from __future__ import annotations

from app.api.v1.endpoints.platform import _public_model
from app.core.audit import _safe_exception_reason
from app.core.auth import RESOURCE_ACTIONS, RESOURCE_ACTION_ALIASES


def test_public_model_never_exposes_provider_credentials() -> None:
    result = _public_model({
        "id": "m_1",
        "name": "online",
        "api_url": "https://example.invalid/v1",
        "api_key": "secret-value",
    })

    assert "api_key" not in result
    assert result["api_key_configured"] is True
    assert result["name"] == "online"


def test_resource_action_registry_keeps_export_separate_from_module_permissions() -> None:
    assert "download" in RESOURCE_ACTIONS
    assert "execute" in RESOURCE_ACTIONS
    assert RESOURCE_ACTION_ALIASES["export"] == "download"


def test_audit_exception_reason_masks_credentials() -> None:
    reason = _safe_exception_reason(ValueError("api_key=secret-value"))
    assert "secret-value" not in reason
    assert "***" in reason