import { describe, expect, it } from 'vitest';

import type { AppConfigService } from '../config/app-config.service';
import { SensitiveDataService } from './sensitive-data.service';

const config = {
  fieldEncryptionKey: Buffer.alloc(32, 3),
  sessionTokenPepper: 'test-session-token-pepper',
  auditIpHashKey: 'test-audit-ip-hash-key',
} as AppConfigService;

describe('SensitiveDataService', () => {
  it('encrypts sensitive values with randomized authenticated ciphertext', () => {
    const service = new SensitiveDataService(config);
    const first = service.encrypt('sensitive-openid');
    const second = service.encrypt('sensitive-openid');

    expect(first).not.toContain('sensitive-openid');
    expect(first).not.toBe(second);
    expect(service.decrypt(first)).toBe('sensitive-openid');
  });

  it('creates stable domain-separated lookup hashes', () => {
    const service = new SensitiveDataService(config);
    expect(service.lookupHash('openid', 'value')).toBe(service.lookupHash('openid', 'value'));
    expect(service.lookupHash('openid', 'value')).not.toBe(service.lookupHash('unionid', 'value'));
  });
});