tegwick
fc0f18aa5c
- warden/mask.py: fingerprint()/mask_value() — presence, length, 8-char sha256 prefix; never the value. - proxy.proxy_fetch_fingerprint + `warden access --fingerprint`: masked status view (presence/length/hash) that emits no value, so it bypasses the T02 stdout guard. Lets two parties compare sha256 prefixes to confirm a shared value without seeing it (e.g. rotation landed). - documented as defense-in-depth (raw bao bypasses it) in OperatorAccessAssist.md and the module docstring. - tests: tests/test_mask.py + CLI fingerprint test. 299 pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
33 lines
1.2 KiB
Python
33 lines
1.2 KiB
Python
"""Tests for the masking display filter (WARDEN-WP-0026 T03)."""
|
||
from warden.mask import fingerprint, mask_value
|
||
from warden.proxy import ResolvedFetch, proxy_fetch_fingerprint
|
||
|
||
|
||
def test_mask_never_contains_the_value():
|
||
secret = "ghp_realtokenvalue1234567890abcdef"
|
||
masked = mask_value(secret)
|
||
assert secret not in masked
|
||
assert "hidden" in masked and "len=" in masked and "sha256:" in masked
|
||
|
||
|
||
def test_fingerprint_reports_presence_and_length():
|
||
fp = fingerprint("abcd")
|
||
assert fp.present is True and fp.length == 4
|
||
assert len(fp.sha256_prefix) == 8
|
||
|
||
|
||
def test_absent_value_renders_absent():
|
||
assert mask_value("") == "‹absent›"
|
||
assert mask_value(None) == "‹absent›"
|
||
assert fingerprint(None).present is False
|
||
|
||
|
||
def test_fingerprint_is_stable_and_discriminating():
|
||
assert fingerprint("token-A").sha256_prefix == fingerprint("token-A").sha256_prefix
|
||
assert fingerprint("token-A").sha256_prefix != fingerprint("token-B").sha256_prefix
|
||
|
||
|
||
def test_proxy_fingerprint_returns_mask_not_value():
|
||
fp = proxy_fetch_fingerprint(ResolvedFetch(shell_cmd="printf 'the-secret-value'"))
|
||
assert fp.present and fp.length == len("the-secret-value")
|
||
assert "the-secret-value" not in fp.render()
|