Functions
	_prod_on ()
	test_git_url_credentials_stripped ()
	test_github_pat_prefix_redacted_in_bare_text ()
	test_openai_and_slack_prefixes_redacted ()
	test_kv_password_scrubbed_without_configured_pattern ()
	test_kv_api_key_variants_all_redacted ()
	test_redact_secrets_toggle_bypasses_builtins ()
	test_dev_mode_still_skips_all_redaction ()

Variables
	_REPO_ROOT = Path(__file__).resolve().parents[1]

Detailed Description

Purpose
-------
OI-506 / FS-506 — regression coverage for the built-in secret/URL/token
scrubbers added to ``_apply_redaction``. These run unconditionally when
``REDACT_SECRETS`` is True (the default) inside production mode.

The three built-in regexes:

1. ``_GIT_URL_RE``       — strips ``user:token@`` from http(s) URLs.
2. ``_TOKEN_PREFIXES_RE`` — redacts common opaque-prefix tokens
   (GitHub PATs, Slack bot tokens, OpenAI keys, JWTs).
3. ``_KV_SECRET_RE``     — redacts ``secret=value`` / ``secret: value``
   style pairs for a fixed allowlist of key names.

The tests restore ``PROD_MODE`` and ``REDACT_SECRETS`` in ``finally`` so
they never leak state into neighbouring tests.

Diagnostics
-----------
Domain: TEST
Levels:
    L2 — test lifecycle

Contracts
---------
- Built-ins must scrub even when ``REDACTION_PATTERNS`` is empty.
- The ``REDACT_SECRETS=False`` toggle must bypass all three built-ins.
- Dev mode (``PROD_MODE=False``) must never redact.

Function Documentation

◆ _prod_on()

test_redaction._prod_on ( )

protected

Flip PROD_MODE on and return the restore callable.

Definition at line 49 of file test_redaction.py.

Here is the caller graph for this function:

◆ test_dev_mode_still_skips_all_redaction()

test_redaction.test_dev_mode_still_skips_all_redaction ( )

OI-506: PROD_MODE=False short-circuits the full redaction stack.

Definition at line 153 of file test_redaction.py.