"""Unit tests for sensitive data redaction utilities (metric labels)."""

from src.utils.redaction import is_sensitive_label_key, redact_labels


class TestIsSensitiveLabelKey:
    """is_sensitive_label_key matches sensitive patterns case-insensitively."""

    def test_exact_match_password(self):
        assert is_sensitive_label_key("password") is True

    def test_exact_match_secret(self):
        assert is_sensitive_label_key("secret") is True

    def test_exact_match_token(self):
        assert is_sensitive_label_key("token") is True

    def test_substring_match(self):
        assert is_sensitive_label_key("my_password") is True
        assert is_sensitive_label_key("api_key") is True
        assert is_sensitive_label_key("auth_header") is True

    def test_case_insensitive(self):
        assert is_sensitive_label_key("PASSWORD") is True
        assert is_sensitive_label_key("Token") is True
        assert is_sensitive_label_key("SECRET") is True

    def test_non_sensitive_keys_return_false(self):
        assert is_sensitive_label_key("user") is False
        assert is_sensitive_label_key("instance") is False
        assert is_sensitive_label_key("job") is False
        assert is_sensitive_label_key("__name__") is False


class TestRedactLabels:
    """redact_labels replaces sensitive values with [REDACTED], preserves keys."""

    def test_empty_dict(self):
        assert redact_labels({}) == {}

    def test_no_sensitive_keys_unchanged(self):
        labels = {"job": "prometheus", "instance": "localhost:9090"}
        assert redact_labels(labels) == labels

    def test_single_sensitive_key_value_redacted(self):
        labels = {"password": "supersecret"}
        assert redact_labels(labels) == {"password": "[REDACTED]"}

    def test_key_preserved_value_redacted(self):
        labels = {"api_key": "sk-12345"}
        result = redact_labels(labels)
        assert result["api_key"] == "[REDACTED]"

    def test_mixed_labels(self):
        labels = {
            "job": "prometheus",
            "token": "bearer-xyz",
            "instance": "localhost",
            "secret": "hidden",
        }
        result = redact_labels(labels)
        assert result["job"] == "prometheus"
        assert result["instance"] == "localhost"
        assert result["token"] == "[REDACTED]"
        assert result["secret"] == "[REDACTED]"

    def test_case_insensitive_key_matching(self):
        labels = {"Password": "pwd", "TOKEN": "t123"}
        result = redact_labels(labels)
        assert result["Password"] == "[REDACTED]"
        assert result["TOKEN"] == "[REDACTED]"

    def test_returns_new_dict(self):
        labels = {"user": "alice"}
        result = redact_labels(labels)
        assert result is not labels
        assert result == labels