tegwick
a852d3f1ff
Implements SECRETS-WP-0002 end to end as a uv-managed Python package: - catalog: non-secret lane registry + strict validator (build/test/prod) - stage roles + OpenBao ACL policies; guards refuse wildcards, sys/, identity/, admin names, and cross-stage paths before any backend call - plan/apply: dry-run-first, idempotent policy + approle apply, decision-gated - decisions: State Hub lookup with local-fixture fallback; non-secret evidence to JSONL + hub progress, scrubbed of any value - provision/verify: mode-0600 file import + generated test values; positive/ negative checks that never print the value - exec delivery: `exec --catalog ... -- npm publish` injects the token via a temp .npmrc for the child only, cleaned up on exit/failure/interrupt - ops-warden routing contract + hardening backlog docs - 34 tests incl. live OpenBao integration; scripts/demo-e2e.sh runs the full chain against a throwaway bao dev server Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
41 lines
1.4 KiB
Python
41 lines
1.4 KiB
Python
import json
|
|
|
|
from secrets_engine.evidence import EvidenceWriter, _scrub
|
|
from secrets_engine.redact import looks_secret, redact_text
|
|
|
|
|
|
def test_redact_known_token_shapes():
|
|
assert "npm_" not in redact_text("token=npm_abcdEFGH12345678abcd")
|
|
assert "REDACTED" in redact_text("token=npm_abcdEFGH12345678abcd")
|
|
assert "ghp_" not in redact_text("ghp_0123456789abcdef0123")
|
|
|
|
|
|
def test_redact_extra_literal():
|
|
out = redact_text("the value is hunter2hunter2", extra=["hunter2hunter2"])
|
|
assert "hunter2" not in out
|
|
|
|
|
|
def test_looks_secret():
|
|
assert looks_secret("npm_token")
|
|
assert looks_secret("API_KEY")
|
|
assert not looks_secret("path")
|
|
|
|
|
|
def test_scrub_drops_secret_keys_and_redacts():
|
|
scrubbed = _scrub({"token": "npm_realvalue123456789", "path": "a/b", "note": "ghp_0123456789abcdef0123"})
|
|
assert scrubbed["token"].startswith("<omitted")
|
|
assert scrubbed["path"] == "a/b"
|
|
assert "ghp_" not in scrubbed["note"]
|
|
|
|
|
|
def test_evidence_record_has_no_value(tmp_path):
|
|
w = EvidenceWriter(evidence_dir=tmp_path, hub_url="") # hub disabled
|
|
rec = w.record(
|
|
"provision", result="from-file", catalog_id="lane", stage="prod",
|
|
detail={"field": "npm_token", "value": "npm_shouldnotappear123"},
|
|
)
|
|
blob = json.dumps(rec)
|
|
assert "npm_shouldnotappear123" not in blob
|
|
# written to disk too
|
|
files = list(tmp_path.glob("evidence-*.jsonl"))
|
|
assert files and "npm_shouldnotappear123" not in files[0].read_text()
|