@contrail/cli 3.4.5 → 3.4.6-alpha.cffb28e

package/node_modules/@pinojs/redact/test/integration.test.js

@@ -0,0 +1,390 @@
+const { test } = require('node:test')
+const { strict: assert } = require('node:assert')
+const slowRedact = require('../index.js')
+const fastRedact = require('fast-redact')
+
+test('integration: basic path redaction matches fast-redact', () => {
+  const obj = {
+    headers: {
+      cookie: 'secret-cookie',
+      authorization: 'Bearer token'
+    },
+    body: { message: 'hello' }
+  }
+
+  const slowResult = slowRedact({ paths: ['headers.cookie'] })(obj)
+  const fastResult = fastRedact({ paths: ['headers.cookie'] })(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: multiple paths match fast-redact', () => {
+  const obj = {
+    user: { name: 'john', password: 'secret' },
+    session: { token: 'abc123' }
+  }
+
+  const paths = ['user.password', 'session.token']
+  const slowResult = slowRedact({ paths })(obj)
+  const fastResult = fastRedact({ paths })(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: custom censor value matches fast-redact', () => {
+  const obj = { secret: 'hidden' }
+  const options = { paths: ['secret'], censor: '***' }
+
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: bracket notation matches fast-redact', () => {
+  const obj = {
+    'weird-key': { 'another-weird': 'secret' },
+    normal: 'public'
+  }
+
+  const options = { paths: ['["weird-key"]["another-weird"]'] }
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: array paths match fast-redact', () => {
+  const obj = {
+    users: [
+      { name: 'john', password: 'secret1' },
+      { name: 'jane', password: 'secret2' }
+    ]
+  }
+
+  const options = { paths: ['users[0].password', 'users[1].password'] }
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: wildcard at end matches fast-redact', () => {
+  const obj = {
+    secrets: {
+      key1: 'secret1',
+      key2: 'secret2'
+    },
+    public: 'data'
+  }
+
+  const options = { paths: ['secrets.*'] }
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: wildcard with arrays matches fast-redact', () => {
+  const obj = {
+    items: ['secret1', 'secret2', 'secret3']
+  }
+
+  const options = { paths: ['items.*'] }
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: intermediate wildcard matches fast-redact', () => {
+  const obj = {
+    users: {
+      user1: { password: 'secret1' },
+      user2: { password: 'secret2' }
+    }
+  }
+
+  const options = { paths: ['users.*.password'] }
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: custom serialize function matches fast-redact', () => {
+  const obj = { secret: 'hidden', public: 'data' }
+  const options = {
+    paths: ['secret'],
+    serialize: (obj) => `custom:${JSON.stringify(obj)}`
+  }
+
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: nested paths match fast-redact', () => {
+  const obj = {
+    level1: {
+      level2: {
+        level3: {
+          secret: 'hidden'
+        }
+      }
+    }
+  }
+
+  const options = { paths: ['level1.level2.level3.secret'] }
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: non-existent paths match fast-redact', () => {
+  const obj = { existing: 'value' }
+  const options = { paths: ['nonexistent.path'] }
+
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: null and undefined handling - legitimate difference', () => {
+  const obj = {
+    nullValue: null,
+    undefinedValue: undefined,
+    nested: {
+      nullValue: null
+    }
+  }
+
+  const options = { paths: ['nullValue', 'nested.nullValue'] }
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  // This is a legitimate behavioral difference:
+  // @pinojs/redact redacts null values, fast-redact doesn't
+  const slowParsed = JSON.parse(slowResult)
+  const fastParsed = JSON.parse(fastResult)
+
+  // @pinojs/redact redacts nulls
+  assert.strictEqual(slowParsed.nullValue, '[REDACTED]')
+  assert.strictEqual(slowParsed.nested.nullValue, '[REDACTED]')
+
+  // fast-redact preserves nulls
+  assert.strictEqual(fastParsed.nullValue, null)
+  assert.strictEqual(fastParsed.nested.nullValue, null)
+})
+
+test('integration: strict mode with primitives - different error handling', () => {
+  const options = { paths: ['test'], strict: true }
+
+  const slowRedactFn = slowRedact(options)
+  const fastRedactFn = fastRedact(options)
+
