package gcp

import (
	"context"
	"strings"
	"testing"

	"github.com/go-logr/logr/funcr"
	sdktrace "go.opentelemetry.io/otel/sdk/trace"
)

func TestWireFilterHandler_addsTraceContext(t *testing.T) {
	t.Parallel()

	var lines []string
	base := funcr.New(func(prefix, args string) {
		lines = append(lines, prefix+" "+args)
	}, funcr.Options{Verbosity: 5})
	log := wireLogger(base, WireLogOptions{})

	tp := sdktrace.NewTracerProvider()
	t.Cleanup(func() { _ = tp.Shutdown(context.Background()) })
	ctx, span := tp.Tracer("test").Start(context.Background(), "provider.create")
	defer span.End()

	log.DebugContext(ctx, "api request", "url", "https://compute.googleapis.com/x")
	if len(lines) != 1 {
		t.Fatalf("got %d lines, want 1: %v", len(lines), lines)
	}
	traceID := span.SpanContext().TraceID().String()
	if !strings.Contains(lines[0], "traceID") || !strings.Contains(lines[0], traceID) {
		t.Errorf("wire record missing trace context %s: %s", traceID, lines[0])
	}

	// The security filter must still win: non-wire Debug records are
	// dropped even when a span is present.
	log.DebugContext(ctx, "token exchange", "assertion", "secret-jwt")
	if len(lines) != 1 {
		t.Fatalf("filtered record leaked: %v", lines[1:])
	}

	// No span in ctx: record passes through without trace keys.
	log.DebugContext(context.Background(), "api response", "status", 200)
	if len(lines) != 2 {
		t.Fatalf("got %d lines, want 2", len(lines))
	}
	if strings.Contains(lines[1], "traceID") {
		t.Errorf("spanless record must not carry traceID: %s", lines[1])
	}
}