from __future__ import annotations

import logging


def test_global_error_boundary_redacts_secrets_and_returns_correlation_id(
    caplog,
    monkeypatch,
):
    from flask import Blueprint

    from app import create_app

    monkeypatch.setattr(
        "app.core.system.permissions.authenticate_request",
        lambda: {
            "id": "00000000-0000-7000-8000-000000000111",
            "roles": ["admin"],
        },
    )
    app = create_app()
    app.config.update(TESTING=False, PROPAGATE_EXCEPTIONS=False)
    failure = Blueprint("wp12_failure", __name__)

    @failure.get("/api/wp12/failure")
    def unsafe_failure():
        raise RuntimeError(
            "password=database-secret "
            "postgresql://admin:url-secret@db/dataops "
            "Authorization: Bearer bearer-secret"
        )

    app.register_blueprint(failure)
    with caplog.at_level(logging.ERROR):
        response = app.test_client().get("/api/wp12/failure")

    assert response.status_code == 500
    payload = response.get_json()
    assert payload["message"] == "服务器内部错误"
    assert len(payload["correlation_id"]) == 36
    combined = caplog.text + repr(payload)
    for secret in ("database-secret", "url-secret", "bearer-secret"):
        assert secret not in combined


def test_audit_and_auth_responses_disable_storage_and_add_security_headers(
    monkeypatch,
):
    from app import create_app

    monkeypatch.setattr(
        "app.core.system.permissions.authenticate_request",
        lambda: {
            "id": "00000000-0000-7000-8000-000000000111",
            "roles": ["admin"],
        },
    )
    app = create_app()
    app.config.update(TESTING=True)
    response = app.test_client().get("/api/system/auth/me")

    assert response.status_code == 200
    assert response.headers["Cache-Control"] == "no-store"
    assert response.headers["Referrer-Policy"] == "no-referrer"
    assert response.headers["Permissions-Policy"] == (
        "camera=(), microphone=(), geolocation=()"
    )