#!/usr/bin/env python3
"""Independently re-implement the tool's pseudonymize_ip() to confirm:
  (a) tokens are deterministic within one salt, and
  (b) they diverge across the two salts the tool ships (demo vs file/stdin).

This does not import the tool; it recomputes the HMAC itself, so it is a
cross-check of the tool's output rather than a restatement of it.
"""
import hmac
import hashlib

DEMO_SALT = "interview-demo-salt-key"              # used by run_demo()
DEFAULT_SALT = "enterprise-siem-secret-salt-2026"  # used by file/stdin mode


def tok(salt, ip):
    return hmac.new(salt.encode(), ip.encode(), hashlib.sha256).hexdigest()[:8]


ips = ["185.220.101.5", "10.0.1.45", "10.0.2.200", "52.95.110.1", "8.8.8.8"]
print(f"{'IP':16} {'demo-salt':10} {'default-salt':12} same?")
for ip in ips:
    a, b = tok(DEMO_SALT, ip), tok(DEFAULT_SALT, ip)
    print(f"{ip:16} {a:10} {b:12} {'YES' if a == b else 'NO'}")

print("\ndeterminism (default salt, 185.220.101.5 x2):",
      tok(DEFAULT_SALT, "185.220.101.5"), tok(DEFAULT_SALT, "185.220.101.5"))