"""
Tests for run-payload logging.

Covers sanitize_payload() in session_logger.py — the guard that lets the full
run payload go into the Supabase session_logs meta column on every run without
ever leaking secrets (trusted-auth keys, API keys, passwords).
"""

import json

from session_logger import sanitize_payload


def test_secret_keys_are_redacted():
    payload = {
        'thoughtspot_trusted_auth_key': 'super-secret-value-123',
        'openai_api_key': 'sk-abc',
        'password': 'hunter2',
        'some_token': 'tok_xyz',
        'thoughtspot_url': 'https://demo.thoughtspot.cloud',
        'company': 'Acme',
    }
    out = sanitize_payload(payload)
    dumped = json.dumps(out)
    assert 'super-secret-value-123' not in dumped
    assert 'sk-abc' not in dumped
    assert 'hunter2' not in dumped
    assert 'tok_xyz' not in dumped
    # Non-secret values pass through untouched
    assert out['thoughtspot_url'] == 'https://demo.thoughtspot.cloud'
    assert out['company'] == 'Acme'
    # Redacted values carry a length marker, not the secret
    assert out['thoughtspot_trusted_auth_key'].startswith('<redacted')


def test_nested_secrets_are_redacted():
    payload = {'settings': {'inner': {'auth_key': 'deep-secret'}}}
    out = sanitize_payload(payload)
    assert 'deep-secret' not in json.dumps(out)


def test_long_strings_are_truncated():
    out = sanitize_payload({'ddl': 'x' * 5000})
    assert len(out['ddl']) < 2100
    assert 'truncated' in out['ddl']


def test_json_safe_output():
    class Weird:
        def __repr__(self):
            return 'WeirdObject'

    payload = {
        'obj': Weird(),
        'tuple': (1, 2),
        'none': None,
        'flag': True,
        'num': 3.5,
        'list': [{'k': 'v'}, 'plain'],
    }
    out = sanitize_payload(payload)
    # Must round-trip through JSON without default= hacks (Supabase insert path)
    json.dumps(out)
    assert out['obj'] == 'WeirdObject'
    assert out['tuple'] == [1, 2]
    assert out['none'] is None


def test_typical_run_payload_shape():
    """A realistic snapshot like _snapshot_run_payload() produces."""
    snapshot = {
        'interface': 'app_defined',
        'company': 'https://nike.com',
        'use_case': 'Retail Sales Performance',
        'vertical': 'Retail',
        'line': 'Retail',
        'function': 'Sales',
        'is_custom': False,
        'additional_context': '',
        'form': {
            'vertical': 'Retail', 'line': 'Retail', 'function': 'Sales',
            'url': 'https://nike.com', 'use_url': True, 'additional_info': '',
            'model': 'GPT-5', 'ts_environment': 'SE Demo', 'liveboard_name': None,
            'data_size': 'Medium', 'geo_scope': 'USA Only', 'tag_name': '',
            'column_naming': 'snake_case', 'object_prefix': '', 'share_with': '',
        },
        'settings': {
            'model': 'GPT-5',
            'thoughtspot_trusted_auth_key': 'SECRET',
            'fact_table_size': '10000',
        },
    }
    out = sanitize_payload(snapshot)
    assert 'SECRET' not in json.dumps(out)
    assert out['form']['data_size'] == 'Medium'
    assert out['settings']['fact_table_size'] == '10000'