from lai_automation.models import FailureReport
from lai_automation.prompt import build_task, redact


def test_redact_removes_common_secrets_and_personal_markers() -> None:
    value = "password=hunter2 token: abc123 admin@example.com 10.2.3.4 Bearer secret.jwt"
    result = redact(value)
    assert "hunter2" not in result
    assert "abc123" not in result
    assert "admin@example.com" not in result
    assert "10.2.3.4" not in result
    assert "secret.jwt" not in result


def test_task_contains_constraints_and_redacted_report() -> None:
    report = FailureReport(
        id=7,
        chat_message_id=91,
        source="user_feedback",
        category="incorrect_answer",
        user_feedback="password=secret-value",
        prompt="List locations for admin@example.com",
        response=None,
        sql_query="SELECT * FROM company",
        error_message=None,
        context={"model": "mistral", "database_type": "customer"},
    )
    task = build_task(report)
    assert "failure report #7" in task
    assert "secret-value" not in task
    assert "admin@example.com" not in task
    assert "Do not commit or push" in task


def test_redact_removes_extended_credentials() -> None:
    private_key = "-----BEGIN PRIVATE KEY-----\nprivate-material\n-----END PRIVATE KEY-----"
    value = (
        "AKIAIOSFODNN7EXAMPLE "
        "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0In0.signature "
        "mysql://admin:database-password@db.internal/lai "
        f"{private_key}"
    )
    result = redact(value)
    assert "AKIAIOSFODNN7EXAMPLE" not in result
    assert "eyJhbGci" not in result
    assert "database-password" not in result
    assert "private-material" not in result