test_redaction.py

Go to the documentation of this file.

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# tests/test_redaction.py
 
"""
Purpose
-------
OI-506 / FS-506 — regression coverage for the built-in secret/URL/token
scrubbers added to ``_apply_redaction``. These run unconditionally when
``REDACT_SECRETS`` is True (the default) inside production mode.
 
The three built-in regexes:
 
1. ``_GIT_URL_RE``       — strips ``user:token@`` from http(s) URLs.
2. ``_TOKEN_PREFIXES_RE`` — redacts common opaque-prefix tokens
   (GitHub PATs, Slack bot tokens, OpenAI keys, JWTs).
3. ``_KV_SECRET_RE``     — redacts ``secret=value`` / ``secret: value``
   style pairs for a fixed allowlist of key names.
 
The tests restore ``PROD_MODE`` and ``REDACT_SECRETS`` in ``finally`` so
they never leak state into neighbouring tests.
 
Diagnostics
-----------
Domain: TEST
Levels:
    L2 — test lifecycle
 
Contracts
---------
- Built-ins must scrub even when ``REDACTION_PATTERNS`` is empty.
- The ``REDACT_SECRETS=False`` toggle must bypass all three built-ins.
- Dev mode (``PROD_MODE=False``) must never redact.
"""
 
from __future__ import annotations
 
import os
import sys
from pathlib import Path
 
_REPO_ROOT = Path(__file__).resolve().parents[1]
if str(_REPO_ROOT) not in sys.path:
    sys.path.insert(0, str(_REPO_ROOT))
 
from oc_diagnostics import unified_debug as _ud  # noqa: E402
 
 
def _prod_on():
    """Flip PROD_MODE on and return the restore callable."""
    old_prod = _ud.PROD_MODE
    old_toggle = _ud.REDACT_SECRETS
    _ud.PROD_MODE = True
    _ud.REDACT_SECRETS = True
 
    def _restore():
        _ud.PROD_MODE = old_prod
        _ud.REDACT_SECRETS = old_toggle
 
    return _restore
 
 
def test_git_url_credentials_stripped():
    """OI-506: ``https://user:token@host/path`` → ``https://***@host/path``."""
    restore = _prod_on()
    try:
        out = _ud._apply_redaction(
            "cloning https://alice:ghp_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@github.com/org/repo.git"
        )
        assert "alice" not in out
        assert "ghp_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" not in out
        assert "https://***@github.com/org/repo.git" in out
    finally:
        restore()
 
 
def test_github_pat_prefix_redacted_in_bare_text():
    """OI-506: ``ghp_…`` tokens outside URL context are still redacted."""
    restore = _prod_on()
    try:
        out = _ud._apply_redaction(
            "exported GH_TOKEN=ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
        )
        assert "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789" not in out
        assert "ghp_[REDACTED]" in out or "[REDACTED]" in out
    finally:
        restore()
 
 
def test_openai_and_slack_prefixes_redacted():
    """OI-506: ``sk-…`` and ``xoxb-…`` tokens match the prefix regex."""
    restore = _prod_on()
    try:
        out = _ud._apply_redaction(
            "OPENAI=sk-abcdefghijklmnopqrstuvwxyz0123 SLACK=xoxb-1234567890-AbCdEfGhIj"
        )
        assert "sk-abcdefghijklmnopqrstuvwxyz0123" not in out
        assert "xoxb-1234567890-AbCdEfGhIj" not in out
    finally:
        restore()
 
 
def test_kv_password_scrubbed_without_configured_pattern():
    """OI-506: ``password=…`` is redacted even with no REDACTION_PATTERNS."""
    old_patterns = _ud.REDACTION_PATTERNS
    _ud.REDACTION_PATTERNS = []
    restore = _prod_on()
    try:
        out = _ud._apply_redaction("logging in with password=hunter2")
        assert "hunter2" not in out
        assert "password=[REDACTED]" in out
    finally:
        restore()
        _ud.REDACTION_PATTERNS = old_patterns
 
 
def test_kv_api_key_variants_all_redacted():
    """OI-506: ``api_key``, ``api-key``, and ``apikey`` all match the KV regex."""
    old_patterns = _ud.REDACTION_PATTERNS
    _ud.REDACTION_PATTERNS = []
    restore = _prod_on()
    try:
        for key in ("api_key", "api-key", "apikey"):
            out = _ud._apply_redaction(f"config {key}=supersecret123")
            assert "supersecret123" not in out, (key, out)
            assert "[REDACTED]" in out, (key, out)
    finally:
        restore()
        _ud.REDACTION_PATTERNS = old_patterns
 
 
def test_redact_secrets_toggle_bypasses_builtins():
    """OI-506: with REDACT_SECRETS=False the three built-ins are inert."""
    old_patterns = _ud.REDACTION_PATTERNS
    old_prod = _ud.PROD_MODE
    old_toggle = _ud.REDACT_SECRETS
    _ud.PROD_MODE = True
    _ud.REDACT_SECRETS = False
    _ud.REDACTION_PATTERNS = []
    try:
        text = (
            "https://alice:ghp_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@host/ "
            "password=hunter2"
        )
        out = _ud._apply_redaction(text)
        assert out == text
    finally:
        _ud.PROD_MODE = old_prod
        _ud.REDACT_SECRETS = old_toggle
        _ud.REDACTION_PATTERNS = old_patterns
 
 
def test_dev_mode_still_skips_all_redaction():
    """OI-506: PROD_MODE=False short-circuits the full redaction stack."""
    old_prod = _ud.PROD_MODE
    _ud.PROD_MODE = False
    try:
        text = "password=hunter2 https://u:t@h/"
        assert _ud._apply_redaction(text) == text
    finally:
        _ud.PROD_MODE = old_prod