tegwick
c4504c6de9
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306
88 lines
2.9 KiB
Python
88 lines
2.9 KiB
Python
import json
|
|
import urllib.error
|
|
from types import SimpleNamespace
|
|
|
|
from secrets_engine.evidence import EvidenceWriter, _scrub
|
|
from secrets_engine.redact import looks_secret, redact_text
|
|
|
|
|
|
def test_redact_known_token_shapes():
|
|
assert "npm_" not in redact_text("token=npm_abcdEFGH12345678abcd")
|
|
assert "REDACTED" in redact_text("token=npm_abcdEFGH12345678abcd")
|
|
assert "ghp_" not in redact_text("ghp_0123456789abcdef0123")
|
|
|
|
|
|
def test_redact_extra_literal():
|
|
out = redact_text("the value is hunter2hunter2", extra=["hunter2hunter2"])
|
|
assert "hunter2" not in out
|
|
|
|
|
|
def test_looks_secret():
|
|
assert looks_secret("npm_token")
|
|
assert looks_secret("API_KEY")
|
|
assert not looks_secret("path")
|
|
|
|
|
|
def test_scrub_drops_secret_keys_and_redacts():
|
|
scrubbed = _scrub({"token": "npm_realvalue123456789", "path": "a/b", "note": "ghp_0123456789abcdef0123"})
|
|
assert scrubbed["token"].startswith("<omitted")
|
|
assert scrubbed["path"] == "a/b"
|
|
assert "ghp_" not in scrubbed["note"]
|
|
|
|
|
|
def test_evidence_record_has_no_value(tmp_path):
|
|
w = EvidenceWriter(evidence_dir=tmp_path, hub_url="") # hub disabled
|
|
rec = w.record(
|
|
"provision", result="from-file", catalog_id="lane", stage="prod",
|
|
detail={"field": "npm_token", "value": "npm_shouldnotappear123"},
|
|
)
|
|
blob = json.dumps(rec)
|
|
assert "npm_shouldnotappear123" not in blob
|
|
# written to disk too
|
|
files = list(tmp_path.glob("evidence-*.jsonl"))
|
|
assert files and "npm_shouldnotappear123" not in files[0].read_text()
|
|
|
|
|
|
def test_evidence_records_append_only_hub_delivery_success(tmp_path, monkeypatch):
|
|
monkeypatch.setattr(
|
|
"urllib.request.urlopen",
|
|
lambda *_args, **_kwargs: SimpleNamespace(read=lambda: b"{}"),
|
|
)
|
|
writer = EvidenceWriter(
|
|
evidence_dir=tmp_path,
|
|
hub_url="http://hub.invalid",
|
|
topic_id="topic-id",
|
|
)
|
|
|
|
primary = writer.record("verify", result="pass", catalog_id="lane")
|
|
|
|
lines = [
|
|
json.loads(line)
|
|
for line in next(tmp_path.glob("evidence-*.jsonl")).read_text().splitlines()
|
|
]
|
|
assert len(lines) == 2
|
|
assert lines[0] == primary
|
|
assert lines[1]["action"] == "evidence-delivery"
|
|
assert lines[1]["result"] == "delivered"
|
|
assert lines[1]["related_record_id"] == primary["record_id"]
|
|
|
|
|
|
def test_evidence_records_hub_failure_without_raising(tmp_path, monkeypatch):
|
|
def offline(*_args, **_kwargs):
|
|
raise urllib.error.URLError("offline")
|
|
|
|
monkeypatch.setattr("urllib.request.urlopen", offline)
|
|
writer = EvidenceWriter(
|
|
evidence_dir=tmp_path,
|
|
hub_url="http://hub.invalid",
|
|
topic_id="topic-id",
|
|
)
|
|
|
|
writer.record("verify", result="pass", catalog_id="lane")
|
|
|
|
lines = [
|
|
json.loads(line)
|
|
for line in next(tmp_path.glob("evidence-*.jsonl")).read_text().splitlines()
|
|
]
|
|
assert lines[-1]["action"] == "evidence-delivery"
|
|
assert lines[-1]["result"] == "failed"
|