from fastapi.testclient import TestClient

from app.main import app
from app.security.redaction import redact_authorization_header, redact_client_secret, redact_token, redact_upload_url


def test_health_endpoint_reports_ok():
    client = TestClient(app)
    response = client.get("/api/health")
    assert response.status_code == 200
    assert response.json()["status"] == "ok"


def test_redaction_helpers_never_return_secrets():
    assert redact_token("abc123secret") == "[REDACTED]"
    assert redact_client_secret("super-secret") == "[REDACTED]"
    assert redact_authorization_header("Bearer abc123") == "Bearer [REDACTED]"
    redacted = redact_upload_url("https://upload.example.test/path?token=abc&signature=def")
    assert "abc" not in redacted
    assert "def" not in redacted
    assert "[REDACTED]" in redacted