package controlplane

import (
	"path/filepath"
	"strings"
	"testing"
)

func TestSkillDocumentProvidesReadOnlyMarkdownWithSensitiveLinesRedacted(t *testing.T) {
	t.Setenv("MULTICLAW_CONTROLLER_DATA_DIR", t.TempDir())
	controller, err := Open(filepath.Join(t.TempDir(), "controller-config.json"))
	if err != nil {
		t.Fatal(err)
	}
	defer controller.Close()
	skill, err := controller.SaveSkill(SkillInput{
		Name:    "只读预览测试",
		Version: "1.0.0",
		Content: "# Skill\n\npassword: demo-password\napi_key=demo-key\n普通说明\n<think>不应显示</think>",
	})
	if err != nil {
		t.Fatal(err)
	}

	document, err := controller.SkillDocument(skill.ID)
	if err != nil {
		t.Fatal(err)
	}
	if document.ID != skill.ID || document.Name != skill.Name || !strings.Contains(document.Content, "普通说明") {
		t.Fatalf("unexpected Skill document: %#v", document)
	}
	for _, forbidden := range []string{"demo-password", "demo-key", "不应显示"} {
		if strings.Contains(document.Content, forbidden) {
			t.Fatalf("Skill preview leaked sensitive or hidden content: %q", forbidden)
		}
	}
	if strings.Count(document.Content, "[已脱敏]") != 2 {
		t.Fatalf("expected both sensitive values to be redacted: %q", document.Content)
	}
	if _, err := controller.SkillDocument("not-a-skill-id"); err == nil {
		t.Fatal("invalid Skill ID must be rejected")
	}
}