+  // @pinojs/redact handles primitives gracefully
+  const stringSlowResult = slowRedactFn('primitive')
+  assert.strictEqual(stringSlowResult, '"primitive"')
+
+  const numberSlowResult = slowRedactFn(42)
+  assert.strictEqual(numberSlowResult, '42')
+
+  // fast-redact throws an error for primitives in strict mode
+  assert.throws(() => {
+    fastRedactFn('primitive')
+  }, /primitives cannot be redacted/)
+
+  assert.throws(() => {
+    fastRedactFn(42)
+  }, /primitives cannot be redacted/)
+})
+
+test('integration: serialize false behavior difference', () => {
+  const slowObj = { secret: 'hidden' }
+  const fastObj = { secret: 'hidden' }
+  const options = { paths: ['secret'], serialize: false }
+
+  const slowResult = slowRedact(options)(slowObj)
+  const fastResult = fastRedact(options)(fastObj)
+
+  // Both should redact the secret
+  assert.strictEqual(slowResult.secret, '[REDACTED]')
+  assert.strictEqual(fastResult.secret, '[REDACTED]')
+
+  // @pinojs/redact always has restore method
+  assert.strictEqual(typeof slowResult.restore, 'function')
+
+  // @pinojs/redact should restore to original value
+  assert.strictEqual(slowResult.restore().secret, 'hidden')
+
+  // Key difference: original object state
+  // fast-redact mutates the original, @pinojs/redact doesn't
+  assert.strictEqual(slowObj.secret, 'hidden') // @pinojs/redact preserves original
+  assert.strictEqual(fastObj.secret, '[REDACTED]') // fast-redact mutates original
+})
+
+test('integration: censor function behavior', () => {
+  const obj = { secret: 'hidden' }
+  const options = {
+    paths: ['secret'],
+    censor: (value, path) => `REDACTED:${path}`
+  }
+
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: complex object with mixed patterns', () => {
+  const obj = {
+    users: [
+      {
+        id: 1,
+        name: 'john',
+        credentials: { password: 'secret1', apiKey: 'key1' }
+      },
+      {
+        id: 2,
+        name: 'jane',
+        credentials: { password: 'secret2', apiKey: 'key2' }
+      }
+    ],
+    config: {
+      database: { password: 'db-secret' },
+      api: { keys: ['key1', 'key2', 'key3'] }
+    }
+  }
+
+  const options = {
+    paths: [
+      'users.*.credentials.password',
+      'users.*.credentials.apiKey',
+      'config.database.password',
+      'config.api.keys.*'
+    ]
+  }
+
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+// Remove option integration tests - comparing with fast-redact
+test('integration: remove option basic comparison with fast-redact', () => {
+  const obj = { username: 'john', password: 'secret123' }
+  const options = { paths: ['password'], remove: true }
+
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+
+  // Verify the key is actually removed
+  const parsed = JSON.parse(slowResult)
+  assert.strictEqual(parsed.username, 'john')
+  assert.strictEqual('password' in parsed, false)
+})
+
+test('integration: remove option multiple paths comparison with fast-redact', () => {
+  const obj = {
+    user: { name: 'john', password: 'secret' },
+    session: { token: 'abc123', id: 'session1' }
+  }
+
+  const options = {
+    paths: ['user.password', 'session.token'],
+    remove: true
+  }
+
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: remove option wildcard comparison with fast-redact', () => {
+  const obj = {
+    secrets: {
+      key1: 'secret1',
+      key2: 'secret2'
+    },
+    public: 'data'
+  }
+
+  const options = {
+    paths: ['secrets.*'],
+    remove: true
+  }
+
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: remove option intermediate wildcard comparison with fast-redact', () => {
+  const obj = {
+    users: {
+      user1: { password: 'secret1', name: 'john' },
+      user2: { password: 'secret2', name: 'jane' }
+    }
+  }
+
+  const options = {
+    paths: ['users.*.password'],
+    remove: true
+  }
+
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: remove option with custom censor comparison with fast-redact', () => {
+  const obj = { secret: 'hidden', public: 'data' }
+  const options = {
+    paths: ['secret'],
+    censor: '***',
+    remove: true
+  }
+
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+
+  // With remove: true, censor value should be ignored
+  const parsed = JSON.parse(slowResult)
+  assert.strictEqual('secret' in parsed, false)
+  assert.strictEqual(parsed.public, 'data')
+})
+
