"""EX-B2-10: capture the leak before introducing a public output contract."""

from fastapi import FastAPI

app = FastAPI(title="Output filtering incident")

INTERNAL_RECORD = {
    "id": "EXP-204",
    "subject": "Synthetic internal request",
    "state": "in_review",
    "owner_email": "owner@example.invalid",
    "audit_token": "synthetic-secret-do-not-return",
}


@app.get("/expedientes/{record_id}")
def read_record(record_id: str) -> dict[str, str]:
    return {**INTERNAL_RECORD, "id": record_id}


# Regression questions:
# - Which exact keys are public?
# - Does OpenAPI describe that allowlist?
# - Do the internal keys disappear from both body and public schema?