from app.logging_security import REDACTED, redact_event, sanitize_text


def test_redacts_sensitive_fields_recursively() -> None:
    event = {
        "api_key": "provider-key",
        "nested": {
            "callback_url": "https://user:password@example.test/callback",
            "status": "accepted",
        },
    }

    redacted = redact_event(None, "info", event)

    assert redacted["api_key"] == REDACTED
    assert redacted["nested"]["callback_url"] == REDACTED
    assert redacted["nested"]["status"] == "accepted"


def test_redacts_credentials_embedded_in_text() -> None:
    value = (
        "POST https://callback-user:callback-password@example.test/cb"
        "?api_key=query-secret Authorization=Basic header-secret"
    )

    redacted = sanitize_text(value)

    assert "callback-password" not in redacted
    assert "query-secret" not in redacted
    assert "header-secret" not in redacted
    assert redacted.count(REDACTED) == 3