import pytest

from apps.modelhub.crypto import (
    CredentialEncryptionError,
    decrypt_secret,
    encrypt_secret,
    mask_secret,
)


def test_encrypts_masks_and_decrypts_secret(settings):
    encrypted = encrypt_secret("sk-example-1234")

    assert encrypted != "sk-example-1234"
    assert decrypt_secret(encrypted) == "sk-example-1234"
    assert mask_secret(encrypted) == "****1234"


def test_missing_encryption_key_is_rejected(settings):
    settings.AI_CREDENTIAL_ENCRYPTION_KEY = ""

    with pytest.raises(CredentialEncryptionError):
        encrypt_secret("secret")