<?php declare(strict_types=1);

/*
 * This file is part of the Monolog package.
 *
 * (c) Jordi Boggiano <j.boggiano@seld.be>
 *
 * For the full copyright and license information, please view the LICENSE
 * file that was distributed with this source code.
 */

namespace Monolog\Formatter;

use Monolog\Level;
use Monolog\LogRecord;
use Monolog\Processor\PsrLogMessageProcessor;
use Monolog\Test\MonologTestCase;
use PHPUnit\Framework\Attributes\DataProvider;

/**
 * @covers Monolog\Formatter\RedactingFormatter
 */
class RedactingFormatterTest extends MonologTestCase
{
    public function testRedactsSensitiveKeysInContextAndExtra()
    {
        $captured = null;
        $formatter = new RedactingFormatter($this->capturingFormatter($captured));

        $formatter->format($this->getRecord(
            context: ['user' => 'rishi', 'password' => 'super-secret', 'nested' => ['api_key' => 'abc123']],
            extra: ['token' => 't-456', 'irrelevant' => 'keep'],
        ));

        $this->assertSame('rishi', $captured->context['user']);
        $this->assertSame('[REDACTED]', $captured->context['password']);
        $this->assertSame('[REDACTED]', $captured->context['nested']['api_key']);
        $this->assertSame('[REDACTED]', $captured->extra['token']);
        $this->assertSame('keep', $captured->extra['irrelevant']);
    }

    public function testKeyMatchingIsCaseInsensitive()
    {
        $captured = null;
        $formatter = new RedactingFormatter($this->capturingFormatter($captured));

        $formatter->format($this->getRecord(context: ['Password' => 'x', 'AUTHORIZATION' => 'Bearer y']));

        $this->assertSame('[REDACTED]', $captured->context['Password']);
        $this->assertSame('[REDACTED]', $captured->context['AUTHORIZATION']);
    }

    public function testRedactsPatternsInFinalOutput()
    {
        $formatter = new RedactingFormatter(
            new LineFormatter('%message% %context%', 'Y-m-d'),
            sensitiveKeys: [],
            patterns: ['{Bearer\s+[A-Za-z0-9._-]+}'],
        );

        $output = $formatter->format($this->getRecord(
            message: 'Auth header Bearer abc.def-ghi',
            context: ['header' => 'Bearer zzz999'],
        ));

        $this->assertStringContainsString('Auth header [REDACTED]', $output);
        $this->assertStringNotContainsString('Bearer', $output);
    }

    public function testTokenPatternConstantRedactsLongTokens()
    {
        $formatter = new RedactingFormatter(
            new LineFormatter('%message%', 'Y-m-d'),
            sensitiveKeys: [],
            patterns: [RedactingFormatter::TOKEN_PATTERN],
        );

        $output = $formatter->format($this->getRecord(message: 'token is test_0123456789abcdefghijklmnopqrstuvwxyz here'));

        $this->assertStringContainsString('token is [REDACTED] here', $output);
    }

    public function testSweepsSecretsHiddenInsideNormalizedObjects()
    {
        // The secret lives inside an exception that only becomes a string once
        // the wrapped JsonFormatter normalizes the record. Redacting the record
        // alone would miss it; running the patterns over the output catches it.
        $formatter = new RedactingFormatter(
            new JsonFormatter(),
            sensitiveKeys: [],
            patterns: ['{Bearer\s+[A-Za-z0-9._-]+}'],
        );

        $output = $formatter->format($this->getRecord(
            context: ['exception' => new \RuntimeException('failed using Bearer abc.def-ghi')],
        ));

        $this->assertIsString($output);
        $this->assertStringNotContainsString('Bearer abc.def-ghi', $output);
        $this->assertStringContainsString('[REDACTED]', $output);
    }

    public function testSweepsArrayReturningFormatters()
    {
        $formatter = new RedactingFormatter(
            new NormalizerFormatter('Y-m-d'),
            sensitiveKeys: [],
            patterns: ['{Bearer\s+[A-Za-z0-9._-]+}'],
        );

