from __future__ import annotations

import unittest

from vpn_egressctl.redact import redact, redacted_diff, secret_fingerprint


class RedactionTests(unittest.TestCase):
    def test_recursive_redaction(self) -> None:
        value = {"password": "secret", "nested": {"obfs_password": "other", "server": "example.com"}}
        safe = redact(value)
        self.assertEqual(safe["password"], "<REDACTED>")
        self.assertEqual(safe["nested"]["obfs_password"], "<REDACTED>")
        self.assertEqual(safe["nested"]["server"], "example.com")

    def test_diff_hides_secrets(self) -> None:
        diff = "\n".join(redacted_diff({"password": "old"}, {"password": "new"}))
        self.assertNotIn("old", diff)
        self.assertNotIn("new", diff)
        self.assertIn("REDACTED", diff)

    def test_fingerprint_is_short_and_stable(self) -> None:
        self.assertEqual(secret_fingerprint("x"), secret_fingerprint("x"))
        self.assertEqual(len(secret_fingerprint("x")), 12)


if __name__ == "__main__":
    unittest.main()