@kernel-sig/console 0.1.0

package/backend/tests/test_atomgit_models.py

@@ -0,0 +1,257 @@
+"""AtomGit 数据模型对**真实响应**的解析验证。
+
+夹具来自 atomgit.com 的实际 API 响应（见 tests/fixtures/atomgit/）。
+不使用手写假数据 —— 手写数据会掩盖字段名与类型上的错误，
+正如官方文档把认证头写错一样。
+"""
+
+import json
+from pathlib import Path
+
+import pytest
+
+from app.integrations.atomgit.models import (
+    AtomGitComment,
+    AtomGitCommit,
+    AtomGitFile,
+    AtomGitIssue,
+    AtomGitLabel,
+    AtomGitPullRequest,
+    AtomGitRepository,
+)
+
+FIXTURES = Path(__file__).parent / "fixtures" / "atomgit"
+
+
+def load(name: str):
+    return json.loads((FIXTURES / name).read_text(encoding="utf-8"))
+
+
+# --- PR ---------------------------------------------------------------
+
+
+def test_parses_real_pull_list():
+    pulls = [AtomGitPullRequest.model_validate(x) for x in load("pulls_page1.json")]
+    assert len(pulls) == 5
+    first = pulls[0]
+    assert isinstance(first.number, int)
+    assert first.title
+    assert first.state == "open"
+    assert first.target_branch
+
+
+def test_pull_exposes_label_names():
+    pulls = [AtomGitPullRequest.model_validate(x) for x in load("pulls_page1.json")]
+    assert isinstance(pulls[0].label_names, list)
+
+
+def test_pull_detail_parses():
+    pull = AtomGitPullRequest.model_validate(load("pull_detail.json"))
+    assert pull.number == 27650
+    assert pull.mergeable is not None
+    assert isinstance(pull.label_names, list)
+
+
+def test_blank_datetime_becomes_none():
+    """AtomGit 用空字符串表示"尚未合并"，不能当成非法日期。"""
+    pull = AtomGitPullRequest.model_validate(load("pull_detail.json"))
+    if pull.merged_at is not None:
+        # 该 PR 未合并，字段应为空字符串 → None
+        pytest.fail("未合并的 PR 不应有 merged_at")
+    assert pull.merged_at is None
+
+
+def test_merged_pull_has_merged_at():
+    pulls = [AtomGitPullRequest.model_validate(x) for x in load("pulls_merged.json")]
+    merged = [p for p in pulls if p.merged_at is not None]
+    assert merged, "已合并的 PR 应解析出 merged_at"
+
+
+def test_merged_pull_review_labels_present():
+    """评审状态由标签承载：这是评审子系统的数据基础。"""
+    pulls = [AtomGitPullRequest.model_validate(x) for x in load("pulls_merged.json")]
+    names = {n for p in pulls for n in p.label_names}
+    assert "approved" in names or "lgtm" in names
+
+
+def test_pull_permalink_prefers_web_url():
+    """html_url 实测指向 /merge_requests/，规范链接应用 web_url。"""
+    pull = AtomGitPullRequest.model_validate(load("pull_detail.json"))
+    assert pull.permalink
+    assert "/pull/" in pull.permalink or "/merge_requests/" in pull.permalink
+
+
+# --- 文件 -------------------------------------------------------------
+
+
+def test_parses_real_pull_files():
+    files = [AtomGitFile.model_validate(x) for x in load("pull_files.json")]
+    assert files
+    assert all(f.filename for f in files)
+
+
+def test_text_file_is_not_binary():
+    files = [AtomGitFile.model_validate(x) for x in load("pull_files.json")]
+    assert not any(f.is_binary for f in files)
+
+
+@pytest.mark.parametrize("marker", ["Binary files differ", "GIT binary patch"])
+def test_binary_file_detected_from_patch_marker(marker):
+    """内核仓库禁止提交二进制文件，判定依据是 Git 的二进制标记。"""
+    file = AtomGitFile(filename="drivers/x/fw.bin", patch=f"{marker}\n...")
+    assert file.is_binary
+
+
+def test_file_without_patch_is_not_binary():
+    assert not AtomGitFile(filename="a.c", patch=None).is_binary
+
+
+# --- 提交 -------------------------------------------------------------
+
+
+def test_parses_real_pull_commits():
+    commits = [AtomGitCommit.model_validate(x) for x in load("pull_commits.json")]
+    assert commits
+    assert len(commits[0].sha) >= 8
+    assert commits[0].subject
+
+
+# --- 评论 -------------------------------------------------------------
+
+
+def test_parses_real_pull_comments():
+    comments = [AtomGitComment.model_validate(x) for x in load("pull_comments.json")]
+    assert comments
+    assert all(c.id is not None for c in comments)
+    # 实测字段：comment_type 与 discussion_id
+    assert any(c.comment_type for c in comments)
+
+
+# --- Issue ------------------------------------------------------------
+
+
+def test_issue_number_string_is_coerced_to_int():
+    """Issue 的 number 是字符串，需与 PR 共用整数编号空间。"""