        $output = $formatter->format($this->getRecord(message: 'Bearer abc.def-ghi'));

        $this->assertIsArray($output);
        $this->assertSame('[REDACTED]', $output['message']);
    }

    public function testFormatBatchRedactsEachRecord()
    {
        $formatter = new RedactingFormatter(
            new LineFormatter('%message% %context%', 'Y-m-d'),
            patterns: ['{Bearer\s+[A-Za-z0-9._-]+}'],
        );

        // LineFormatter::formatBatch joins records into a single string
        $output = $formatter->formatBatch([
            $this->getRecord(message: 'one Bearer aaa.bbb-ccc', context: ['password' => 'p1']),
            $this->getRecord(message: 'two', context: ['token' => 't2']),
        ]);

        $this->assertIsString($output);
        $this->assertStringNotContainsString('Bearer', $output);
        $this->assertStringNotContainsString('p1', $output);
        $this->assertStringNotContainsString('t2', $output);
        $this->assertSame(3, substr_count($output, '[REDACTED]')); // password key, token key, and Bearer pattern
    }

    public function testFormatBatchWithArrayReturningFormatter()
    {
        $formatter = new RedactingFormatter(new NormalizerFormatter('Y-m-d'));

        $output = $formatter->formatBatch([
            $this->getRecord(context: ['password' => 'p1']),
            $this->getRecord(context: ['token' => 't2']),
        ]);

        $this->assertIsArray($output);
        $this->assertSame('[REDACTED]', $output[0]['context']['password']);
        $this->assertSame('[REDACTED]', $output[1]['context']['token']);
    }

    public function testThrowsOnInvalidPattern()
    {
        $this->expectException(\InvalidArgumentException::class);

        new RedactingFormatter(new LineFormatter(), patterns: ['{invalid']);
    }

    public function testNoPatternsLeavesOutputUntouched()
    {
        $inner = new LineFormatter('%message%', 'Y-m-d');
        $record = $this->getRecord(message: 'a long token test_0123456789abcdefghijklmnopqrstuvwxyz');

        $formatter = new RedactingFormatter($inner, sensitiveKeys: []);

        $this->assertSame($inner->format($record), $formatter->format($record));
    }

    public function testCustomMask()
    {
        $captured = null;
        $formatter = new RedactingFormatter($this->capturingFormatter($captured), mask: '***');

        $formatter->format($this->getRecord(context: ['password' => 'x']));

        $this->assertSame('***', $captured->context['password']);
    }

    public function testRedactsSensitiveParameterValues()
    {
        $formatter = new RedactingFormatter(new LineFormatter('%message% %context%', 'Y-m-d'));

        $output = $formatter->format($this->getRecord(context: ['user' => new SensitiveParamHolder()]));

        $this->assertStringNotContainsString('s3cret-webhook', $output);
        $this->assertStringContainsString('[REDACTED]', $output);
        // the non-sensitive parameter is left alone
        $this->assertStringContainsString('user-1', $output);
    }

    public function testRedactsSensitiveParameterValuesWithJsonFormatter()
    {
        // JsonFormatter hands objects straight to json_encode, so nothing normalizes them
        $formatter = new RedactingFormatter(new JsonFormatter());

        $output = $formatter->format($this->getRecord(context: ['user' => new SensitiveParamHolder()]));

        $this->assertIsString($output);
        $this->assertStringNotContainsString('s3cret-webhook', $output);
        $this->assertStringContainsString('"mySecretUrl":"[REDACTED]"', $output);
    }

    public function testRedactsNonPublicSensitiveParameterLeakedByToString()
    {
        $formatter = new RedactingFormatter(new LineFormatter('%context%', 'Y-m-d'));

        $output = $formatter->format($this->getRecord(context: ['conn' => new SensitiveDsnHolder()]));

        $this->assertStringNotContainsString('hunter2', $output);
        $this->assertStringContainsString('Connection([REDACTED])', $output);
    }

    public function testRedactsNonPromotedSensitiveParameterMatchedByPropertyName()
    {
        $formatter = new RedactingFormatter(new LineFormatter('%context%', 'Y-m-d'));

