from pathlib import Path
import sys
import unittest
from unittest import mock

import pandas as pd


ROOT = Path(__file__).resolve().parents[1]
APP_DIR = ROOT / 'app'
sys.path.insert(0, str(APP_DIR))

import dashboard
from scanner_db import extract_redacted_secret


class DashboardSecretGuardTests(unittest.TestCase):
    def test_raw_only_finding_never_populates_redacted_column_with_raw(self):
        self.assertEqual(
            extract_redacted_secret({'Raw': 'raw-secret-value'}),
            '***REDACTED***',
        )

    def test_historical_unmasked_redacted_value_is_masked_before_render(self):
        frame = pd.DataFrame([{'redacted_secret': 'historical-raw-secret', 'detector_name': 'OpenAI'}])
        with mock.patch.object(dashboard.st, 'dataframe') as render:
            dashboard.display_df(frame)
        rendered = render.call_args.args[0]
        self.assertEqual(rendered.iloc[0]['redacted_secret'], '***REDACTED***')
        self.assertNotIn('historical-raw-secret', rendered.to_string())

    def test_historical_endpoint_credentials_are_removed_before_render(self):
        sentinels = (
            'DASHBOARD-URL-USER-SENTINEL',
            'DASHBOARD-URL-PASSWORD-SENTINEL',
            'DASHBOARD-API-KEY-SENTINEL',
            'DASHBOARD-TOKEN-SENTINEL',
            'DASHBOARD-QUERY-PASSWORD-SENTINEL',
        )
        contaminated = (
            f'https://{sentinels[0]}:{sentinels[1]}@normal.openai.azure.com:443/openai/deployments/demo'
            f'?api_key={sentinels[2]}&token={sentinels[3]}&password={sentinels[4]}#private'
        )
        normal = 'https://normal.openai.azure.com/openai/deployments/ordinary'
        frame = pd.DataFrame([
            {'endpoint': contaminated, 'detector_name': 'OpenAI'},
            {'endpoint': normal, 'detector_name': 'AzureOpenAI'},
        ])
        with mock.patch.object(dashboard.st, 'dataframe') as render:
            dashboard.display_df(frame)
        rendered = render.call_args.args[0]
        self.assertEqual(
            rendered.iloc[0]['endpoint'],
            'https://normal.openai.azure.com:443/openai/deployments/demo',
        )
        self.assertEqual(rendered.iloc[1]['endpoint'], normal)
        self.assertTrue(all(sentinel not in rendered.to_string() for sentinel in sentinels))


if __name__ == '__main__':
    unittest.main()