import { test } from 'node:test';
import assert from 'node:assert/strict';
const secret = 'sk-test-NOT-A-SECRET-1234';
// JSON.parse quotes a prefix near this fault on Node 26; check partial leaks too.
function safe(label, ErrorType, properties = {}) {
  return error => {
    assert.ok(error instanceof ErrorType);
    for (const [key, value] of Object.entries(properties)) assert.equal(error[key], value);
    assert.ok(error.message.includes(label), error.message);
    assert.doesNotMatch(error.message, /sk-test|Unexpected token/);
    assert.doesNotMatch(error.stack, /sk-test/);
    assert.equal(error.cause, undefined);
    return true;
  };
}
import { BusinessError } from '../src/errors.mjs';
import { requireId, requirePositiveInt, requireDate } from '../src/util.mjs';
import { checkAccess } from '../src/access.mjs';
for (const [field, check, value] of [
  ['id', requireId, secret], ['revision', requirePositiveInt, secret], ['rotateBy', requireDate, secret],
  // Arbitrary sentinel bytes cannot pass the date-shape check to reach this branch.
  ['rotateBy', requireDate, '2026-02-30'],
]) test(`${field} rejects ${check.name} input without its value`, () => {
  assert.throws(() => check(value, field), error => {
    safe(field, BusinessError, { exitCode: 2 })(error);
    assert.ok(!error.message.includes(value), error.message);
    return true;
  });
});
function access() { return { accessVersion: 1, revision: 1, users: [{ id: 'bean', home: 'local', subjects: [{ provider: 'test', sub: 'user' }] }], grants: [{ id: 'grant', user: 'bean', business: 'acme', projects: ['*'], instances: ['coder'], level: 'viewer' }] }; }
const context = { providers: ['test'], peers: [], businesses: { acme: { human: 'jason', instances: ['coder'] } }, ssoSubjects: [] };
for (const [field, value] of [['expires', secret], ['expires', '2026-02-30T00:00:00Z'], ['instances', [secret]]]) test(`grant ${field} refusal omits its value ${JSON.stringify(value)}`, () => {
  const doc = access(); doc.grants[0][field] = value;
  assert.throws(() => checkAccess(doc, context), error => {
    safe(`grants[0].${field}`, BusinessError, { exitCode: 2 })(error);
    assert.ok(!error.message.includes(Array.isArray(value) ? value[0] : value), error.message);
    return true;
  });
});