aeat.adapters.inbound.sanitizer.fixtures module

Known-sanitised fixture SHAs for refuse-if-already-sanitised guard.

When sanitize_pdf() is called with bytes whose SHA-256 lives in SANITIZED_SHAS, the sanitiser refuses with AlreadySanitizedError. The set is populated with every fixture committed under src/aeat/tests/fixtures/justificantes/ so an operator who points the sanitiser at a previously-sanitised fixture gets a hard error rather than a silent no-op or double-stripped output.

The set contains only SHA-256 digests of already-sanitised fixture bytes. It does not store cleartext source hashes or token-map contents.

Callers can opt out per-call with sanitize_pdf(..., refuse_if_already_sanitized=False) for the narrow case where intentionally re-sanitising a fixture is the correct action (e.g. when extending the TokenMap to cover a new PII surface against an existing capture).