package model

import (
	"encoding/json"
	"testing"
)

func TestUserJSONOmitsPasswordHash(t *testing.T) {
	u := User{
		ID:           "user-1",
		Username:     "alice",
		Email:        "alice@example.com",
		PasswordHash: "hash-secret",
		Status:       StatusActive,
	}

	raw, err := json.Marshal(u)
	if err != nil {
		t.Fatalf("json.Marshal: %v", err)
	}

	var m map[string]interface{}
	if err := json.Unmarshal(raw, &m); err != nil {
		t.Fatalf("json.Unmarshal: %v", err)
	}

	assertJSONKeysAbsent(t, m, "PasswordHash", "password_hash")
}

func TestSessionJSONOmitsTokenHash(t *testing.T) {
	s := Session{
		ID:        "session-1",
		UserID:    "user-1",
		TokenHash: "token-hash-secret",
	}

	raw, err := json.Marshal(s)
	if err != nil {
		t.Fatalf("json.Marshal: %v", err)
	}

	var m map[string]interface{}
	if err := json.Unmarshal(raw, &m); err != nil {
		t.Fatalf("json.Unmarshal: %v", err)
	}

	assertJSONKeysAbsent(t, m, "TokenHash", "token_hash")
}

func TestCredentialJSONOmitsSecretHash(t *testing.T) {
	c := Credential{
		ID:         "credential-1",
		UserID:     "user-1",
		Type:       "app_passkey",
		Label:      "Phone",
		SecretHash: "credential-secret",
	}

	raw, err := json.Marshal(c)
	if err != nil {
		t.Fatalf("json.Marshal: %v", err)
	}

	var m map[string]interface{}
	if err := json.Unmarshal(raw, &m); err != nil {
		t.Fatalf("json.Unmarshal: %v", err)
	}

	assertJSONKeysAbsent(t, m, "SecretHash", "secret_hash")
}

func assertJSONKeysAbsent(t *testing.T, m map[string]interface{}, keys ...string) {
	t.Helper()

	for _, key := range keys {
		if _, ok := m[key]; ok {
			t.Errorf("%s field should not appear in JSON output", key)
		}
	}
}