KArtSell.Aegis/tests/KArtSell.ArchitectureTests/PiiRedactionTests.cs

using Xunit;
using System.Text.RegularExpressions;

namespace KArtSell.ArchitectureTests;

/// <summary>
/// AEG-X-007: PII Redaction Policy Tests
/// Ensures sensitive data patterns are properly redacted
/// Evidence for: Security validation (AGENTS.md v16.0)
/// </summary>
public class PiiRedactionPolicyTests
{
    private static string RedactSensitiveData(string input)
    {
        if (string.IsNullOrEmpty(input)) return input;

        // SSN pattern: XXX-XX-XXXX
        var redacted = Regex.Replace(input, @"(\d{3})-(\d{2})-(\d{4})", "***-**-****");

        // Email pattern
        redacted = Regex.Replace(redacted, @"[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}", "[REDACTED]@example.com");

        // Credit card pattern (4532-1234-5678-9010)
        redacted = Regex.Replace(redacted, @"\d{4}-\d{4}-\d{4}-\d{4}", "****-****-****-****");

        // API key pattern (sk-xxxxx...)
        redacted = Regex.Replace(redacted, @"sk-[A-Za-z0-9]{32,}", "[REDACTED_API_KEY]");

        return redacted;
    }

    [Fact]
    public void Redact_SocialSecurityNumber()
    {
        // Arrange
        var input = "User SSN: 123-45-6789 processed";

        // Act
        var result = RedactSensitiveData(input);

        // Assert
        Assert.DoesNotContain("123-45-6789", result);
        Assert.Contains("***-**-****", result);
    }

    [Fact]
    public void Redact_EmailAddress()
    {
        // Arrange
        var input = "Contact john.doe@example.com for support";

        // Act
        var result = RedactSensitiveData(input);

        // Assert
        Assert.DoesNotContain("john.doe@example.com", result);
        Assert.Contains("[REDACTED]@example.com", result);
    }

    [Fact]
    public void Redact_CreditCard()
    {
        // Arrange
        var input = "Payment card 4532-1234-5678-9010 processed";

        // Act
        var result = RedactSensitiveData(input);

        // Assert
        Assert.DoesNotContain("4532-1234-5678-9010", result);
        Assert.Contains("****-****-****-****", result);
    }

    [Fact]
    public void Redact_ApiKey()
    {
        // Arrange
        var input = "Using API key sk-1234567890abcdef1234567890abcdef";

        // Act
        var result = RedactSensitiveData(input);

        // Assert
        Assert.DoesNotContain("sk-1234567890abcdef1234567890abcdef", result);
        Assert.Contains("[REDACTED_API_KEY]", result);
    }

    [Fact]
    public void Redact_MultiplePatterns()
    {
        // Arrange
        var input = "User 123-45-6789 emailed john.doe@example.com with card 4532-1234-5678-9010";

        // Act
        var result = RedactSensitiveData(input);

        // Assert
        Assert.DoesNotContain("123-45-6789", result);
        Assert.DoesNotContain("john.doe@example.com", result);
        Assert.DoesNotContain("4532-1234-5678-9010", result);
        Assert.Contains("***-**-****", result);
        Assert.Contains("[REDACTED]@example.com", result);
        Assert.Contains("****-****-****-****", result);
    }

    [Fact]
    public void Redact_EmptyString()
    {
        // Arrange
        var input = "";

        // Act
        var result = RedactSensitiveData(input);

        // Assert
        Assert.Equal("", result);
    }
}