fix: keep control-path credentials out of registry logs

    settings: ControlPathSettings,

    factory: TransformationFunctionAdapterFactory | None,

) -> ConfiguredControlPathRegistry:

    logger.info("building_cpr", entries=settings.entries)

    logger.info("building_cpr", entry_count=len(settings.entries))

    if not settings.entries:

        return ConfiguredControlPathRegistry({})

    if factory is None:

"""Registry diagnostics must not expose runtime control-path configuration."""

from unittest.mock import Mock

from structlog.testing import capture_logs

from srm.adapters.transformation_functions.registry import build_control_path_registry

from srm.config import ControlPathEntry, ControlPathSettings

from srm.domain.ports.transformation_functions import TransformationFunctionAdapterFactory

def test_registry_logging_keeps_credentials_out_of_events() -> None:

    credential = "test-only-registry-credential"

    settings = ControlPathSettings(

        entries=[

            ControlPathEntry(

                control_path_ref="network-test",

                adapter="network",

                config={"credentials": {"password": credential}},

            )

        ]

    )

    factory = Mock(spec=TransformationFunctionAdapterFactory)

    with capture_logs() as events:

        registry = build_control_path_registry(settings, factory)

    assert registry.control_path_refs() == ["network-test"]

    factory.create_adapter.assert_called_once_with(

        "network", {"credentials": {"password": credential}, "control_path_ref": "network-test"}

    )

    assert credential not in repr(events)

    assert events == [{"event": "building_cpr", "entry_count": 1, "log_level": "info"}]