#![allow(clippy::expect_used, clippy::panic)]

use super::*;

fn config() -> LeidosConfig {
    LeidosConfig::new("https://example.invalid/ws/", "vendor", "sekrit-password")
}

/// Guardrail: the password must never appear in any Debug rendering —
/// Debug output reaches logs, panics, and error chains.
#[test]
fn debug_never_prints_the_vendor_password() {
    let rendered = format!("{:?}", config());
    assert!(!rendered.contains("sekrit-password"), "{rendered}");
    assert!(rendered.contains("[redacted]"));
    let client = LeidosClient::new(config()).expect("client builds");
    let rendered = format!("{client:?}");
    assert!(!rendered.contains("sekrit-password"), "{rendered}");
}

/// The endpoint URL is not a credential channel; embedded userinfo
/// would leak into logs, so construction refuses it without echoing
/// the URL.
#[test]
fn endpoint_userinfo_is_rejected_without_echo() {
    let bad = LeidosConfig::new("https://id:pw@example.invalid/ws/", "vendor", "x");
    let error = LeidosClient::new(bad).expect_err("must reject");
    assert!(matches!(error, ConfigError::EndpointUserinfo));
    let message = error.to_string();
    assert!(!message.contains("pw"), "{message}");
}
