import { describe, expect, it } from 'vitest';
import { maskPii } from '../pii-masker';

describe('maskPii', () => {
  it('should redact sensitive keys', () => {
    const input = {
      username: 'john',
      password: 'secret123',
      token: 'abc-def',
      authorization: 'Bearer xyz',
    };
    const result = maskPii(input) as Record<string, unknown>;
    expect(result['username']).toBe('john');
    expect(result['password']).toBe('[REDACTED]');
    expect(result['token']).toBe('[REDACTED]');
    expect(result['authorization']).toBe('[REDACTED]');
  });

  it('should mask email addresses in strings', () => {
    const input = 'Contact user@example.com for details';
    const result = maskPii(input);
    expect(result).toBe('Contact u***@example.com for details');
  });

  it('should mask Vietnamese phone numbers', () => {
    const input = 'Call 0912345678 or +84912345678';
    const result = maskPii(input) as string;
    expect(result).not.toContain('0912345678');
    expect(result).not.toContain('+84912345678');
    expect(result).toContain('091****678');
    expect(result).toContain('+84****678');
  });

  it('should handle nested objects', () => {
    const input = {
      user: {
        name: 'John',
        password: 'secret',
        email: 'john@test.com',
      },
    };
    const result = maskPii(input) as Record<string, Record<string, unknown>>;
    expect(result['user']!['name']).toBe('John');
    expect(result['user']!['password']).toBe('[REDACTED]');
  });

  it('should handle arrays', () => {
    const input = [{ password: 'a' }, { password: 'b' }];
    const result = maskPii(input) as Record<string, unknown>[];
    expect(result[0]!['password']).toBe('[REDACTED]');
    expect(result[1]!['password']).toBe('[REDACTED]');
  });

  it('should return null/undefined as-is', () => {
    expect(maskPii(null)).toBeNull();
    expect(maskPii(undefined)).toBeUndefined();
  });

  it('should return numbers as-is', () => {
    expect(maskPii(42)).toBe(42);
  });
});