        $output = $formatter->format($this->getRecord(context: ['sub' => new SensitiveNonPromotedHolder()]));

        $this->assertStringNotContainsString('tok-abcdefghij', $output);
        $this->assertStringContainsString('[REDACTED]', $output);
    }

    public function testRedactsSensitiveParameterOnNestedObjectAndInsideArrays()
    {
        $formatter = new RedactingFormatter(new LineFormatter('%context%', 'Y-m-d'));

        $output = $formatter->format($this->getRecord(context: ['list' => [['nested' => new SensitiveNestingHolder()]]]));

        $this->assertStringNotContainsString('s3cret-webhook', $output);
        $this->assertStringContainsString('[REDACTED]', $output);
    }

    public function testRedactsSecretAlreadyInterpolatedIntoTheMessage()
    {
        $formatter = new RedactingFormatter(new LineFormatter('%message% %context%', 'Y-m-d'));
        $processor = new PsrLogMessageProcessor();

        $output = $formatter->format($processor($this->getRecord(
            message: 'calling api with {token}',
            context: ['token' => 'tok-supersecret-value'],
        )));

        $this->assertStringNotContainsString('tok-supersecret-value', $output);
        $this->assertStringContainsString('calling api with [REDACTED]', $output);
    }

    public function testRedactsSecretEmbeddedInAnExceptionMessage()
    {
        $formatter = new RedactingFormatter(new JsonFormatter());

        $output = $formatter->format($this->getRecord(context: [
            'user' => new SensitiveParamHolder(),
            'exception' => new \RuntimeException('could not reach https://example.org/s3cret-webhook'),
        ]));

        $this->assertIsString($output);
        $this->assertStringNotContainsString('s3cret-webhook', $output);
        $this->assertStringContainsString('could not reach [REDACTED]', $output);
    }

    public function testRedactsSecretsNeedingJsonEscaping()
    {
        $formatter = new RedactingFormatter(new JsonFormatter(), sensitiveKeys: ['password']);

        $output = $formatter->format($this->getRecord(
            message: 'login failed for pa"ss\\word-123',
            context: ['password' => 'pa"ss\\word-123'],
        ));

        $this->assertIsString($output);
        $this->assertStringNotContainsString('word-123', $output);
        $this->assertSame(2, substr_count($output, '[REDACTED]')); // masked key + swept message
    }

    public function testRedactsSensitiveParameterValueObjects()
    {
        if (!class_exists(\SensitiveParameterValue::class)) {
            $this->markTestSkipped('SensitiveParameterValue requires PHP 8.2');
        }

        $formatter = new RedactingFormatter(new LineFormatter('%message% %context%', 'Y-m-d'));

        $output = $formatter->format($this->getRecord(
            message: 'token was tok-supersecret-value',
            context: ['arg' => new \SensitiveParameterValue('tok-supersecret-value')],
        ));

        $this->assertStringNotContainsString('tok-supersecret-value', $output);
    }

    public function testShortSecretsAreNotSwept()
    {
        $formatter = new RedactingFormatter(new LineFormatter('%message% %context%', 'Y-m-d'));

        $output = $formatter->format($this->getRecord(
            message: 'user pass logged in',
            context: ['password' => 'pass'],
        ));

        // the key is still masked, but "pass" is too short to be removed from the message
        $this->assertStringContainsString('user pass logged in', $output);
        $this->assertStringContainsString('[REDACTED]', $output);
    }

    public function testMinSecretLengthIsConfigurable()
    {
        $formatter = new RedactingFormatter(new LineFormatter('%message%', 'Y-m-d'), minSecretLength: 4);

        $output = $formatter->format($this->getRecord(message: 'user pass logged in', context: ['password' => 'pass']));

        $this->assertStringContainsString('user [REDACTED] logged in', $output);
    }

    public function testSensitiveParameterSupportCanBeDisabled()
    {
        $formatter = new RedactingFormatter(new LineFormatter('%message% %context%', 'Y-m-d'), redactSensitiveParameters: false);

