package secrets

import (
	"bytes"
	"testing"
)

// TestZeroKey verifies that ZeroKey overwrites every byte of the slice
// with zeros (P05 T6, REQ-147).
func TestZeroKey(t *testing.T) {
	key := []byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16,
		17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32}
	ZeroKey(key)
	want := make([]byte, 32)
	if !bytes.Equal(key, want) {
		t.Errorf("ZeroKey did not zero the slice: got %v, want %v", key, want)
	}
}

// TestZeroKey_NilAndEmpty verifies ZeroKey is safe on nil/empty slices.
func TestZeroKey_NilAndEmpty(t *testing.T) {
	ZeroKey(nil)      // must not panic
	ZeroKey([]byte{}) // must not panic
	ZeroKey([]byte{}) // must not panic
}

// TestZeroKey_PartialFill verifies zeroing works on a slice with a
// specific non-zero pattern across all bytes.
func TestZeroKey_PartialFill(t *testing.T) {
	key := make([]byte, 64)
	for i := range key {
		key[i] = 0xFF
	}
	ZeroKey(key)
	for i, b := range key {
		if b != 0 {
			t.Errorf("byte %d = 0x%02x, want 0x00", i, b)
		}
	}
}