#[cfg(test)]
mod middleware_tests {
    use dd0c_route::proxy::middleware::redact_sensitive;

    // --- API Key Redaction (BMad Must-Have 12.1) ---

    #[test]
    fn redacts_openai_live_key() {
        let input = "Error processing request with key sk-live-abc123xyz456def789ghi012";
        let result = redact_sensitive(input);
        assert!(!result.contains("sk-live-abc123xyz456def789ghi012"));
        assert!(result.contains("[REDACTED"));
    }

    #[test]
    fn redacts_openai_project_key() {
        let input = "Upstream returned: Invalid API key sk-proj-abc123xyz456def789ghi012";
        let result = redact_sensitive(input);
        assert!(!result.contains("sk-proj-abc123xyz456def789ghi012"));
    }

    #[test]
    fn redacts_anthropic_key() {
        let input = "Auth failed for sk-ant-api03-abc123xyz456def789ghi012jkl345mno678";
        let result = redact_sensitive(input);
        assert!(!result.contains("sk-ant-api03"));
    }

    #[test]
    fn redacts_bearer_token() {
        let input = "Authorization: Bearer sk-live-secret123456789abcdef";
        let result = redact_sensitive(input);
        assert!(!result.contains("sk-live-secret"));
        assert!(result.contains("[REDACTED"));
    }

    #[test]
    fn does_not_redact_normal_text() {
        let input = "Hello world, this is a normal log message about the proxy";
        let result = redact_sensitive(input);
        assert_eq!(result, input);
    }

    #[test]
    fn does_not_redact_short_sk_prefix() {
        // "sk-" alone or with < 20 chars should not be redacted
        let input = "The key prefix is sk-abc";
        let result = redact_sensitive(input);
        assert_eq!(result, input);
    }

    #[test]
    fn redacts_multiple_keys_in_same_string() {
        let input = "Key1: sk-live-aaaaaaaaaaaaaaaaaaaaaa Key2: sk-proj-bbbbbbbbbbbbbbbbbbbbbb";
        let result = redact_sensitive(input);
        assert!(!result.contains("aaaaaaaaaa"));
        assert!(!result.contains("bbbbbbbbbb"));
    }

    #[test]
    fn redacts_key_in_json_error_body() {
        let input = r#"{"error": "Invalid API key: sk-proj-abc123xyz456def789ghi012"}"#;
        let result = redact_sensitive(input);
        assert!(!result.contains("sk-proj-abc123xyz456def789ghi012"));
    }

    #[test]
    fn telemetry_event_serialization_never_contains_key() {
        use dd0c_route::data::TelemetryEvent;
        let event = TelemetryEvent {
            org_id: "org-1".to_string(),
            original_model: "gpt-4o".to_string(),
            routed_model: "gpt-4o-mini".to_string(),
            provider: "openai".to_string(),
            strategy: "cheapest".to_string(),
            latency_ms: 3,
            status_code: 200,
            is_streaming: false,
            prompt_tokens: 100,
            completion_tokens: 50,
            timestamp: chrono::Utc::now(),
        };
        let serialized = serde_json::to_string(&event).unwrap();
        assert!(!serialized.contains("sk-"));
        assert!(!serialized.contains("Bearer"));
    }
}
