#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Manual test script for log sanitizer to verify it works correctly."""

import sys
import logging
import io

# Set UTF-8 encoding for Windows console
if sys.platform == 'win32':
    import codecs
    sys.stdout = codecs.getwriter('utf-8')(sys.stdout.buffer, 'strict')

# Add mcpgateway to path
sys.path.insert(0, '.')

from mcpgateway.utils.log_sanitizer import sanitize_for_log

# Setup logging to capture output
handler = logging.StreamHandler(stream := io.StringIO())
handler.setFormatter(logging.Formatter('%(levelname)s:%(name)s:%(message)s'))
logger = logging.getLogger('test')
logger.addHandler(handler)
logger.setLevel(logging.DEBUG)

print("=" * 60)
print("Testing Log Injection Prevention")
print("=" * 60)

# Test 1: Normal text (should pass through unchanged)
print("\n1. Normal text test:")
normal_text = "normal error message"
logger.warning(f"OAuth error: {sanitize_for_log(normal_text)}")
output = stream.getvalue()
print(f"Input: {repr(normal_text)}")
print(f"Output: {output.strip()}")
assert "\n" not in output or output.count("\n") == 1, "Should be single line"
stream.truncate(0)
stream.seek(0)

# Test 2: Newline injection (the actual vulnerability)
print("\n2. Newline injection test (VULNERABILITY):")
malicious_input = "bad scope\nCRITICAL:root:SECURITY BREACH detected"
logger.warning(f"OAuth error: {sanitize_for_log(malicious_input)}")
output = stream.getvalue()
print(f"Input: {repr(malicious_input)}")
print(f"Output: {output.strip()}")
lines = output.strip().split('\n')
assert len(lines) == 1, f"Should be single line, got {len(lines)} lines"
assert "SECURITY BREACH" in output, "Content should be preserved"
print("✓ Attack prevented - single log line produced")
stream.truncate(0)
stream.seek(0)

# Test 3: CRLF injection
print("\n3. CRLF injection test:")
crlf_input = "error\r\nINFO:fake:Fake log entry"
logger.warning(f"OAuth error: {sanitize_for_log(crlf_input)}")
output = stream.getvalue()
print(f"Input: {repr(crlf_input)}")
print(f"Output: {output.strip()}")
lines = output.strip().split('\n')
assert len(lines) == 1, f"Should be single line, got {len(lines)} lines"
print("✓ CRLF attack prevented")
stream.truncate(0)
stream.seek(0)

# Test 4: Tab injection
print("\n4. Tab character test:")
tab_input = "col1\tcol2\tcol3"
logger.warning(f"Data: {sanitize_for_log(tab_input)}")
output = stream.getvalue()
print(f"Input: {repr(tab_input)}")
print(f"Output: {output.strip()}")
assert "\t" not in output, "Tabs should be removed"
print("✓ Tabs sanitized")
stream.truncate(0)
stream.seek(0)

# Test 5: Multiple control characters
print("\n5. Multiple control characters test:")
multi_input = "text\nwith\rmany\tcontrol\vchars"
logger.warning(f"Message: {sanitize_for_log(multi_input)}")
output = stream.getvalue()
print(f"Input: {repr(multi_input)}")
print(f"Output: {output.strip()}")
assert "\n" not in output or output.count("\n") == 1
assert "\r" not in output
assert "\t" not in output
assert "\v" not in output
print("✓ All control characters sanitized")
stream.truncate(0)
stream.seek(0)

# Test 6: Real-world OAuth scenario
print("\n6. Real-world OAuth callback scenario:")
error = "invalid_scope"
error_description = "Requested scope not available\nCRITICAL:security:BREACH DETECTED"
logger.warning(f"OAuth provider returned error callback: error={sanitize_for_log(error)}, description={sanitize_for_log(error_description)}")
output = stream.getvalue()
print(f"Error: {repr(error)}")
print(f"Description: {repr(error_description)}")
print(f"Output: {output.strip()}")
lines = output.strip().split('\n')
assert len(lines) == 1, f"Should be single line, got {len(lines)} lines"
print("✓ Real-world scenario protected")

print("\n" + "=" * 60)
print("✅ ALL TESTS PASSED - Log injection vulnerability fixed!")
print("=" * 60)