/x?u=a@b"
    );
    // Userinfo with a port, no path.
    assert_eq!(
        redact_userinfo("https://user@host:8080"),
        "https://[redacted]@host:8080"
    );
}
