package main

import (
	"bytes"
	"encoding/json"
	"strings"
	"testing"
)

func TestDigest(t *testing.T) {
	b := []byte("public fixture")
	want := digest(b)
	if !matches(b, want) || matches([]byte("modified"), want) {
		t.Fatal("digest comparison")
	}
	if !matches([]byte("modified"), digest([]byte("modified"))) {
		t.Fatal("matching an attacker-controlled digest does not prove trust")
	}
}
func TestAuditBoundary(t *testing.T) {
	var out bytes.Buffer
	want := Audit{"user-7", "read\nforged", "document-42", "deny", "r1"}
	if err := writeAudit(&out, want); err != nil {
		t.Fatal(err)
	}
	if strings.Count(out.String(), "\n") != 1 {
		t.Fatal("line injection")
	}
	var got Audit
	if err := json.Unmarshal(out.Bytes(), &got); err != nil || got != want {
		t.Fatal(got, err)
	}
	for _, forbidden := range []string{"Authorization", "Cookie", "password"} {
		if strings.Contains(out.String(), forbidden) {
			t.Fatal("unexpected sensitive field")
		}
	}
}