wehub-resource-sync
99 lines
3.0 KiB
Python
99 lines
3.0 KiB
Python
"""Tests for the dependency-free free-text redaction primitive."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from opensquilla.redaction import redact_error_text
|
|
|
|
|
|
def test_empty_text_stays_empty() -> None:
|
|
assert redact_error_text("") == ""
|
|
|
|
|
|
def test_plain_error_text_passes_through() -> None:
|
|
text = "connection refused while contacting host"
|
|
assert redact_error_text(text) == text
|
|
|
|
|
|
def test_bearer_token_is_masked() -> None:
|
|
out = redact_error_text("401 unauthorized: Bearer abc123def456 rejected")
|
|
assert "abc123def456" not in out
|
|
assert "Bearer ***" in out
|
|
assert "rejected" in out
|
|
|
|
|
|
def test_bearer_token_masked_case_insensitively() -> None:
|
|
out = redact_error_text("header was BEARER XYZTOKEN123")
|
|
assert "XYZTOKEN123" not in out
|
|
|
|
|
|
def test_sk_style_key_is_masked() -> None:
|
|
out = redact_error_text("invalid api key sk-test-000 provided")
|
|
assert "sk-test-000" not in out
|
|
assert "provided" in out
|
|
|
|
|
|
def test_api_key_query_value_is_masked() -> None:
|
|
out = redact_error_text("GET https://api.example.test/v1?api_key=tok0123456&scope=chat failed")
|
|
assert "tok0123456" not in out
|
|
assert "scope=chat" in out
|
|
|
|
|
|
def test_token_and_key_body_values_are_masked() -> None:
|
|
out = redact_error_text('payload had token: tok-abc-1 and "key=val0987"')
|
|
assert "tok-abc-1" not in out
|
|
assert "val0987" not in out
|
|
|
|
|
|
def test_token_prose_plural_is_not_masked() -> None:
|
|
text = "too many tokens: 4096 requested"
|
|
assert redact_error_text(text) == text
|
|
|
|
|
|
def test_url_userinfo_is_masked() -> None:
|
|
out = redact_error_text("proxy http://alice:hunter0@proxy.local:8080 unreachable")
|
|
assert "alice" not in out
|
|
assert "hunter0" not in out
|
|
assert "***@proxy.local:8080" in out
|
|
|
|
|
|
def test_long_unbroken_base64_run_is_masked() -> None:
|
|
secret = "QUJDREVGR0hJSktMTU5PUFFSU1RVVg=="
|
|
out = redact_error_text(f"upstream echoed {secret} in the body")
|
|
assert secret not in out
|
|
assert "upstream echoed" in out
|
|
|
|
|
|
def test_long_hex_run_is_masked() -> None:
|
|
out = redact_error_text("trace 0badc0ffee0badc0ffee0badc0ffee end")
|
|
assert "0badc0ffee0badc0ffee0badc0ffee" not in out
|
|
assert "end" in out
|
|
|
|
|
|
def test_short_runs_are_not_masked() -> None:
|
|
text = "request id abc123 failed after 30s"
|
|
assert redact_error_text(text) == text
|
|
|
|
|
|
def test_truncates_to_max_len() -> None:
|
|
out = redact_error_text("x " * 400)
|
|
assert len(out) <= 200
|
|
assert out.endswith("…")
|
|
|
|
|
|
def test_custom_max_len_is_honored() -> None:
|
|
out = redact_error_text("connection reset by peer during handshake", max_len=16)
|
|
assert len(out) <= 16
|
|
assert out.endswith("…")
|
|
|
|
|
|
def test_secret_beyond_truncation_window_never_survives() -> None:
|
|
text = ("padding " * 30) + "sk-test-000-aaaaaaaaaaaaaaaaaaaaaa"
|
|
out = redact_error_text(text, max_len=250)
|
|
assert "sk-test-000" not in out
|
|
|
|
|
|
def test_onboarding_module_reexports_the_primitive() -> None:
|
|
from opensquilla.onboarding import redaction as onboarding_redaction
|
|
|
|
assert onboarding_redaction.redact_error_text is redact_error_text
|