+test('integration: remove option serialize false behavior - @pinojs/redact only', () => {
+  // fast-redact doesn't support remove option with serialize: false
+  // so we test @pinojs/redact's behavior only
+  const obj = { secret: 'hidden', public: 'data' }
+  const options = { paths: ['secret'], remove: true, serialize: false }
+
+  const result = slowRedact(options)(obj)
+
+  // Should have the key removed
+  assert.strictEqual('secret' in result, false)
+  assert.strictEqual(result.public, 'data')
+
+  // Should have restore method
+  assert.strictEqual(typeof result.restore, 'function')
+
+  // Original object should be preserved
+  assert.strictEqual(obj.secret, 'hidden')
+
+  // Restore should bring back the removed key
+  const restored = result.restore()
+  assert.strictEqual(restored.secret, 'hidden')
+})

package/node_modules/@pinojs/redact/test/multiple-wildcards.test.js

@@ -0,0 +1,227 @@
+'use strict'
+
+const { test } = require('node:test')
+const { strict: assert } = require('node:assert')
+const slowRedact = require('../index.js')
+
+// Tests for Issue #2319: @pinojs/redact fails to redact patterns with 3+ consecutive wildcards
+test('three consecutive wildcards: *.*.*.password (4 levels deep)', () => {
+  const obj = {
+    simple: { password: 'secret-2-levels' },
+    user: { auth: { password: 'secret-3-levels' } },
+    nested: { deep: { auth: { password: 'secret-4-levels' } } }
+  }
+
+  const redact = slowRedact({
+    paths: ['*.*.*.password']
+  })
+  const result = redact(obj)
+  const parsed = JSON.parse(result)
+
+  // Only the 4-level deep password should be redacted
+  assert.strictEqual(parsed.simple.password, 'secret-2-levels', '2-level password should NOT be redacted')
+  assert.strictEqual(parsed.user.auth.password, 'secret-3-levels', '3-level password should NOT be redacted')
+  assert.strictEqual(parsed.nested.deep.auth.password, '[REDACTED]', '4-level password SHOULD be redacted')
+})
+
+test('four consecutive wildcards: *.*.*.*.password (5 levels deep)', () => {
+  const obj = {
+    simple: { password: 'secret-2-levels' },
+    user: { auth: { password: 'secret-3-levels' } },
+    nested: { deep: { auth: { password: 'secret-4-levels' } } },
+    config: { user: { auth: { settings: { password: 'secret-5-levels' } } } }
+  }
+
+  const redact = slowRedact({
+    paths: ['*.*.*.*.password']
+  })
+  const result = redact(obj)
+  const parsed = JSON.parse(result)
+
+  // Only the 5-level deep password should be redacted
+  assert.strictEqual(parsed.simple.password, 'secret-2-levels', '2-level password should NOT be redacted')
+  assert.strictEqual(parsed.user.auth.password, 'secret-3-levels', '3-level password should NOT be redacted')
+  assert.strictEqual(parsed.nested.deep.auth.password, 'secret-4-levels', '4-level password should NOT be redacted')
+  assert.strictEqual(parsed.config.user.auth.settings.password, '[REDACTED]', '5-level password SHOULD be redacted')
+})
+
+test('five consecutive wildcards: *.*.*.*.*.password (6 levels deep)', () => {
+  const obj = {
+    simple: { password: 'secret-2-levels' },
+    user: { auth: { password: 'secret-3-levels' } },
+    nested: { deep: { auth: { password: 'secret-4-levels' } } },
+    config: { user: { auth: { settings: { password: 'secret-5-levels' } } } },
+    data: {
+      reqConfig: {
+        data: {
+          credentials: {
+            settings: {
+              password: 'secret-6-levels'
+            }
+          }
+        }
+      }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['*.*.*.*.*.password']
+  })
+  const result = redact(obj)
+  const parsed = JSON.parse(result)
+
+  // Only the 6-level deep password should be redacted
+  assert.strictEqual(parsed.simple.password, 'secret-2-levels', '2-level password should NOT be redacted')
+  assert.strictEqual(parsed.user.auth.password, 'secret-3-levels', '3-level password should NOT be redacted')
+  assert.strictEqual(parsed.nested.deep.auth.password, 'secret-4-levels', '4-level password should NOT be redacted')
+  assert.strictEqual(parsed.config.user.auth.settings.password, 'secret-5-levels', '5-level password should NOT be redacted')
+  assert.strictEqual(parsed.data.reqConfig.data.credentials.settings.password, '[REDACTED]', '6-level password SHOULD be redacted')
+})
+
+test('three wildcards with censor function receives correct values', () => {
+  const obj = {
