"""Tests for MB-Secure diagnostics redaction."""

from unittest.mock import AsyncMock, MagicMock

from homeassistant.core import HomeAssistant
from pytest_homeassistant_custom_component.common import MockConfigEntry

from custom_components.mb_secure.const import CONF_TOKEN, DOMAIN
from custom_components.mb_secure.diagnostics import async_get_config_entry_diagnostics


async def test_diagnostics_redact_config_and_whitelist_bridge_data(
    hass: HomeAssistant,
) -> None:
    """Tokens, hosts, and unrecognized bridge fields never leave diagnostics."""
    entry = MockConfigEntry(
        domain=DOMAIN,
        data={
            "host": "private-host.local",
            "port": 8099,
            CONF_TOKEN: "x" * 32,
        },
        unique_id="bridge-installation-1",
    )
    coordinator = MagicMock()
    coordinator.client.async_get_diagnostics = AsyncMock(
        return_value={
            "api_version": 1,
            "connected": True,
            "snapshot_revision": 4,
            "object_counts": {"areas": 1},
            "unexpected_private_field": "must-not-leak",
        }
    )
    entry.runtime_data = coordinator

    result = await async_get_config_entry_diagnostics(hass, entry)

    assert result["config_entry"]["host"] != "private-host.local"
    assert result["config_entry"][CONF_TOKEN] != entry.data[CONF_TOKEN]
    assert result["config_entry"]["port"] == 8099
    assert "unexpected_private_field" not in result["bridge"]