"""合成哨兵回归：检测最终格式化日志，不使用真实凭据。"""
import io
import json
import logging

SENTINEL = 'DEMO_SECRET_ONLY_FOR_TEST_7'


class DemoFormatter(logging.Formatter):
    def format(self, record):
        # 演示只遮蔽固定哨兵，不能作为生产通用脱敏器。
        return super().format(record).replace(SENTINEL, '[REDACTED]')


def leaks(text):
    return SENTINEL in text


def main():
    assert leaks('未处理的凭据=' + SENTINEL), '负向控制失败'
    output = io.StringIO()
    handler = logging.StreamHandler(output)
    handler.setFormatter(DemoFormatter('%(levelname)s %(message)s'))
    logger = logging.getLogger('synthetic-redaction')
    logger.handlers = [handler]
    logger.propagate = False
    logger.setLevel(logging.DEBUG)
    logger.info('Authorization: Bearer %s; AUTHORIZATION: %s', SENTINEL, SENTINEL)
    logger.debug(json.dumps({'nested': {'api_key': SENTINEL}, 'status': 500}))
    try:
        raise ValueError('任务demo-007失败，secret=' + SENTINEL)
    except ValueError:
        logger.exception('堆栈测试 status=500')
    handler.flush()
    result = output.getvalue()
    assert result and not leaks(result)
    assert '500' in result and 'demo-007' in result
    assert 'Traceback' in result and '[REDACTED]' in result
    print('三个日志入口与负向控制通过；生产应用需替换示例Formatter再验证。')


if __name__ == '__main__':
    main()