"""Synthetic-only redaction counterexamples. No inputs, environment reads or network.
Run: python3 mcp-log-sharing-lab.py
This is NOT a sanitizer for real logs.
"""
import base64
import json
import platform
from urllib.parse import quote, unquote

secret = 'DEMO_ONLY_a+b/c=42'
encoded = quote(secret, safe='')
b64 = base64.b64encode(secret.encode()).decode()
escaped = ''.join('\\u%04x' % ord(c) for c in secret)
fixtures = {
    'json_literal': json.dumps({'error': {'token': secret}}),
    'authorization': 'Authorization: Bearer ' + secret,
    'url_encoded': 'https://example.invalid/mcp?access_token=' + encoded,
    'json_unicode': '{"token":"' + escaped + '"}',
    'base64_text': b64,
    'split_value': secret[:9] + '\n' + secret[9:],
    'unknown_secret': 'Cookie: session=DEMO_OTHER_NOT_IN_REPLACEMENT_LIST',
}
results = {}
for name, value in fixtures.items():
    after = value.replace(secret, '[REMOVED]')
    results[name] = {'changed': after != value, 'output': after}
assert results['json_literal']['changed'] and results['authorization']['changed']
assert unquote(results['url_encoded']['output'].split('=', 1)[1]) == secret
assert json.loads(results['json_unicode']['output'])['token'] == secret
assert base64.b64decode(results['base64_text']['output']).decode() == secret
assert results['split_value']['output'].replace('\n', '') == secret
assert 'DEMO_OTHER' in results['unknown_secret']['output']
# A field-name denylist does not cover free text, different keys or nested objects.
record = {'token': secret, 'message': 'request failed: ' + secret,
          'nested': {'Authorization': 'Bearer ' + secret}}
filtered = {k: '[REMOVED]' if k == 'token' else v for k, v in record.items()}
assert secret in filtered['message'] and secret in filtered['nested']['Authorization']
# Build a new example from fixed, reviewed facts. Do NOT copy arbitrary source fields.
packet = {
    'example': 'synthetic, not an observed MCP incident',
    'client_version': 'demo-client 1.0.0', 'server_version': 'demo-server 0.1.0',
    'runtime': 'record your actual runtime version here', 'transport': 'stdio',
    'launch_shape': 'node ./demo-server.mjs (dummy fixture; not supplied)',
    'required_env': {'DEMO_SERVICE_TOKEN': 'present; value omitted'},
    'failure_stage': 'tools/call', 'error_code': -32602,
    'location': 'server.mjs:42:7 (synthetic)',
    'expected': 'reject invalid argument without logging credentials',
    'actual': 'synthetic validation error',
}
serialized = json.dumps(packet)
assert all(x not in serialized for x in (secret, encoded, b64, escaped, 'DEMO_OTHER'))
assert packet['error_code'] == -32602 and packet['failure_stage'] == 'tools/call'
assert packet['location'] and packet['client_version'] and packet['launch_shape']
print(json.dumps({'python': platform.python_version(), 'checks': 10, 'passed': True,
    'literal_replacement': results, 'top_level_filter_failed': True,
    'reviewed_packet': packet, 'limits': 'Synthetic strings only; no MCP client/server or real log sanitizer tested.'}, indent=2))