"""Tests for the masking display filter (WARDEN-WP-0026 T03)."""
from warden.mask import fingerprint, mask_value
from warden.proxy import ResolvedFetch, proxy_fetch_fingerprint


def test_mask_never_contains_the_value():
    secret = "ghp_realtokenvalue1234567890abcdef"
    masked = mask_value(secret)
    assert secret not in masked
    assert "hidden" in masked and "len=" in masked and "sha256:" in masked


def test_fingerprint_reports_presence_and_length():
    fp = fingerprint("abcd")
    assert fp.present is True and fp.length == 4
    assert len(fp.sha256_prefix) == 8


def test_absent_value_renders_absent():
    assert mask_value("") == "‹absent›"
    assert mask_value(None) == "‹absent›"
    assert fingerprint(None).present is False


def test_fingerprint_is_stable_and_discriminating():
    assert fingerprint("token-A").sha256_prefix == fingerprint("token-A").sha256_prefix
    assert fingerprint("token-A").sha256_prefix != fingerprint("token-B").sha256_prefix


def test_proxy_fingerprint_returns_mask_not_value():
    fp = proxy_fetch_fingerprint(ResolvedFetch(shell_cmd="printf 'the-secret-value'"))
    assert fp.present and fp.length == len("the-secret-value")
    assert "the-secret-value" not in fp.render()