package notify

import (
	"strings"
	"testing"
)

func TestConfigSecretsEncryptedAtRest(t *testing.T) {
	s := New(nil, []byte("0123456789abcdef0123456789abcdef"))
	raw, err := s.encodeConfig(map[string]string{"url": "https://example.invalid/hook", "token": "super-secret-token", "password": "pw123"})
	if err != nil {
		t.Fatal(err)
	}
	if strings.Contains(raw, "super-secret-token") || strings.Contains(raw, "pw123") {
		t.Fatalf("secret leaked in persisted config: %s", raw)
	}
	cfg, err := s.decodeConfig(raw)
	if err != nil {
		t.Fatal(err)
	}
	if cfg["token"] != "super-secret-token" || cfg["password"] != "pw123" {
		t.Fatalf("roundtrip mismatch: %#v", cfg)
	}
}