from app.sanitizer import sanitize


def test_sensitive_mapping_values_are_redacted():
    payload = sanitize({
        "api_key": "sk-secret",
        "nested": {"Authorization": "Bearer token"},
        "data_source_url": "postgresql://user:pass@db/name",
        "safe": "ok",
    })
    assert payload == {
        "api_key": "***",
        "nested": {"Authorization": "***"},
        "data_source_url": "***",
        "safe": "ok",
    }


def test_connection_strings_are_redacted_inside_text():
    assert sanitize("connect postgresql://user:pass@db/name") == "connect postgresql://user:***@db/name"


def test_json_strings_and_authorization_schemes_are_fully_redacted():
    assert sanitize('{"api_key":"SECRET","safe":"ok"}') == '{"api_key":"***","safe":"ok"}'
    assert sanitize("Authorization: Bearer SECRET") == "Authorization: ***"
    assert sanitize("Authorization=Basic dXNlcjpwYXNz") == "Authorization=***"
    assert sanitize('{"access_token":"TOKEN"}') == '{"access_token":"***"}'