"""Tests for the config read/write API helpers in http.py."""
import pytest
from hbd.server import http


def test_mask_config_for_api_masks_user_passwords():
    config = {
        "hbd_port": 50004,
        "interval": 20,
        "users": {
            "alice": {"full_name": "Alice", "admin": True, "password": "pbkdf2:sha256:abc"},
        },
        "oauth": {},
    }
    result = http._mask_config_for_api(config)
    assert result["users"]["alice"]["password"] == "•••"
    assert result["users"]["alice"]["full_name"] == "Alice"


def test_mask_config_for_api_masks_oauth_client_secret():
    config = {
        "hbd_port": 50004,
        "interval": 20,
        "users": {},
        "oauth": {
            "gitea": {"type": "gitea", "url": "https://git.example.com",
                      "client_id": "cid", "client_secret": "verysecret"},
        },
    }
    result = http._mask_config_for_api(config)
    assert result["oauth"]["gitea"]["client_secret"] == "•••"
    assert result["oauth"]["gitea"]["client_id"] == "cid"


def test_mask_config_for_api_includes_server_keys():
    config = {"hbd_port": 50004, "interval": 20, "users": {}, "oauth": {}}
    result = http._mask_config_for_api(config)
    assert result["server"]["hbd_port"] == 50004
    assert result["server"]["interval"] == 20


def test_mask_config_for_api_no_password_in_users_leaves_no_key():
    config = {
        "hbd_port": 50004,
        "users": {"bob": {"full_name": "Bob", "admin": False}},
        "oauth": {},
    }
    result = http._mask_config_for_api(config)
    assert "password" not in result["users"]["bob"]