from __future__ import annotations

import unittest

from .redaction import RedactionError, assert_no_leaks, redact, scan_for_leaks


class RedactionTests(unittest.TestCase):
    def test_recursive_canary_redaction_across_all_evidence_surfaces(self) -> None:
        canary = "canary-value-93f1"
        evidence = {
            canary + "-key": "key canary",
            "environment": {"OPENAI_API_KEY": canary, "SAFE_MODE": "on"},
            "argv": ["--token", canary],
            "stdout": "output " + canary,
            "stderr": "error " + canary,
            "exception": RuntimeError("failed with " + canary),
            "nested": [{"GITHUB_TOKEN": "another-value"}],
        }
        self.assertTrue(scan_for_leaks(evidence, canaries=[canary]))
        redacted = redact(evidence, canaries=[canary])
        assert_no_leaks(redacted, canaries=[canary])
        self.assertEqual(redacted["environment"]["SAFE_MODE"], "on")
        self.assertNotIn(canary, str(redacted))
        self.assertIn("[REDACTED]", str(redacted))

    def test_configured_name_pattern_is_precise_for_safe_fields(self) -> None:
        evidence = {
            "status": "passed",
            "provider": "fixture",
            "tokenCount": 2,
            "MY_SECRET_ALPHA": "fixture-secret",
            "message": "MY_SECRET_ALPHA was used",
        }
        patterns = [r"(?<![A-Za-z0-9])MY_SECRET_[A-Z]+(?![A-Za-z0-9])"]
        leaks = scan_for_leaks(evidence, credential_name_patterns=patterns)
        self.assertIn("MY_SECRET_ALPHA", leaks)
        self.assertIn("message", leaks)
        self.assertNotIn("status", leaks)
        self.assertNotIn("provider", leaks)
        self.assertNotIn("tokenCount", leaks)
        cleaned = redact(evidence, credential_name_patterns=patterns)
        assert_no_leaks(cleaned, credential_name_patterns=patterns)
        self.assertEqual(cleaned["status"], "passed")
        self.assertEqual(cleaned["provider"], "fixture")
        self.assertEqual(cleaned["tokenCount"], 2)

    def test_leak_assertion_rejects_unredacted_summary_material(self) -> None:
        with self.assertRaises(RedactionError):
            assert_no_leaks(
                {"observation": "GITHUB_TOKEN still visible"},
                canaries=["a-secret-canary"],
            )


if __name__ == "__main__":
    unittest.main()