import { describe, expect, it } from 'vitest';

import type { PrismaService } from '../database/prisma.service';
import type { SensitiveDataService } from '../security/sensitive-data.service';
import { AuditService } from './audit.service';

describe('AuditService metadata policy', () => {
  const service = new AuditService({} as PrismaService, {} as SensitiveDataService);

  it('allows non-sensitive action metadata', () => {
    expect(service.safeMetadata({ reasonCode: 'INVALID_CREDENTIALS', attempt: 2 })).toEqual({
      reasonCode: 'INVALID_CREDENTIALS',
      attempt: 2,
    });
  });

  it('rejects sensitive metadata keys', () => {
    expect(() => service.safeMetadata({ password: 'never-store-this' })).toThrow(/not allowed/);
    expect(() => service.safeMetadata({ openid: 'never-store-this' })).toThrow(/not allowed/);
  });
});