// src/lib/db/client.test.ts — pure unit test (no DB) for the dev-logger
// secret-masking predicate (D3). Importing "./client" would open a pg pool at
// module load in some environments, so this only imports the pure function.
import { describe, expect, test } from "bun:test";
import { shouldMaskParams } from "./client";

describe("shouldMaskParams", () => {
  test("masks queries touching the session table", () => {
    expect(
      shouldMaskParams(
        'insert into "session" ("id", "token", "user_id") values ($1, $2, $3)',
      ),
    ).toBe(true);
  });

  test("masks queries touching the verification table", () => {
    expect(
      shouldMaskParams('select * from "verification" where "id" = $1'),
    ).toBe(true);
  });

  test("masks queries touching the account table (OAuth tokens)", () => {
    expect(
      shouldMaskParams(
        'update "account" set "access_token" = $1 where "id" = $2',
      ),
    ).toBe(true);
  });

  test("masks queries touching the two_factor table (TOTP secret)", () => {
    expect(
      shouldMaskParams('select * from "two_factor" where "user_id" = $1'),
    ).toBe(true);
  });

  test("is case-insensitive", () => {
    expect(shouldMaskParams('SELECT * FROM "SESSION" WHERE "id" = $1')).toBe(
      true,
    );
  });

  test("does not mask unrelated domain tables", () => {
    expect(shouldMaskParams('select * from "sites" where "id" = $1')).toBe(
      false,
    );
    expect(
      shouldMaskParams('select * from "keywords" where "site_id" = $1'),
    ).toBe(false);
  });

  test("does not false-positive on a column name that merely contains the word (underscore-joined)", () => {
    expect(
      shouldMaskParams(
        'insert into "some_table" ("stripe_session_id") values ($1)',
      ),
    ).toBe(false);
  });
});