from app.logging_security import REDACTED, redact_event, sanitize_text


def test_redacts_sensitive_fields_recursively() -> None:
    event = {
        "authorization": "Bearer top-secret",
        "nested": {
            "database_url": "postgresql://user:password@db/app",
            "safe": "kept",
        },
    }

    redacted = redact_event(None, "info", event)

    assert redacted["authorization"] == REDACTED
    assert redacted["nested"]["database_url"] == REDACTED
    assert redacted["nested"]["safe"] == "kept"


def test_redacts_credentials_embedded_in_text() -> None:
    value = (
        "POST https://callback-user:callback-password@example.test/cb"
        "?token=query-secret Authorization=Bearer header-secret"
    )

    redacted = sanitize_text(value)

    assert "callback-password" not in redacted
    assert "query-secret" not in redacted
    assert "header-secret" not in redacted
    assert redacted.count(REDACTED) == 3