from flask import Flask


def test_datasource_list_never_serializes_credentials(monkeypatch):
    from app.api.data_source import routes
    from app.core.data_source.models import DataSourceDefinition
    from app.core.data_source.service import DataSourceService

    class FakeService:
        serialize = staticmethod(DataSourceService.serialize)

        def list(self, _payload):
            return [
                DataSourceDefinition(
                    uid="01900000-0000-7000-8000-000000000010",
                    name_en="warehouse",
                    database_type="postgresql",
                    host="db",
                    port=5432,
                    database="analytics",
                    credential_ref="credential-id",
                    credential_version=2,
                )
            ]

    monkeypatch.setattr(routes, "get_data_source_service", FakeService)
    app = Flask(__name__)

    with app.test_request_context("/api/datasource/list", method="POST", json={}):
        result = routes.data_source_list()
        response = result[0] if isinstance(result, tuple) else result

    text = response.get_data(as_text=True).lower()
    body = response.get_json()["data"]["data_source"][0]

    assert "password" not in text
    assert "username" not in text
    assert "encrypted_payload" not in text
    assert "credential_ref" not in text
    assert body["credential_configured"] is True