<?php

declare(strict_types=1);

use App\Services\TenantConfiguration\CoveragePayloadRedactor;

it('Spec420 redacts M365 permission and provider context secrets recursively', function (): void {
    $redacted = (new CoveragePayloadRedactor)->redact([
        'provider_connection_id' => 10,
        'Authorization' => 'Bearer secret',
        'clientSecret' => 'secret',
        'permission_context' => [
            'access_token' => 'token',
            'refreshToken' => 'refresh',
            'scopes_granted' => ['Policy.Read.All'],
        ],
    ]);

    expect($redacted['Authorization'])->toBe('[redacted]')
        ->and($redacted['clientSecret'])->toBe('[redacted]')
        ->and($redacted['permission_context']['access_token'])->toBe('[redacted]')
        ->and($redacted['permission_context']['refreshToken'])->toBe('[redacted]')
        ->and($redacted['permission_context']['scopes_granted'])->toBe(['Policy.Read.All']);
});