#!/bin/bash
# Unit tests for netinfra/dns/drift-check.sh [#420][#469]
# Tests the redaction and normalization functions without touching hosts.
set -euo pipefail

PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
SCRIPT="$PROJECT_ROOT/netinfra/dns/drift-check.sh"

failed=0

if [[ -f "$SCRIPT" ]] && (source "$SCRIPT"); then
    echo "✅ script exists + sources cleanly"
else
    echo "❌ script missing or fails to source: $SCRIPT"
    exit 1
fi
# shellcheck disable=SC1091
source "$SCRIPT"

test_redact_strips_secrets() {
    local out
    out=$(printf '  pwhash = "SECRETBALLOONHASH"\n  totp_secret = "ABC234"\n  password = "hunter2"\n  port = 53\n' | redact_config)
    if grep -qE "SECRETBALLOON|ABC234|hunter2" <<<"$out"; then
        echo "❌ redact_config leaked a secret"
        ((++failed))
    elif grep -q '"REDACTED"' <<<"$out" && grep -q "port = 53" <<<"$out"; then
        echo "✅ redact_config strips secrets, keeps config"
    else
        echo "❌ redact_config mangled output"
        ((++failed))
    fi
}

test_normalize_drops_timestamp() {
    local out
    out=$(printf '# Last updated on 2026-09-01 17:01:15 CDT\n  dnsmasq_lines = []\n' | normalize_toml)
    if grep -q "Last updated" <<<"$out"; then
        echo "❌ normalize_toml kept the timestamp churn line"
        ((++failed))
    elif grep -q "dnsmasq_lines" <<<"$out"; then
        echo "✅ normalize_toml drops timestamp, keeps config"
    else
        echo "❌ normalize_toml dropped config lines"
        ((++failed))
    fi
}

test_normalize_implies_redaction() {
    local out
    out=$(printf '  totp_secret = "XYZ789"\n  a = 1\n' | normalize_toml)
    if grep -q XYZ789 <<<"$out"; then
        echo "❌ normalize_toml leaked a secret"
        ((++failed))
    else
        echo "✅ normalize_toml redacts secrets"
    fi
}

test_redact_strips_secrets
test_normalize_drops_timestamp
test_normalize_implies_redaction

if ((failed > 0)); then
    echo "❌ $failed drift-check test(s) failed"
    exit 1
fi
echo "✅ all drift-check tests passed"