test_no_hardcoded_secrets.py

Go to the documentation of this file.

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# tests/tests_linter/test_no_hardcoded_secrets.py
 
"""
Purpose
-------
Validate the linter's ``no_hardcoded_secrets`` rule (§6b Secret Hygiene).
 
Responsibilities
----------------
- Confirm that hardcoded secrets in direct assignments are caught (Pattern A).
- Confirm that hardcoded secrets in annotated assignments are caught (Pattern A).
- Confirm that hardcoded secrets in dict literals are caught (Pattern B).
- Confirm that hardcoded secrets in function defaults are caught (Pattern C).
- Confirm that safe patterns (os.getenv, os.environ, function calls,
  subscripts) pass without violations.
- Confirm that non-secret variable names with string literals pass.
- Confirm profile behaviour (strict/compact: blocking; proto: not checked).
 
Diagnostics
-----------
Domain: LINTER-TESTS
L2: test lifecycle
L3: assertion details
L4: deep tracing
 
Contracts
---------
Inputs:  inline source strings
Outputs: pass/fail assertions
"""
 
from oct.linter import oct_lint
 
 
# =====================================================================
# Pattern A — Direct assignments
# =====================================================================
 
def test_direct_assignment_violation():
    """String literal assigned to a secret-like variable name is caught."""
    source = 'password = "hunter2"\n'
    ok, msg = oct_lint.check_no_hardcoded_secrets(source)
    assert not ok
    assert "password" in msg
    assert "string literal" in msg
 
 
def test_direct_assignment_multiple_violations():
    """Multiple secret assignments produce multiple violation messages."""
    source = (
        'API_KEY = "sk-abc123"\n'
        'token = "tok-xyz"\n'
    )
    ok, msg = oct_lint.check_no_hardcoded_secrets(source)
    assert not ok
    assert "API_KEY" in msg or "api_key" in msg.lower()
    assert "token" in msg
 
 
def test_annotated_assignment_violation():
    """Annotated assignment (name: str = "literal") is caught."""
    source = 'password: str = "hunter2"\n'
    ok, msg = oct_lint.check_no_hardcoded_secrets(source)
    assert not ok
    assert "password" in msg
 
 
def test_class_attribute_violation():
    """Class-level secret attribute is caught (AST walker visits class bodies)."""
    source = (
        'class Config:\n'
        '    API_KEY = "sk-abc"\n'
    )
    ok, msg = oct_lint.check_no_hardcoded_secrets(source)
    assert not ok
    assert "API_KEY" in msg or "api_key" in msg.lower()
 
 
# =====================================================================
# Pattern B — Dict literals
# =====================================================================
 
def test_dict_literal_violation():
    """Dict with secret-like key mapped to a string literal is caught."""
    source = 'config = {"password": "secret"}\n'
    ok, msg = oct_lint.check_no_hardcoded_secrets(source)
    assert not ok
    assert "password" in msg
 
 
def test_dict_multiple_secret_keys():
    """Dict with multiple secret keys produces multiple violations."""
    source = 'settings = {"api_key": "sk-123", "db_url": "postgres://x"}\n'
    ok, msg = oct_lint.check_no_hardcoded_secrets(source)
    assert not ok
    assert "api_key" in msg
    assert "db_url" in msg
 
 
def test_dict_non_secret_key_passes():
    """Dict with non-secret key and string value passes."""
    source = 'config = {"max_retries": "3"}\n'
    ok, msg = oct_lint.check_no_hardcoded_secrets(source)
    assert ok
 
 
def test_dict_secret_key_call_value_passes():
    """Dict with secret key mapped to a function call passes."""
    source = (
        'import os\n'
        'config = {"password": os.getenv("DB_PASS")}\n'
    )
    ok, msg = oct_lint.check_no_hardcoded_secrets(source)
    assert ok
 
 
# =====================================================================
# Pattern C — Function default arguments
# =====================================================================
 
def test_function_default_violation():
    """Function with secret-like parameter defaulting to string literal is caught."""
    source = 'def connect(password="default"):\n    pass\n'
    ok, msg = oct_lint.check_no_hardcoded_secrets(source)
    assert not ok
    assert "password" in msg
 
 
def test_kwonly_default_violation():
    """Keyword-only parameter with secret default is caught."""
    source = 'def connect(*, token="default"):\n    pass\n'
    ok, msg = oct_lint.check_no_hardcoded_secrets(source)
    assert not ok
    assert "token" in msg
 
 
def test_function_default_non_secret_passes():
    """Function with non-secret parameter defaulting to string passes."""
    source = 'def connect(host="localhost"):\n    pass\n'
    ok, msg = oct_lint.check_no_hardcoded_secrets(source)
    assert ok
 
 
# =====================================================================
# Safe patterns — should all pass
# =====================================================================
 
def test_os_getenv_passes():
    """os.getenv() is a function call, not a literal — passes."""
    source = (
        'import os\n'
        'password = os.getenv("PASSWORD")\n'
    )
    ok, msg = oct_lint.check_no_hardcoded_secrets(source)
    assert ok
 
 
def test_os_environ_subscript_passes():
    """os.environ["KEY"] is a subscript, not a literal — passes."""
    source = (
        'import os\n'
        'API_KEY = os.environ["API_KEY"]\n'
    )
    ok, msg = oct_lint.check_no_hardcoded_secrets(source)
    assert ok
 
 
def test_function_call_passes():
    """Assigning a function call result to a secret name passes."""
    source = 'password = get_password()\n'
    ok, msg = oct_lint.check_no_hardcoded_secrets(source)
    assert ok
 
