package cli

import (
	"bytes"
	"context"
	"os"
	"path/filepath"
	"strings"
	"testing"
)

func TestPrivateHandoffAndSafeErrors(t *testing.T) {
	root := t.TempDir()
	credentials := filepath.Join(root, "client.json")
	if err := os.WriteFile(credentials, []byte(`{"username":"sim-001","password":"PRIVATE_SENTINEL","host":"unused"}`), 0600); err != nil {
		t.Fatal(err)
	}
	for _, args := range [][]string{{"--credentials", credentials, "check-config"}, {"--credentials", credentials, "--device-id", "bad/+", "check-config"}} {
		var out, errOut bytes.Buffer
		Run(context.Background(), args, &out, &errOut, false)
		if strings.Contains(out.String()+errOut.String(), "PRIVATE_SENTINEL") {
			t.Fatal("private credentials leaked")
		}
	}
	var out, errOut bytes.Buffer
	if code := Run(context.Background(), []string{"--broker", "mqtt://localhost:1884", "check-config"}, &out, &errOut, false); code != 1 {
		t.Fatal("plaintext not rejected")
	}
	out.Reset()
	errOut.Reset()
	if code := Run(context.Background(), []string{"--broker", "mqtt://localhost:1884", "--allow-plaintext", "check-config"}, &out, &errOut, false); code != 0 {
		t.Fatal("explicit plaintext not accepted")
	}
}