"""Connection probes must never return bearer-token fragments."""
from __future__ import annotations

from unittest.mock import AsyncMock, patch

import pytest

from app.integrations.drivers.feishu_chat_approval import (
    FeishuChatApprovalDriver,
)
from app.integrations.drivers.feishu_contact import FeishuContactDriver
from app.integrations.drivers.huilianyi import HuilianyiDriver

_TOKEN = "tenant-secret-token-123456789"


def _assert_token_absent(result) -> None:
    rendered = result.model_dump_json()
    assert _TOKEN not in rendered
    assert _TOKEN[:8] not in rendered
    assert "token_prefix" not in rendered


@pytest.mark.asyncio
async def test_feishu_approval_success_does_not_return_token_prefix() -> None:
    client = AsyncMock()
    client.get_tenant_access_token.return_value = _TOKEN
    driver = FeishuChatApprovalDriver(
        integration_id="approval-test",
        config={"app_id": "cli-test", "app_secret": "secret"},
    )

    with patch.object(driver, "_client", return_value=client):
        result = await driver.test_connection()

    assert result.ok
    _assert_token_absent(result)


@pytest.mark.asyncio
async def test_feishu_contact_success_does_not_return_token_prefix() -> None:
    client = AsyncMock()
    client.get_tenant_access_token.return_value = _TOKEN

    async def _request(method: str, path: str, **_kwargs):
        if path.startswith("/contact/v3/custom_attrs"):
            return {"items": []}
        return {}

    client.request.side_effect = _request
    driver = FeishuContactDriver(
        integration_id="contact-test",
        config={"app_id": "cli-test", "app_secret": "secret"},
    )

    with patch.object(driver, "_client", return_value=client):
        result = await driver.test_connection()

    assert result.ok
    _assert_token_absent(result)


@pytest.mark.asyncio
async def test_huilianyi_success_does_not_return_token_prefix() -> None:
    client = AsyncMock()
    client.get_access_token.return_value = _TOKEN
    client.request.return_value = (200, {"errorCode": "0000"}, "ok")
    driver = HuilianyiDriver(
        integration_id="huilianyi-test",
        config={
            "base_url": "https://api.huilianyi.com/gateway",
            "client_id": "client-id",
            "client_secret": "secret",
        },
    )

    with (
        patch.object(driver, "_client", return_value=client),
        patch(
            "app.integrations._url_safety.assert_safe_external_url_async",
            new=AsyncMock(),
        ),
    ):
        result = await driver.test_connection()

    assert result.ok
    _assert_token_absent(result)