import json,base64
from app.jwtcheck import inspect_jwt
def part(x):
    return base64.urlsafe_b64encode(json.dumps(x).encode()).decode().rstrip("=")
def test_safe_inspection():
    r=inspect_jwt(part({"alg":"none"})+"."+part({"sub":"secret"})+".x")
    assert r["signature_verified"] is False
    assert "secret" not in str(r)
    assert r["findings"]