"""Le journal d'audit doit être utile sans enregistrer de secrets."""
from app_new.core.models.audit import AuditLog


def test_login_attempt_is_audited_and_password_is_redacted(client, app):
    response = client.post('/auth/login', data={
        'username': 'personne-inconnue',
        'password': 'secret-qui-ne-doit-pas-etre-stocke',
    })
    assert response.status_code == 200

    with app.app_context():
        entry = AuditLog.query.filter_by(endpoint='auth.login').order_by(AuditLog.id.desc()).first()
        assert entry is not None
        assert entry.action == 'POST'
        assert 'secret-qui-ne-doit-pas-etre-stocke' not in entry.payload
        assert '[MASQUÉ]' in entry.payload


def test_audit_page_is_admin_only(client, app):
    assert client.get('/admin/audit').status_code == 302