"""Tests for secret detection and sanitization helpers."""

from aegis_gitea_mcp.security import detect_secrets, sanitize_data


def test_detect_secrets_api_key_pattern() -> None:
    """Secret detector should identify common token formats."""
    findings = detect_secrets("token=sk-test12345678901234567890")
    assert findings


def test_issued_oauth_tokens_are_masked() -> None:
    """Our own ``agm_`` OAuth tokens are masked wherever they show up in content."""
    issued = "agm_" + "Ab3_-x" * 7 + "Z"  # the shape of agm_ + token_urlsafe(32)
    text = f"pasted by mistake: {issued}."

    findings = detect_secrets(text)
    masked = sanitize_data({"body": text})

    assert [finding.secret_type for finding in findings] == ["aegis_oauth_token"]
    assert issued not in masked["body"] and masked["body"].endswith(".")
    assert detect_secrets("agm_short") == []


def test_sanitize_data_mask_mode() -> None:
    """Mask mode should preserve structure while redacting values."""
    payload = {"content": "api_key=AKIA1234567890ABCDEF"}
    sanitized = sanitize_data(payload, mode="mask")

    assert sanitized["content"] != payload["content"]
    assert "AKIA" in sanitized["content"]


def test_sanitize_data_block_mode() -> None:
    """Block mode should replace secret-bearing fields entirely."""
    payload = {"nested": ["Bearer eyJhbGciOiJIUzI1NiJ9.abcd.efgh"]}
    sanitized = sanitize_data(payload, mode="block")

    assert sanitized["nested"][0] == "[REDACTED_SECRET]"