package http

import (
	"testing"
	"time"

	licenseclient "qycw/go-server/internal/license"
)

func TestApplyLocalLicenseInfoOnlyReturnsDisplayFields(t *testing.T) {
	verifiedAt := time.Date(2026, 7, 11, 1, 2, 3, 0, time.UTC)
	info := map[string]any{}
	applyLocalLicenseInfo(info, licenseclient.State{
		Code:       "AUTH-SECRET",
		Type:       "standard",
		Version:    "0.10",
		VerifiedAt: verifiedAt,
		Identity: licenseclient.Identity{
			InstanceID:   "550e8400-e29b-41d4-a716-446655440000",
			InstanceName: "production-01",
			SystemName:   "linux",
			SystemArch:   "amd64",
			BackendURL:   "https://example.com",
		},
		InstanceToken:   "inst_secret",
		LastHeartbeatAt: verifiedAt,
	}, "0.1.0")

	for _, forbidden := range []string{"code", "license_code", "instance_token", "instance_id"} {
		if _, exists := info[forbidden]; exists {
			t.Fatalf("sensitive field %q was exposed", forbidden)
		}
	}
	if info["instance_name"] != "production-01" || info["system_name"] != "linux" || info["verified_at"] != verifiedAt.Format(time.RFC3339) {
		t.Fatalf("display fields = %#v", info)
	}
}
