package httpapi

import (
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"
)

func TestGetSpeaker_redactsAgentSecret(t *testing.T) {
	srv, err := New(Options{InsecureDev: true, SeedDemo: true, BundleSeedHex: testBundleSeed})
	if err != nil {
		t.Fatal(err)
	}
	defer srv.Close()
	tenant, _, _, _, demoSpk := srv.Store().DemoIDs()
	mustSetTestAPIKeys(t, srv, "vwkey|"+tenant+"|viewer")

	req := httptest.NewRequest(http.MethodGet, "/v1/speakers/"+demoSpk, nil)
	req.Header.Set("Authorization", "Bearer vwkey")
	rec := httptest.NewRecorder()
	srv.Handler().ServeHTTP(rec, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("status %d body %s", rec.Code, rec.Body.String())
	}
	var out map[string]any
	if err := json.Unmarshal(rec.Body.Bytes(), &out); err != nil {
		t.Fatal(err)
	}
	if out["agent_secret"] != nil {
		t.Fatalf("agent_secret must not appear at top level: %#v", out["agent_secret"])
	}
	meta, _ := out["meta_json"].(map[string]any)
	if meta != nil {
		if v, ok := meta["agent_secret"]; ok && v != nil && v != "" {
			t.Fatalf("agent_secret must be redacted from meta_json: %#v", v)
		}
	}
}

func TestListSpeakers_redactsAgentSecret(t *testing.T) {
	srv, err := New(Options{InsecureDev: true, SeedDemo: true, BundleSeedHex: testBundleSeed})
	if err != nil {
		t.Fatal(err)
	}
	defer srv.Close()
	tenant, _, _, _, _ := srv.Store().DemoIDs()
	mustSetTestAPIKeys(t, srv, "vwkey|"+tenant+"|viewer")

	req := httptest.NewRequest(http.MethodGet, "/v1/speakers", nil)
	req.Header.Set("Authorization", "Bearer vwkey")
	rec := httptest.NewRecorder()
	srv.Handler().ServeHTTP(rec, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("status %d body %s", rec.Code, rec.Body.String())
	}
	body := rec.Body.String()
	if strings.Contains(body, "agent_secret") {
		t.Fatalf("list response must not contain agent_secret: %s", body)
	}
}