"""Tests for the secret-masking JSON logger (obs-core)."""

from __future__ import annotations

from app.common.json_logger import (
    MASK,
    build_event,
    is_sensitive_key,
    mask_sensitive,
    redact_secrets,
)


def test_flat_secret_keys_are_masked():
    out = redact_secrets(
        {
            "api_key": "super-secret",
            "authorization": "Bearer abc",
            "password": "hunter2",
            "x_api_key": "k",
        }
    )
    assert out == {
        "api_key": MASK,
        "authorization": MASK,
        "password": MASK,
        "x_api_key": MASK,
    }


def test_nested_storage_kms_key_is_masked():
    out = redact_secrets(
        {
            "asset_id": "asset_123",
            "storage": {"bucket": "b", "object_key": "k", "kms_key_id": "arn:aws:kms:secret"},
        }
    )
    assert out["asset_id"] == "asset_123"
    assert out["storage"]["bucket"] == "b"
    assert out["storage"]["object_key"] == "k"  # neutral key NOT masked
    assert out["storage"]["kms_key_id"] == MASK


def test_neutral_keys_are_not_masked():
    for key in ("object_key", "idempotency_key", "storage_key", "asset_id", "owner_module"):
        assert is_sensitive_key(key) is False
    assert redact_secrets({"object_key": "x"}) == {"object_key": "x"}


def test_secret_keys_are_detected():
    for key in ("api_key", "x-api-key", "qdrant_api_key", "kms_key_id", "password", "authorization"):
        assert is_sensitive_key(key) is True


def test_list_values_are_recursed():
    out = redact_secrets({"items": [{"token": "t"}, {"name": "ok"}]})
    assert out["items"][0]["token"] == MASK
    assert out["items"][1]["name"] == "ok"


def test_mask_sensitive_processor_signature():
    event = {"event": "x.y", "api_key": "leak", "user": "u"}
    masked = mask_sensitive(None, "info", event)
    assert masked["api_key"] == MASK
    assert masked["event"] == "x.y"
    assert masked["user"] == "u"


def test_build_event_returns_masked_payload():
    payload = build_event("ingest", "doc.indexed", level="info", api_key="leak", asset_id="a1")
    assert payload["api_key"] == MASK
    assert payload["asset_id"] == "a1"
    assert payload["event"] == "doc.indexed"