package controller

import (
	"net/http"
	"net/http/httptest"
	"testing"

	"github.com/QuantumNous/new-api/common"
	"github.com/gin-gonic/gin"
	"github.com/stretchr/testify/require"
)

func TestGetOptionsOmitsSensitiveSuffixes(t *testing.T) {
	common.OptionMapRWMutex.Lock()
	oldOptions := common.OptionMap
	common.OptionMap = map[string]string{
		"PublicOption": "visible", "AccessToken": "secret", "WebhookSecret": "secret",
		"ProviderKey": "secret", "lowercase_secret": "secret", "service_api_key": "secret",
	}
	common.OptionMapRWMutex.Unlock()
	t.Cleanup(func() {
		common.OptionMapRWMutex.Lock()
		common.OptionMap = oldOptions
		common.OptionMapRWMutex.Unlock()
	})

	router := gin.New()
	router.GET("/", GetOptions)
	response := httptest.NewRecorder()
	router.ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/", nil))

	require.Equal(t, http.StatusOK, response.Code)
	body := response.Body.String()
	require.Contains(t, body, "PublicOption")
	require.NotContains(t, body, "AccessToken")
	require.NotContains(t, body, "WebhookSecret")
	require.NotContains(t, body, "ProviderKey")
	require.NotContains(t, body, "lowercase_secret")
	require.NotContains(t, body, "service_api_key")
}