#!/usr/bin/env python3
"""Regression: ordinary UTAS diagnostics never expose session credentials."""
import importlib
import os
import sys
import tempfile

TOOLS = os.path.dirname(os.path.abspath(__file__))
if TOOLS not in sys.path:
    sys.path.insert(0, TOOLS)

CANARY = "OPENFUT_UTAS_CANARY_SECRET"


def main():
    with tempfile.TemporaryDirectory() as state:
        os.environ["FUT_ACCOUNT_PATH"] = os.path.join(state, "active_account.json")
        os.environ["FUT_PROFILE_ROOT"] = os.path.join(state, "accounts")
        os.environ["FUT_LOG"] = os.path.join(state, "utas.log")
        os.environ.pop("FUT_PROFILE", None)

        import utas_server
        importlib.reload(utas_server)

        for name in ("X-UT-SID", "Authorization", "Cookie", "Set-Cookie"):
            rendered = utas_server.safe_header_for_log(name, CANARY)
            assert rendered == "[REDACTED]", (name, rendered)
            assert CANARY not in rendered

        assert utas_server.safe_header_for_log("Content-Type", "application/json") == "application/json"
        assert utas_server.safe_header_for_log("X-Request-Id", "status-0") == "status-0"

    print("UTAS header redaction: PASS")


if __name__ == "__main__":
    main()