from __future__ import annotations

import subprocess
import sys


def test_leakage_scan_rejects_canary_and_accepts_clean_file(tmp_path) -> None:
    path = tmp_path / "output.txt"
    path.write_text("safe output", encoding="utf-8")
    clean = subprocess.run(
        [sys.executable, "tools/leakage_scan.py", "--canary", "secret-canary", str(path)],
        capture_output=True,
        text=True,
        check=False,
    )
    assert clean.returncode == 0

    path.write_text("oops secret-canary escaped", encoding="utf-8")
    leaked = subprocess.run(
        [sys.executable, "tools/leakage_scan.py", "--canary", "secret-canary", str(path)],
        capture_output=True,
        text=True,
        check=False,
    )
    assert leaked.returncode == 1
    assert "output.txt" in leaked.stdout