from __future__ import annotations

from core.logging.filters import build_sensitive_data_processor


def test_redact_sensitive_fields_masks_values() -> None:
    processor = build_sensitive_data_processor(
        ["password", "token", "api_key", "cookie"]
    )

    event: dict[str, object] = {
        "message": "login",
        "password": "secret",
        "access_token": "token-123",
        "apiKey": "apikey-123",
        "set-cookie": "cookie-1",
        "nested": {"token": "abc", "safe": "ok"},
        "list": [{"password": "x"}],
    }

    redacted = processor(None, "info", event)

    assert redacted["password"] == "[REDACTED]"
    assert redacted["access_token"] == "[REDACTED]"
    assert redacted["apiKey"] == "[REDACTED]"
    assert redacted["set-cookie"] == "[REDACTED]"
    assert redacted["nested"]["token"] == "[REDACTED]"
    assert redacted["nested"]["safe"] == "ok"
    assert redacted["list"][0]["password"] == "[REDACTED]"
    assert event["password"] == "secret"
