Latte
ce5ae6caa5
ci / gitleaks (push) Successful in 8s
ci / docs-check (push) Failing after 30s
ci / lint (push) Successful in 42s
ci / test-integration (push) Successful in 46s
ci / security (push) Failing after 27s
ci / test-mcp (push) Successful in 1m16s
ci / test-unit (push) Successful in 2m17s
ci / build-and-push (push) Successful in 17s
Identity gains a redact field that the executor honours, so the OAuth resolver no longer needs an executor subclass overriding private internals. Opaque agm_ tokens issued by our authorization server are now masked by the secret patterns wherever they appear in content.
40 lines
1.5 KiB
Python
40 lines
1.5 KiB
Python
"""Tests for secret detection and sanitization helpers."""
|
|
|
|
from aegis_gitea_mcp.security import detect_secrets, sanitize_data
|
|
|
|
|
|
def test_detect_secrets_api_key_pattern() -> None:
|
|
"""Secret detector should identify common token formats."""
|
|
findings = detect_secrets("token=sk-test12345678901234567890")
|
|
assert findings
|
|
|
|
|
|
def test_issued_oauth_tokens_are_masked() -> None:
|
|
"""Our own ``agm_`` OAuth tokens are masked wherever they show up in content."""
|
|
issued = "agm_" + "Ab3_-x" * 7 + "Z" # the shape of agm_ + token_urlsafe(32)
|
|
text = f"pasted by mistake: {issued}."
|
|
|
|
findings = detect_secrets(text)
|
|
masked = sanitize_data({"body": text})
|
|
|
|
assert [finding.secret_type for finding in findings] == ["aegis_oauth_token"]
|
|
assert issued not in masked["body"] and masked["body"].endswith(".")
|
|
assert detect_secrets("agm_short") == []
|
|
|
|
|
|
def test_sanitize_data_mask_mode() -> None:
|
|
"""Mask mode should preserve structure while redacting values."""
|
|
payload = {"content": "api_key=AKIA1234567890ABCDEF"}
|
|
sanitized = sanitize_data(payload, mode="mask")
|
|
|
|
assert sanitized["content"] != payload["content"]
|
|
assert "AKIA" in sanitized["content"]
|
|
|
|
|
|
def test_sanitize_data_block_mode() -> None:
|
|
"""Block mode should replace secret-bearing fields entirely."""
|
|
payload = {"nested": ["Bearer eyJhbGciOiJIUzI1NiJ9.abcd.efgh"]}
|
|
sanitized = sanitize_data(payload, mode="block")
|
|
|
|
assert sanitized["nested"][0] == "[REDACTED_SECRET]"
|