XFEServerManager

package com.xfestudio.xfeservermanager.core.audit;

import static org.junit.jupiter.api.Assertions.assertEquals;

import com.xfestudio.xfeservermanager.api.audit.AuditEvent;
import com.xfestudio.xfeservermanager.api.audit.AuditOutcome;
import com.xfestudio.xfeservermanager.api.command.CommandSourceKind;
import java.time.Instant;
import java.util.Map;
import java.util.UUID;
import org.junit.jupiter.api.Test;

class AuditRedactorTest {
    @Test
    void redactsSecretsRawItemStateAndIpAddresses() {
        AuditEvent event = new AuditEvent(
                UUID.fromString("33ed1589-ce19-40bf-8679-f1e922a9444b"),
                Instant.parse("2026-01-01T00:00:00Z"),
                "console",
                "Console",
                CommandSourceKind.CONSOLE,
                "owner.create",
                "client 192.168.10.25",
                "from 10.0.0.1",
                Map.of("password", "hunter2", "slot", "3"),
                Map.of("raw_item_nbt", "{secret:true}"),
                4L,
                "request-1",
                AuditOutcome.SUCCEEDED,
                5,
                Map.of("remote_address", "172.16.0.2")
        );

        AuditEvent redacted = new AuditRedactor().redact(event);

        assertEquals(AuditRedactor.REDACTED, redacted.beforeValues().get("password"));
        assertEquals("3", redacted.beforeValues().get("slot"));
        assertEquals(AuditRedactor.REDACTED, redacted.afterValues().get("raw_item_nbt"));
        assertEquals("client [IP_REDACTED]", redacted.target());
        assertEquals(AuditRedactor.REDACTED, redacted.metadata().get("remote_address"));
    }

    @Test
    void redactsIpv6BearerCredentialsAndUnlabelledOpaqueTokens() {
        String opaque = "AbCdEfGhIjKlMnOpQrStUvWxYz0123456789_token";
        AuditEvent event = new AuditEvent(
                UUID.fromString("33ed1589-ce19-40bf-8679-f1e922a9444b"),
                Instant.parse("2026-01-01T00:00:00Z"),
                "console",
                "Console",
                CommandSourceKind.CONSOLE,
                "webhook.test",
                "peer 2001:db8:85a3::8a2e:370:7334",
                "Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.payload.signature",
                Map.of("reference", "id=" + opaque),
                Map.of(),
                null,
                "request-1",
                AuditOutcome.SUCCEEDED,
                1,
                Map.of());

        AuditEvent redacted = new AuditRedactor().redact(event);

        assertEquals("peer [IP_REDACTED]", redacted.target());
        assertEquals(("authorization=" + AuditRedactor.REDACTED + " " + AuditRedactor.REDACTED)
                        .toLowerCase(java.util.Locale.ROOT),
                redacted.reason().toLowerCase(java.util.Locale.ROOT));
        assertEquals("id=" + AuditRedactor.REDACTED, redacted.beforeValues().get("reference"));
    }

    @Test
    void redactsIpv4MappedIpv6AndShortBearerCredentialsWithoutLeavingSuffixes() {
        AuditEvent event = new AuditEvent(
                UUID.fromString("33ed1589-ce19-40bf-8679-f1e922a9444b"),
                Instant.parse("2026-01-01T00:00:00Z"),
                "console",
                "Console",
                CommandSourceKind.CONSOLE,
                "webhook.test",
                "peers ::ffff:192.0.2.1 and ::1",
                "Authorization: Bearer short",
                Map.of(),
                Map.of(),
                null,
                "request-1",
                AuditOutcome.SUCCEEDED,
                1,
                Map.of());

        AuditEvent redacted = new AuditRedactor().redact(event);

        assertEquals("peers [IP_REDACTED] and [IP_REDACTED]", redacted.target());
        assertEquals(("authorization=" + AuditRedactor.REDACTED + " " + AuditRedactor.REDACTED)
                        .toLowerCase(java.util.Locale.ROOT),
                redacted.reason().toLowerCase(java.util.Locale.ROOT));
    }
}