import logging

from qonto_assistant.audit import AuditLogger, REDACTED


def test_audit_logger_redacts_secret_fields() -> None:
    events: list[dict[str, object]] = []
    logger = logging.getLogger("qonto_assistant.audit.test")
    logger.handlers.clear()
    audit = AuditLogger(logger=logger, sink=events.append)

    payload = audit.emit(
        {
            "authorization": "Bearer super-secret",
            "api_key": "top-secret",
            "nested": {"token": "child-secret"},
            "capability": "org_summary",
        }
    )

    assert payload["authorization"] == REDACTED
    assert payload["api_key"] == REDACTED
    assert payload["nested"]["token"] == REDACTED
    assert "super-secret" not in str(events[0])
    assert "top-secret" not in str(events[0])