"""Sensitive-field sanitizer strips known key names from log payloads."""

from __future__ import annotations

from ypms.logging import sanitize_for_log


def test_top_level_sensitive_keys_are_redacted() -> None:
    out = sanitize_for_log({"username": "chris", "password": "hunter2", "ssn": "111-22-3333"})
    assert out == {"username": "chris", "password": "REDACTED", "ssn": "REDACTED"}


def test_nested_dicts_are_recursed() -> None:
    out = sanitize_for_log(
        {"outer": {"token": "xyz", "safe": 1}, "safe_top": True, "authorization": "Bearer x"}
    )
    assert out == {
        "outer": {"token": "REDACTED", "safe": 1},
        "safe_top": True,
        "authorization": "REDACTED",
    }


def test_lists_are_left_alone() -> None:
    # Design decision: no per-element recursion into lists. Callers that
    # log lists of potentially-sensitive dicts should map through sanitize
    # themselves. Keeps the helper's contract predictable.
    out = sanitize_for_log({"users": [{"password": "x"}], "count": 1})
    assert out == {"users": [{"password": "x"}], "count": 1}