"""Foundation slice: privacy contract — RED phase (should fail until module exists)."""

def test_allowlist_registry_includes_required_operations():
    from reyna_cli.privacy_contract import ALLOWED_OPERATIONS

    assert "service.health" in ALLOWED_OPERATIONS
    assert "calendar.list" in ALLOWED_OPERATIONS


def test_command_to_operation_mapping():
    from reyna_cli.privacy_contract import command_to_operation

    assert command_to_operation("calendar_list_calendars") == "calendar.list"


def test_scrub_privacy_result_redacts_sensitive_keys_case_insensitive_recursive():
    from reyna_cli.privacy_contract import scrub_privacy_result

    payload = {
        "ok": True,
        "token": "should-redact",
        "nested": {
            "Password": "secret123",
            "safe": "keep-me",
            "deep": [{"SECRET": "hide", "value": 1}, {"Api_Key": "abc", "x": "y"}],
        },
        "Authorization": "Bearer xyz",
        "api_key": "key123",
        "normal": "visible",
    }
    scrubbed = scrub_privacy_result(payload)

    assert scrubbed["token"] == "[REDACTED]"
    assert scrubbed["nested"]["Password"] == "[REDACTED]"
    assert scrubbed["nested"]["safe"] == "keep-me"
    assert scrubbed["nested"]["deep"][0]["SECRET"] == "[REDACTED]"
    assert scrubbed["nested"]["deep"][0]["value"] == 1
    assert scrubbed["nested"]["deep"][1]["Api_Key"] == "[REDACTED]"
    assert scrubbed["Authorization"] == "[REDACTED]"
    assert scrubbed["api_key"] == "[REDACTED]"
    assert scrubbed["normal"] == "visible"
    # original unchanged (no mutation)
    assert payload["token"] == "should-redact"


def test_scrub_privacy_result_preserves_non_sensitive_and_handles_lists():
    from reyna_cli.privacy_contract import scrub_privacy_result

    data = {"ok": True, "value": {"calendar": "Home"}}
    assert scrub_privacy_result(data) == {"ok": True, "value": {"calendar": "Home"}}

    data2 = [{"token": "a"}, {"safe": "b"}]
    assert scrub_privacy_result(data2) == [{"token": "[REDACTED]"}, {"safe": "b"}]


def test_scrub_exact_key_match_only():
    """Only exactly token/password/secret/api_key/authorization should be redacted."""
    from reyna_cli.privacy_contract import scrub_privacy_result

    payload = {
        "my_token": "should-not-redact",
        "tokenizer": "keep",
        "passwords": "keep",
        "api_key_id": "keep",
        "secret": "redact",
    }
    scrubbed = scrub_privacy_result(payload)
    assert scrubbed["my_token"] == "should-not-redact"
    assert scrubbed["tokenizer"] == "keep"
    assert scrubbed["passwords"] == "keep"
    assert scrubbed["api_key_id"] == "keep"
    assert scrubbed["secret"] == "[REDACTED]"