"""IT-CRED-001 — preset list never returns encrypted password."""

from __future__ import annotations

import pytest

from server.api.settings import list_presets
from server.domain.models import PasswordPreset
from server.infrastructure.database.crypto import encrypt_value

pytestmark = pytest.mark.integration


@pytest.mark.asyncio
async def test_list_presets_masks_encrypted_pw(db_session, test_admin):
    preset = PasswordPreset(
        name="e2e-preset",
        username="root",
        encrypted_pw=encrypt_value("secret-pass"),
    )
    db_session.add(preset)
    await db_session.commit()

    rows = await list_presets(test_admin["admin"], db_session)

    assert len(rows) >= 1
    for row in rows:
        assert "encrypted_pw" not in row
        assert "password" not in row