 
def test_subscript_on_non_environ_passes():
    """Subscript on a non-environ object passes (known limitation)."""
    source = (
        'config = load_config("settings.json")\n'
        'API_KEY = config["api_key"]\n'
    )
    ok, msg = oct_lint.check_no_hardcoded_secrets(source)
    assert ok
 
 
def test_non_secret_name_with_string_passes():
    """Variable with non-secret name assigned string literal passes."""
    source = 'max_retries = "3"\n'
    ok, msg = oct_lint.check_no_hardcoded_secrets(source)
    assert ok
 
 
def test_fstring_caught():
    """f-string assigned to secret-named variable is flagged (OI-408)."""
    source = 'password = f"prefix-{var}"\n'
    ok, msg = oct_lint.check_no_hardcoded_secrets(source)
    assert not ok
    assert "f-string" in msg
 
 
def test_concatenation_caught():
    """String concatenation assigned to secret-named variable is flagged (OI-408)."""
    source = 'api_key = "sk-" + "abc123"\n'
    ok, msg = oct_lint.check_no_hardcoded_secrets(source)
    assert not ok
    assert "concatenation" in msg
 
 
def test_concat_with_variable_caught():
    """Concatenation where one side is a literal is flagged (OI-408)."""
    source = 'token = prefix + "static_suffix"\n'
    ok, msg = oct_lint.check_no_hardcoded_secrets(source)
    assert not ok
    assert "concatenation" in msg
 
 
def test_fstring_non_secret_name_passes():
    """f-string assigned to a non-secret variable name is fine (OI-408)."""
    source = 'greeting = f"Hello {name}"\n'
    ok, msg = oct_lint.check_no_hardcoded_secrets(source)
    assert ok
 
 
def test_empty_file_passes():
    """Empty file passes."""
    ok, msg = oct_lint.check_no_hardcoded_secrets("")
    assert ok
 
 
def test_syntax_error_passes():
    """Unparseable source passes (same behaviour as other AST-based checks)."""
    ok, msg = oct_lint.check_no_hardcoded_secrets("def (\n")
    assert ok
 
 
# =====================================================================
# Comprehensive coverage of all secret name patterns
# =====================================================================
 
def test_all_secret_patterns_caught():
    """Every name in _SECRET_NAME_PATTERNS is caught when assigned a literal."""
    for name in oct_lint._SECRET_NAME_PATTERNS:
        source = f'{name} = "test_value"\n'
        ok, msg = oct_lint.check_no_hardcoded_secrets(source)
        assert not ok, f"Expected violation for '{name}' but check passed"
 
 
def test_case_insensitive_matching():
    """Secret name matching is case-insensitive."""
    source = 'PASSWORD = "hunter2"\n'
    ok, msg = oct_lint.check_no_hardcoded_secrets(source)
    assert not ok
    assert "PASSWORD" in msg
 
 
# =====================================================================
# OI-402 — Compound / substring name matching
# =====================================================================
 
def test_compound_name_violation():
    """Compound variable names containing secret patterns are caught (OI-402)."""
    source = 'db_password = "hunter2"\n'
    ok, msg = oct_lint.check_no_hardcoded_secrets(source)
    assert not ok
    assert "db_password" in msg
 
 
def test_prefixed_api_key_violation():
    """Prefixed secret name like stripe_api_key is caught (OI-402)."""
    source = 'stripe_api_key = "sk_live_abc123"\n'
    ok, msg = oct_lint.check_no_hardcoded_secrets(source)
    assert not ok
 
 
def test_suffixed_token_violation():
    """Suffixed secret name like refresh_token_value is caught (OI-402)."""
    source = 'refresh_token_value = "tok-xyz"\n'
    ok, msg = oct_lint.check_no_hardcoded_secrets(source)
    assert not ok
 
 
def test_non_secret_compound_passes():
    """Compound name that does not contain a secret pattern passes."""
    source = 'max_retry_count = "3"\n'
    ok, msg = oct_lint.check_no_hardcoded_secrets(source)
    assert ok
 
 
# =====================================================================
# OI-404 — Waiver reason enforcement
# =====================================================================
 
def test_waiver_without_reason_parsed_correctly():
    """parse_inline_waivers sets reason=None when no reason is given (OI-404)."""
    source = '# OCT-LINT: disable=no_hardcoded_secrets\npassword = "hunter2"\n'
    waivers = oct_lint.parse_inline_waivers(source)
    assert len(waivers) == 1
    w = list(waivers.values())[0]
    assert w["reason"] is None
 
 
def test_waiver_with_reason_parsed_correctly():
    """parse_inline_waivers captures reason when provided (OI-404)."""
    source = '# OCT-LINT: disable=no_hardcoded_secrets reason="test fixture"\n'
    waivers = oct_lint.parse_inline_waivers(source)
    w = list(waivers.values())[0]
    assert w["reason"] is not None
    assert "test fixture" in w["reason"]
 
 
def test_waiver_filtering_excludes_reasonless():
    """The waived_rules set only includes waivers with a reason (OI-404)."""
    source = (
        '# OCT-LINT: disable=rule_a\n'
        '# OCT-LINT: disable=rule_b reason="justified"\n'
    )
    waivers = oct_lint.parse_inline_waivers(source)
    waived_rules = {w["rule"] for w in waivers.values() if w["reason"] is not None}
    assert "rule_a" not in waived_rules, "reason-less waiver should not suppress check"
    assert "rule_b" in waived_rules, "waiver with reason should suppress check"