import json

from secrets_engine.evidence import EvidenceWriter, _scrub
from secrets_engine.redact import looks_secret, redact_text


def test_redact_known_token_shapes():
    assert "npm_" not in redact_text("token=npm_abcdEFGH12345678abcd")
    assert "REDACTED" in redact_text("token=npm_abcdEFGH12345678abcd")
    assert "ghp_" not in redact_text("ghp_0123456789abcdef0123")


def test_redact_extra_literal():
    out = redact_text("the value is hunter2hunter2", extra=["hunter2hunter2"])
    assert "hunter2" not in out


def test_looks_secret():
    assert looks_secret("npm_token")
    assert looks_secret("API_KEY")
    assert not looks_secret("path")


def test_scrub_drops_secret_keys_and_redacts():
    scrubbed = _scrub({"token": "npm_realvalue123456789", "path": "a/b", "note": "ghp_0123456789abcdef0123"})
    assert scrubbed["token"].startswith("<omitted")
    assert scrubbed["path"] == "a/b"
    assert "ghp_" not in scrubbed["note"]


def test_evidence_record_has_no_value(tmp_path):
    w = EvidenceWriter(evidence_dir=tmp_path, hub_url="")  # hub disabled
    rec = w.record(
        "provision", result="from-file", catalog_id="lane", stage="prod",
        detail={"field": "npm_token", "value": "npm_shouldnotappear123"},
    )
    blob = json.dumps(rec)
    assert "npm_shouldnotappear123" not in blob
    # written to disk too
    files = list(tmp_path.glob("evidence-*.jsonl"))
    assert files and "npm_shouldnotappear123" not in files[0].read_text()