        $output = $formatter->format($this->getRecord(
            message: 'calling https://example.org/s3cret-webhook',
            context: ['user' => new SensitiveParamHolder(), 'token' => 'tok-supersecret-value'],
        ));

        $this->assertStringContainsString('calling https://example.org/s3cret-webhook', $output);
        // sensitive keys are still swept from the output, only the objects are left alone
        $this->assertStringNotContainsString('tok-supersecret-value', $output);
    }

    #[DataProvider('provideEdgeCaseObjects')]
    public function testHandlesObjectsWithoutUsableConstructors(object $object)
    {
        $formatter = new RedactingFormatter(new LineFormatter('%context%', 'Y-m-d'));

        $output = $formatter->format($this->getRecord(context: ['edge' => $object]));

        $this->assertIsString($output);
    }

    public static function provideEdgeCaseObjects(): array
    {
        $cyclic = new SensitiveCyclicHolder();
        $cyclic->next = $cyclic;

        return [
            'no constructor' => [new \stdClass()],
            'enum' => [SensitiveTestEnum::One],
            'anonymous class' => [new class ('anon-secret-value') {
                public function __construct(#[\SensitiveParameter] public string $secret)
                {
                }
            }],
            'uninitialized property' => [(new \ReflectionClass(SensitiveNonPromotedHolder::class))->newInstanceWithoutConstructor()],
            'cyclic graph' => [$cyclic],
        ];
    }

    public function testCyclicGraphSecretsAreStillFound()
    {
        $cyclic = new SensitiveCyclicHolder();
        $cyclic->next = $cyclic;

        $formatter = new RedactingFormatter(new LineFormatter('%message%', 'Y-m-d'));

        $output = $formatter->format($this->getRecord(message: 'leaked cyclic-secret-value', context: ['obj' => $cyclic]));

        $this->assertStringContainsString('leaked [REDACTED]', $output);
    }

    public function testRedactsSensitiveParameterInheritedFromAParentClass()
    {
        $formatter = new RedactingFormatter(new LineFormatter('%context%', 'Y-m-d'));

        $output = $formatter->format($this->getRecord(context: ['creds' => new ChildCredentials()]));

        $this->assertStringNotContainsString('tok-inherited-secret', $output);
        $this->assertStringContainsString('token=[REDACTED]', $output);
    }

    public function testRedactsStringableSecretsAtSensitiveKeys()
    {
        $formatter = new RedactingFormatter(new LineFormatter('%message% %context%', 'Y-m-d'));

        $output = $formatter->format($this->getRecord(
            message: 'authenticating with stringable-secret-value',
            context: ['token' => new StringableSecret()],
        ));

        $this->assertStringNotContainsString('stringable-secret-value', $output);
    }

    public function testRedactsStringableSensitiveParameters()
    {
        $formatter = new RedactingFormatter(new LineFormatter('%context%', 'Y-m-d'));

        $output = $formatter->format($this->getRecord(context: ['holder' => new StringableSecretHolder()]));

        $this->assertStringNotContainsString('stringable-secret-value', $output);
        $this->assertStringContainsString('auth=[REDACTED]', $output);
    }

    public function testAThrowingToStringDoesNotBreakFormatting()
    {
        $formatter = new RedactingFormatter(new LineFormatter('%message% %context%', 'Y-m-d'));

        $output = $formatter->format($this->getRecord(
            message: 'still logged',
            context: ['token' => new ThrowingStringable()],
        ));

        $this->assertStringContainsString('still logged', $output);
    }

    public function testARecordIsDroppedRatherThanLeakedWhenAPatternCannotBeApplied()
    {
        // a /u pattern over invalid UTF-8 makes preg_replace() return null
        $formatter = new RedactingFormatter(
            new LineFormatter('%message%', 'Y-m-d'),
            sensitiveKeys: [],
            patterns: ['{tok-[a-z0-9]+}u'],
        );

        $output = $formatter->format($this->getRecord(message: 'secret tok-abc123 in '.\chr(0xFF).' here'));

