from __future__ import annotations

import json
from pathlib import Path

from ops.private_receipt_io import print_private_receipt_summary, write_private_json


def test_stdout_summary_never_replays_private_receipt_payload(tmp_path: Path, capsys) -> None:
    output = tmp_path / "private" / "receipt.json"
    payload = {
        "artifact": "private_test_receipt",
        "status": "pass",
        "private_claim_body": "must-not-appear-on-stdout",
        "database_password": "must-not-appear-on-stdout-either",
    }

    write_private_json(output, payload)
    print_private_receipt_summary(output, payload)

    stdout = capsys.readouterr().out
    summary = json.loads(stdout)
    assert "must-not-appear" not in stdout
    assert summary["artifact"] == "private_test_receipt"
    assert summary["status"] == "pass"
    assert summary["output_name"] == output.name
    assert str(output.parent) not in stdout
    assert len(summary["output_sha256"]) == 64
    assert output.stat().st_mode & 0o777 == 0o600