package promptkit_test

import (
	"encoding/json"
	"fmt"
	"strings"
	"testing"

	"go.maximumdirect.net/promptkit"
)

func TestRunRequestFormattingAndJSONProtectDirectCredential(t *testing.T) {
	markers := []string{"secret-key-marker", "variable-marker", "artifact-body-marker", "message-body-marker", "setting-marker", "schema-path-marker"}
	request := promptkit.RunRequest{
		PromptID: "prompt", ProfileID: "profile", APIKey: markers[0],
		Vars:             map[string]string{"name": markers[1]},
		Inputs:           map[string]promptkit.ArtifactRef{"input": {Type: promptkit.ArtifactRefInline, Body: markers[2]}},
		AppendedMessages: []promptkit.RenderedMessage{{Role: promptkit.RoleUser, Content: markers[3]}},
		Execution:        &promptkit.ExecutionTargetOverride{Model: markers[4]},
		Validation:       &promptkit.OutputContract{SchemaPath: markers[5]},
	}
	for _, rendered := range []string{
		fmt.Sprintf("%v", request), fmt.Sprintf("%+v", request), fmt.Sprintf("%#v", request),
		fmt.Sprintf("%v", &request), fmt.Sprintf("%+v", &request), fmt.Sprintf("%#v", &request),
		request.String(), request.GoString(), (&request).String(), (&request).GoString(),
	} {
		for _, marker := range markers {
			if strings.Contains(rendered, marker) {
				t.Fatalf("request formatting exposes %q: %s", marker, rendered)
			}
		}
	}
	for _, value := range []any{request, &request} {
		encoded, err := json.Marshal(value)
		if err != nil {
			t.Fatal(err)
		}
		var object map[string]any
		if err := json.Unmarshal(encoded, &object); err != nil {
			t.Fatal(err)
		}
		if _, found := object["APIKey"]; found || strings.Contains(string(encoded), markers[0]) {
			t.Fatal("request JSON exposed the direct credential")
		}
	}
}