<?php

namespace Tests\Unit;

use App\Enums\UserRole;
use App\Enums\UserStatus;
use App\Models\AuditLog;
use App\Models\Organization;
use App\Models\User;
use App\Services\AuditService;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;

class AuditRedactionTest extends TestCase
{
    use RefreshDatabase;

    public function test_sensitive_values_are_redacted_but_queue_token_numbers_are_not(): void
    {
        $org = Organization::create(['name' => 'Test', 'slug' => 'test', 'timezone' => 'Asia/Karachi', 'is_active' => true]);
        $user = User::create([
            'organization_id' => $org->id,
            'name' => 'Admin',
            'email' => 'admin@test.local',
            'password' => 'password',
            'role' => UserRole::ADMIN,
            'status' => UserStatus::ACTIVE,
        ]);

        app(AuditService::class)->log('settings.changed', $user, $org, null, [
            'whatsapp_access_token' => 'super-secret',
            'token_number' => 5,
            'nested' => ['password' => 'hidden'],
        ]);

        $log = AuditLog::latest('id')->firstOrFail();
        $this->assertSame('[REDACTED]', $log->after['whatsapp_access_token']);
        $this->assertSame(5, $log->after['token_number']);
        $this->assertSame('[REDACTED]', $log->after['nested']['password']);
    }
}
