from __future__ import annotations

import pytest

from drift_quant.secrets import SecretConfigurationError, load_required_secret


def test_secret_value_is_redacted_when_rendered() -> None:
    secret = load_required_secret("TEST_SECRET", {"TEST_SECRET": "not-for-logs"})

    assert str(secret) == "[REDACTED]"
    assert "not-for-logs" not in repr(secret)


def test_missing_secret_does_not_echo_value() -> None:
    with pytest.raises(SecretConfigurationError, match="TEST_SECRET"):
        load_required_secret("TEST_SECRET", {})