test_secret_scanner_standalone.py

Go to the documentation of this file.

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# tests/tests_tools/test_secret_scanner_standalone.py
 
"""
Purpose
-------
OI-514 regression coverage — :func:`check_no_hardcoded_secrets` and the
name-pattern helpers live in :mod:`oct.tools.secret_scanner`; the linter
re-exports them purely for back-compat. The scanner must be reachable
*without* importing :mod:`oct.linter.oct_lint`.
 
Responsibilities
----------------
- Verify ``oct.tools.secret_scanner`` is importable without loading the
  linter.
- Verify the linter re-export is the same object (identity check).
- Verify the scanner flags secret-shaped name patterns in AST snippets.
 
Diagnostics
-----------
Domain: TOOLS-TESTS
Levels:
    L2 — test lifecycle
    L3 — assertion details
    L4 — deep tracing
 
Contracts
---------
- ``oct.tools.secret_scanner.check_no_hardcoded_secrets`` is the canonical
  symbol; :mod:`oct.linter.oct_lint.check_no_hardcoded_secrets` is the
  same object (identity, not just equality).
- The scanner flags direct assignments, dict keys, and default args that
  bind secret-shaped names to string literals.
- The scanner does not import the linter (no circular dependency).
"""
 
from __future__ import annotations
 
import importlib
import sys
 
 
def test_scanner_importable_without_linter():
    """OI-514: the scanner module resolves without importing the linter."""
    # The linter re-exports these symbols for back-compat, but the scanner
    # itself must not depend on the linter being loaded. Popping only the
    # scanner (not the linter) would orphan the linter's cached re-export
    # and break identity checks in ``test_linter_reexport_is_same_object``,
    # so we accept the already-loaded scanner here — the behaviour we care
    # about is simply that ``import_module`` succeeds.
    scanner = importlib.import_module("oct.tools.secret_scanner")
    assert hasattr(scanner, "check_no_hardcoded_secrets")
    assert hasattr(scanner, "_name_matches_secret")
    assert hasattr(scanner, "_SECRET_NAME_PATTERNS")
    # Independence: the scanner module must not pull the linter in.
    # (It's fine if the linter is already loaded for unrelated reasons;
    # the guarantee is that the scanner doesn't cause it.)
    assert "oct.tools.secret_scanner" in sys.modules
 
 
def test_linter_reexport_is_same_object():
    """OI-514: linter re-export preserves object identity."""
    from oct.linter import oct_lint
    from oct.tools import secret_scanner
    assert oct_lint.check_no_hardcoded_secrets is secret_scanner.check_no_hardcoded_secrets
    assert oct_lint._name_matches_secret is secret_scanner._name_matches_secret
    assert oct_lint._SECRET_NAME_PATTERNS is secret_scanner._SECRET_NAME_PATTERNS
 
 
def test_scanner_detects_direct_assignment():
    """OI-514: ``password = "literal"`` flagged with line number."""
    from oct.tools.secret_scanner import check_no_hardcoded_secrets
    passed, msg = check_no_hardcoded_secrets('password = "hunter2"\n')
    assert passed is False
    assert "password" in msg
    assert "L1" in msg
 
 
def test_scanner_ignores_env_lookup():
    """OI-514: calls and subscripts are safe — env lookups never flagged."""
    from oct.tools.secret_scanner import check_no_hardcoded_secrets
    src = (
        "import os\n"
        "password = os.environ['PASSWORD']\n"
        "token = os.getenv('TOKEN')\n"
    )
    passed, msg = check_no_hardcoded_secrets(src)
    assert passed is True, msg