first commit

app/tests/test_logging_setup.py

@@ -0,0 +1,23 @@
+from __future__ import annotations
+
+import logging
+
+from doctor_workstation.logging_setup import SecretRedactionFilter
+
+
+def test_redaction_filter_hides_credentials() -> None:
+    record = logging.LogRecord(
+        name="test",
+        level=logging.INFO,
+        pathname=__file__,
+        lineno=1,
+        msg="token: abc123 userSig='secret-value' password=hunter2",
+        args=(),
+        exc_info=None,
+    )
+    assert SecretRedactionFilter().filter(record)
+    rendered = record.getMessage()
+    assert "abc123" not in rendered
+    assert "secret-value" not in rendered
+    assert "hunter2" not in rendered
+    assert rendered.count("<redacted>") == 3