"""TS-13 — _safe_url redacts every query value + userinfo secret (Hypothesis)."""

from __future__ import annotations

from hypothesis import given, settings
from tests.unit._strategies import secrets

from mgf.http._client import _safe_url


@given(secret=secrets)
@settings(max_examples=150)
def test_query_value_secret_is_masked(secret: str) -> None:
    out = _safe_url(f"https://api.example.com/path?api_key={secret}&q=ok")
    assert secret not in out  # value masked
    assert "api_key" in out  # key kept (shape debuggable)


@given(secret=secrets)
@settings(max_examples=150)
def test_userinfo_secret_is_dropped(secret: str) -> None:
    out = _safe_url(f"https://user:{secret}@api.example.com/path")
    assert secret not in out
    assert "api.example.com" in out  # host preserved
