package telemetry

import (
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"

	metricnoop "go.opentelemetry.io/otel/metric/noop"
	sdktrace "go.opentelemetry.io/otel/sdk/trace"
	"go.opentelemetry.io/otel/sdk/trace/tracetest"
)

func TestWrapHTTPWithoutProvidersReturnsOriginalHandler(t *testing.T) {
	handler := http.HandlerFunc(func(http.ResponseWriter, *http.Request) {})
	if got := WrapHTTP(handler, nil, nil); got == nil {
		t.Fatal("WrapHTTP() returned nil")
	}
}

func TestWrapHTTPDoesNotCaptureCredentialValues(t *testing.T) {
	const canary = "canary-secret-token"
	recorder := tracetest.NewSpanRecorder()
	tracerProvider := sdktrace.NewTracerProvider(sdktrace.WithSpanProcessor(recorder))
	t.Cleanup(func() { _ = tracerProvider.Shutdown(t.Context()) })

	handler := WrapHTTP(http.HandlerFunc(func(response http.ResponseWriter, _ *http.Request) {
		response.WriteHeader(http.StatusNoContent)
	}), &Providers{Tracer: tracerProvider, Meter: metricnoop.NewMeterProvider()}, nil)

	request := httptest.NewRequest(http.MethodGet, "/oauth2/jwks?subject_token="+canary, nil)
	request.Header.Set("Authorization", "Bearer "+canary)
	response := httptest.NewRecorder()
	handler.ServeHTTP(response, request)

	spans := recorder.Ended()
	if len(spans) != 1 {
		t.Fatalf("ended spans = %d, want 1", len(spans))
	}
	for _, attribute := range spans[0].Attributes() {
		if strings.Contains(attribute.Value.Emit(), canary) {
			t.Fatalf("span attribute %q captured credential canary", attribute.Key)
		}
	}
}