+    nested: { deep: { auth: { password: 'secret-value' } } }
+  }
+
+  const censorCalls = []
+  const redact = slowRedact({
+    paths: ['*.*.*.password'],
+    censor: (value, path) => {
+      censorCalls.push({ value, path: [...path] })
+      return '[REDACTED]'
+    }
+  })
+
+  const result = redact(obj)
+  const parsed = JSON.parse(result)
+
+  // Should have been called exactly once with the correct value
+  assert.strictEqual(censorCalls.length, 1, 'censor should be called once')
+  assert.strictEqual(censorCalls[0].value, 'secret-value', 'censor should receive the actual value')
+  assert.deepStrictEqual(censorCalls[0].path, ['nested', 'deep', 'auth', 'password'], 'censor should receive correct path')
+  assert.strictEqual(parsed.nested.deep.auth.password, '[REDACTED]')
+})
+
+test('three wildcards with multiple matches', () => {
+  const obj = {
+    api1: { v1: { auth: { token: 'token1' } } },
+    api2: { v2: { auth: { token: 'token2' } } },
+    api3: { v1: { auth: { token: 'token3' } } }
+  }
+
+  const redact = slowRedact({
+    paths: ['*.*.*.token']
+  })
+  const result = redact(obj)
+  const parsed = JSON.parse(result)
+
+  // All three tokens should be redacted
+  assert.strictEqual(parsed.api1.v1.auth.token, '[REDACTED]')
+  assert.strictEqual(parsed.api2.v2.auth.token, '[REDACTED]')
+  assert.strictEqual(parsed.api3.v1.auth.token, '[REDACTED]')
+})
+
+test('three wildcards with remove option', () => {
+  const obj = {
+    nested: { deep: { auth: { password: 'secret', username: 'admin' } } }
+  }
+
+  const redact = slowRedact({
+    paths: ['*.*.*.password'],
+    remove: true
+  })
+  const result = redact(obj)
+  const parsed = JSON.parse(result)
+
+  // Password should be removed entirely
+  assert.strictEqual('password' in parsed.nested.deep.auth, false, 'password key should be removed')
+  assert.strictEqual(parsed.nested.deep.auth.username, 'admin', 'username should remain')
+})
+
+test('mixed: two and three wildcards in same redactor', () => {
+  const obj = {
+    user: { auth: { password: 'secret-3-levels' } },
+    config: { deep: { auth: { password: 'secret-4-levels' } } }
+  }
+
+  const redact = slowRedact({
+    paths: ['*.*.password', '*.*.*.password']
+  })
+  const result = redact(obj)
+  const parsed = JSON.parse(result)
+
+  // Both should be redacted
+  assert.strictEqual(parsed.user.auth.password, '[REDACTED]', '3-level should be redacted by *.*.password')
+  assert.strictEqual(parsed.config.deep.auth.password, '[REDACTED]', '4-level should be redacted by *.*.*.password')
+})
+
+test('three wildcards should not call censor for non-existent paths', () => {
+  const obj = {
+    shallow: { data: 'value' },
+    nested: { deep: { auth: { password: 'secret' } } }
+  }
+
+  let censorCallCount = 0
+  const redact = slowRedact({
+    paths: ['*.*.*.password'],
+    censor: (value, path) => {
+      censorCallCount++
+      return '[REDACTED]'
+    }
+  })
+
+  redact(obj)
+
+  // Should only be called once for the path that exists
+  assert.strictEqual(censorCallCount, 1, 'censor should only be called for existing paths')
+})
+
+test('three wildcards with arrays', () => {
+  const obj = {
+    users: [
+      { auth: { password: 'secret1' } },
+      { auth: { password: 'secret2' } }
+    ]
+  }
+
+  const redact = slowRedact({
+    paths: ['*.*.*.password']
+  })
+  const result = redact(obj)
+  const parsed = JSON.parse(result)
+
+  // Both passwords should be redacted (users[0].auth.password is 4 levels)
+  assert.strictEqual(parsed.users[0].auth.password, '[REDACTED]')
+  assert.strictEqual(parsed.users[1].auth.password, '[REDACTED]')
+})
+
+test('four wildcards with authorization header (real-world case)', () => {
+  const obj = {
+    requests: {
+      api1: {
+        config: {
+          headers: {
+            authorization: 'Bearer secret-token'
+          }
+        }
+      },
+      api2: {
+        config: {
+          headers: {
+            authorization: 'Bearer another-token'
+          }
+        }
+      }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['*.*.*.*.authorization']
+  })
+  const result = redact(obj)
+  const parsed = JSON.parse(result)
+
+  // Both authorization headers should be redacted
+  assert.strictEqual(parsed.requests.api1.config.headers.authorization, '[REDACTED]')
+  assert.strictEqual(parsed.requests.api2.config.headers.authorization, '[REDACTED]')
+})