34 lines
1.2 KiB
Python
34 lines
1.2 KiB
Python
|
"""Tests for the masking display filter (WARDEN-WP-0026 T03)."""
|
|||
|
|
from warden.mask import fingerprint, mask_value
|
|||
|
|
from warden.proxy import ResolvedFetch, proxy_fetch_fingerprint
|
|||
|
|
|
|||
|
|
|
|||
|
|
def test_mask_never_contains_the_value():
|
|||
|
|
secret = "ghp_realtokenvalue1234567890abcdef"
|
|||
|
|
masked = mask_value(secret)
|
|||
|
|
assert secret not in masked
|
|||
|
|
assert "hidden" in masked and "len=" in masked and "sha256:" in masked
|
|||
|
|
|
|||
|
|
|
|||
|
|
def test_fingerprint_reports_presence_and_length():
|
|||
|
|
fp = fingerprint("abcd")
|
|||
|
|
assert fp.present is True and fp.length == 4
|
|||
|
|
assert len(fp.sha256_prefix) == 8
|
|||
|
|
|
|||
|
|
|
|||
|
|
def test_absent_value_renders_absent():
|
|||
|
|
assert mask_value("") == "‹absent›"
|
|||
|
|
assert mask_value(None) == "‹absent›"
|
|||
|
|
assert fingerprint(None).present is False
|
|||
|
|
|
|||
|
|
|
|||
|
|
def test_fingerprint_is_stable_and_discriminating():
|
|||
|
|
assert fingerprint("token-A").sha256_prefix == fingerprint("token-A").sha256_prefix
|
|||
|
|
assert fingerprint("token-A").sha256_prefix != fingerprint("token-B").sha256_prefix
|
|||
|
|
|
|||
|
|
|
|||
|
|
def test_proxy_fingerprint_returns_mask_not_value():
|
|||
|
|
fp = proxy_fetch_fingerprint(ResolvedFetch(shell_cmd="printf 'the-secret-value'"))
|
|||
|
|
assert fp.present and fp.length == len("the-secret-value")
|
|||
|
|
assert "the-secret-value" not in fp.render()
|