import json
import logging
from fastapi.testclient import TestClient
from karldns import DdnsSettings, make_app


def test_creation_audit_preserves_public_provisioning_and_redacts(tmp_path, caplog):
    app = make_app(DdnsSettings(database_path=tmp_path / 'audit.sqlite3', admin_password='admin', hostname_suffix='example.net'))
    with TestClient(app) as client, caplog.at_level(logging.WARNING, logger='karldns.security'):
        for path, body, code in [('/', '', 303), ('/', '<?php eval("super-secret") ?>', 303), ('/api/v1/hostnames', 'super-secret', 201)]:
            caplog.clear()
            response = client.post(path, content=body, headers={'X-Request-ID': 'a' * 32}, follow_redirects=False)
            assert response.status_code == code
            event = json.loads(next(r.message.removeprefix('KARLDNSSEC ') for r in caplog.records if r.message.startswith('KARLDNSSEC ')))
            assert event['http']['request']['id'] == response.headers['x-request-id'] == 'a' * 32
            assert event['labels']['account_created'] is True
            assert event['labels']['dns_activation'] is False
            assert event['labels']['php_code_marker'] == ('<?php' in body)
            assert event['labels']['unexpected_body'] == bool(body)
            assert 'super-secret' not in json.dumps(event)
            assert response.headers.get('location', 'no-private-url') not in caplog.text
        caplog.clear()
        response = client.post('/', content='x', headers={'X-Request-ID': 'private-invalid-id'}, follow_redirects=False)
        assert len(response.headers['x-request-id']) == 32
        assert 'private-invalid-id' not in caplog.text
        assert app.state.store.count_accounts() == 4
        assert app.state.store.list_records() == []