/**
 * Unit test for jicofo-0002: CWE-312 stream key logged verbatim.
 *
 * Verifies our maskStreamId helper correctly redacts stream keys in log output.
 */
public class JicofoStreamKeyMaskTest {

    // Mirrors our proposed fix in JibriSession
    static String maskStreamId(String id) {
        if (id == null || id.length() <= 4)
            return "****";
        return "****" + id.substring(id.length() - 4);
    }

    // Simulates our defective log line (original code)
    static String buildLogLineDefective(String streamId) {
        return "Starting Jibri jvb.example.com for stream ID: " + streamId + " in room: testroom";
    }

    // Simulates our fixed log line
    static String buildLogLineFixed(String streamId) {
        return "Starting Jibri jvb.example.com for stream ID: " + maskStreamId(streamId) + " in room: testroom";
    }

    static void assertTrue(boolean condition, String msg) {
        if (!condition) {
            System.err.println("FAIL: " + msg);
            System.exit(1);
        }
    }

    public static void main(String[] args) {
        System.out.println("=== jicofo-0002 CWE-312 stream key masking test ===");

        // Representative YouTube stream key format
        String youtubeKey = "abcd-efgh-ijkl-mnop-qrst";
        String twitchKey  = "live_12345678901234567890_xyzXYZ";
        String shortKey   = "ab12";
        String nullKey    = null;

        // Verify defective version exposes full key
        String defectiveLine = buildLogLineDefective(youtubeKey);
        assertTrue(defectiveLine.contains(youtubeKey),
            "Defective line should contain full stream key");

        // Verify fixed version does NOT expose full key
        String fixedLine = buildLogLineFixed(youtubeKey);
        assertTrue(!fixedLine.contains(youtubeKey),
            "Fixed line must not contain full YouTube stream key");
        assertTrue(fixedLine.contains("****qrst"),
            "Fixed line should show last 4 chars with **** prefix");

        // Test Twitch key
        String fixedTwitch = buildLogLineFixed(twitchKey);
        assertTrue(!fixedTwitch.contains(twitchKey),
            "Fixed line must not contain full Twitch key");
        String expectedTwitchSuffix = "****" + twitchKey.substring(twitchKey.length() - 4);
        assertTrue(fixedTwitch.contains(expectedTwitchSuffix),
            "Fixed line should mask Twitch key: " + fixedTwitch + " expected suffix " + expectedTwitchSuffix);

        // Test short key
        String maskedShort = maskStreamId(shortKey);
        assertTrue(maskedShort.equals("****"),
            "Short key (<=4 chars) should be fully masked, got: " + maskedShort);

        // Test null key
        String maskedNull = maskStreamId(nullKey);
        assertTrue(maskedNull.equals("****"),
            "Null key should be fully masked, got: " + maskedNull);

        System.out.println("YouTube key: " + youtubeKey + " -> " + maskStreamId(youtubeKey));
        System.out.println("Twitch key:  " + twitchKey + " -> " + maskStreamId(twitchKey));
        System.out.println("Short key:   " + shortKey + " -> " + maskStreamId(shortKey));
        System.out.println("Null key:    " + nullKey + " -> " + maskStreamId(nullKey));
        System.out.println("PASS: stream key masking works correctly");
    }
}