<?php

declare(strict_types=1);

it('does not allow broad substring or regex secret redaction patterns in persisted snapshot paths', function (): void {
    $files = [
        'app/Services/Intune/PolicySnapshotRedactor.php',
        'app/Support/Audit/AuditContextSanitizer.php',
        'app/Support/Verification/VerificationReportSanitizer.php',
        'app/Support/OpsUx/RunFailureSanitizer.php',
    ];

    $forbiddenPatterns = [
        '/password/i',
        '/secret/i',
        '/token/i',
        "str_contains(\$key, 'password')",
        "str_contains(\$key, 'secret')",
        "str_contains(\$key, 'token')",
    ];

    foreach ($files as $file) {
        $contents = file_get_contents(base_path($file));

        expect($contents)->not->toBeFalse();

        foreach ($forbiddenPatterns as $pattern) {
            expect($contents)->not->toContain($pattern);
        }
    }
});
