package divera

import (
	"context"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"
	"time"

	"github.com/example/notify-gateway/internal/config"
)

func TestRedirectsAndErrorsDoNotLeakCredentials(t *testing.T) {
	calls := 0
	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		calls++
		if r.URL.Query().Get("accesskey") != "private-key" {
			t.Error("missing key")
		}
		w.Header().Set("Location", "/other")
		w.Header().Set("Retry-After", "90")
		w.WriteHeader(307)
		w.Write([]byte("private-key"))
	}))
	defer srv.Close()
	t.Setenv("TEST_DIVERA_KEY", "private-key")
	c := New(func() config.DiveraConfig {
		return config.DiveraConfig{BaseURL: srv.URL, AccessKey: "env:TEST_DIVERA_KEY", TimeoutS: 2}
	})
	resp, err := c.Create(context.Background(), "news", map[string]any{})
	if err == nil || calls != 1 || strings.Contains(err.Error(), "private-key") || len(resp.Body) != 0 || resp.RetryAfter != 90*time.Second {
		t.Fatalf("response=%+v error=%v calls=%d", resp, err, calls)
	}
}