        $this->assertStringNotContainsString('tok-abc123', $output);
        $this->assertStringContainsString('RedactingFormatter dropped this record', $output);
        // neither the pattern nor the mask is echoed back, both may embed secret material
        $this->assertStringNotContainsString('tok-[a-z0-9]+', $output);
    }

    public function testSelfReferencingContextArraysDoNotRecurseForever()
    {
        $context = ['password' => 'super-secret-value'];
        $context['self'] = &$context;

        $formatter = new RedactingFormatter(new LineFormatter('%context%', 'Y-m-d'));

        $output = $formatter->format($this->getRecord(context: $context));

        $this->assertIsString($output);
        $this->assertStringNotContainsString('super-secret-value', $output);
    }

    public function testSelfReferencingFormatterOutputDoesNotRecurseForever()
    {
        $inner = new class implements FormatterInterface {
            public function format(LogRecord $record)
            {
                $formatted = ['leaked' => 'tok-supersecret-value'];
                $formatted['self'] = &$formatted;

                return $formatted;
            }

            public function formatBatch(array $records)
            {
                return array_map(fn (LogRecord $record) => $this->format($record), $records);
            }
        };

        $output = (new RedactingFormatter($inner))->format($this->getRecord(context: ['token' => 'tok-supersecret-value']));

        $this->assertIsArray($output);
        $this->assertSame('[REDACTED]', $output['leaked']);
    }

    public function testGetWrappedFormatter()
    {
        $inner = new LineFormatter();

        $this->assertSame($inner, (new RedactingFormatter($inner))->getWrappedFormatter());
    }

    /**
     * Returns a formatter that records the (already redacted) LogRecord it receives
     * into $captured, so tests can assert on the structured record passed downstream.
     */
    private function capturingFormatter(?LogRecord &$captured): FormatterInterface
    {
        return new class($captured) implements FormatterInterface {
            public function __construct(private ?LogRecord &$captured)
            {
            }

            public function format(LogRecord $record)
            {
                $this->captured = $record;

                return '';
            }

            public function formatBatch(array $records)
            {
                foreach ($records as $record) {
                    $this->captured = $record;
                }

                return '';
            }
        };
    }
}

class SensitiveParamHolder
{
    public function __construct(
        public string $id = 'user-1',
        #[\SensitiveParameter]
        public string $mySecretUrl = 'https://example.org/s3cret-webhook',
    ) {
    }
}

class SensitiveDsnHolder
{
    public function __construct(
        #[\SensitiveParameter]
        private string $dsn = 'mysql://user:hunter2@localhost/db',
    ) {
    }

    public function __toString(): string
    {
        return 'Connection('.$this->dsn.')';
    }
}

class SensitiveNonPromotedHolder
{
    public string $token;

    public function __construct(#[\SensitiveParameter] string $token = 'tok-abcdefghij')
    {
        $this->token = $token;
    }
}

class SensitiveNestingHolder
{
    public function __construct(public SensitiveParamHolder $inner = new SensitiveParamHolder())
    {
    }
}

class SensitiveCyclicHolder
{
    public ?self $next = null;

    public function __construct(#[\SensitiveParameter] public string $secret = 'cyclic-secret-value')
    {
    }
}

enum SensitiveTestEnum: string
{
    case One = 'one';
}

class ParentCredentials
{
    public function __construct(
        #[\SensitiveParameter]
        private string $token = 'tok-inherited-secret',
    ) {
    }

    public function __toString(): string
    {
        return "token={$this->token}";
    }
}

class ChildCredentials extends ParentCredentials
{
}

class StringableSecret
{
    public function __construct(private string $value = 'stringable-secret-value')
    {
    }

    public function __toString(): string
    {
        return $this->value;
    }
}

class StringableSecretHolder
{
    public function __construct(
        #[\SensitiveParameter]
        private StringableSecret $token = new StringableSecret(),
    ) {
    }

    public function __toString(): string
    {
        return 'auth='.$this->token;
    }
}

class ThrowingStringable
{
    public function __toString(): string
    {
        throw new \RuntimeException('nope');
    }
}