<?php

declare(strict_types=1);

it('does not allow broad audit-path redaction fallbacks', function (): void {
    $files = [
        'app/Support/Audit/AuditContextSanitizer.php',
        'app/Support/Verification/VerificationReportSanitizer.php',
        'app/Support/OpsUx/RunFailureSanitizer.php',
    ];

    $forbiddenPatterns = [
        'FORBIDDEN_KEY_SUBSTRINGS',
        "str_ireplace(\n            ['client_secret', 'access_token', 'refresh_token', 'authorization', 'bearer ']",
        "str_contains(\$lower, 'password')",
        "str_contains(\$lower, 'secret')",
        "str_contains(\$lower, 'token')",
    ];

    foreach ($files as $file) {
        $contents = file_get_contents(base_path($file));

        expect($contents)->not->toBeFalse();

        foreach ($forbiddenPatterns as $pattern) {
            expect($contents)->not->toContain($pattern);
        }
    }
});