+    issues = [AtomGitIssue.model_validate(x) for x in load("issues_page1.json")]
+    assert all(isinstance(i.number, int) for i in issues)
+
+
+def test_issue_structured_fields_parsed():
+    """AtomGit 原生提供类型/状态/优先级，比用标签猜测更可靠。"""
+    issue = AtomGitIssue.model_validate(load("issue_detail.json"))
+    assert issue.issue_type
+    assert issue.issue_state
+    assert issue.title
+
+
+def test_issue_labels_parsed():
+    issues = [AtomGitIssue.model_validate(x) for x in load("issues_page1.json")]
+    assert any(i.label_names for i in issues)
+
+
+# --- 标签与仓库 -------------------------------------------------------
+
+
+def test_parses_real_labels():
+    labels = [AtomGitLabel.model_validate(x) for x in load("labels.json")]
+    assert labels
+    assert all(label.name for label in labels)
+
+
+def test_parses_real_repository():
+    repo = AtomGitRepository.model_validate(load("repo.json"))
+    assert repo.full_name == "openeuler/kernel"
+    assert repo.default_branch
+
+
+# --- 健壮性 -----------------------------------------------------------
+
+
+def test_unknown_fields_are_ignored():
+    """上游新增字段不应导致解析失败。"""
+    payload = load("pull_detail.json")
+    pull = AtomGitPullRequest.model_validate({**payload, "brand_new_field": {"x": 1}})
+    assert pull.number == 27650
+
+
+def test_missing_optional_fields_are_tolerated():
+    minimal = {"number": 1, "title": "t", "state": "open"}
+    pull = AtomGitPullRequest.model_validate(minimal)
+    assert pull.labels == []
+    assert pull.author_login is None
+    assert pull.merged_at is None
+
+
+# --- 实测结构与直觉不符之处，逐条锁定 -------------------------------
+
+
+def test_file_patch_is_an_object_not_a_string():
+    """实测 patch 是含 diff/old_path/too_large 的对象，不是 diff 字符串。"""
+    files = [AtomGitFile.model_validate(x) for x in load("pull_files.json")]
+    file = files[0]
+    assert file.patch is not None
+    assert file.patch.diff is not None
+    assert "@@" in file.patch.diff
+    assert file.patch.old_path == file.filename
+
+
+def test_file_diff_text_shortcut():
+    files = [AtomGitFile.model_validate(x) for x in load("pull_files.json")]
+    assert files[0].diff_text is not None
+
+
+def test_file_patch_as_plain_string_still_parses():
+    """其他端点或未来版本可能直接返回字符串，需兼容。"""
+    file = AtomGitFile.model_validate({"filename": "a.c", "patch": "@@ -1 +1 @@\n-x\n+y"})
+    assert file.diff_text and "@@" in file.diff_text
+    assert not file.is_binary
+
+
+def test_commit_message_is_nested_under_commit():
+    """commit 的 message 嵌套在 commit.{author,committer,message}。"""
+    commits = [AtomGitCommit.model_validate(x) for x in load("pull_commits.json")]
+    commit = commits[0]
+    assert commit.message
+    assert commit.subject
+    assert commit.subject.startswith("KVM:")
+
+
+def test_commit_subject_is_first_line_only():
+    commit = AtomGitCommit.model_validate(
+        {"sha": "a" * 40, "commit": {"message": "sub: do thing\n\nbody line\nmore"}}
+    )
+    assert commit.subject == "sub: do thing"
+
+
+def test_mergeable_state_is_an_object():
+    """实测 mergeable_state 是合并检查明细对象，不是状态字符串。"""
+    pull = AtomGitPullRequest.model_validate(load("pull_detail.json"))
+    assert pull.mergeable_state is not None
+    assert pull.mergeable_state.merge_request_id is not None
+
+
+def test_merge_conflict_detected_from_detail():
+    payload = {
+        "number": 1,
+        "title": "t",
+        "state": "open",
+        "mergeable": False,
+        "mergeable_state": {"conflict_passed": False},
+    }
+    assert AtomGitPullRequest.model_validate(payload).has_merge_conflict
+
+
+def test_no_conflict_when_detail_says_passed():
+    payload = {
+        "number": 1,
+        "title": "t",
+        "state": "open",
+        "mergeable": True,
+        "mergeable_state": {"conflict_passed": True},
+    }
+    assert not AtomGitPullRequest.model_validate(payload).has_merge_conflict
+
+
+def test_merge_conflict_falls_back_to_mergeable_flag():
+    payload = {"number": 1, "title": "t", "state": "open", "mergeable": False}
+    assert AtomGitPullRequest.model_validate(payload).has_merge_conflict

package/backend/tests/test_attention.py

@@ -0,0 +1,291 @@
+"""关注项规则。
+
+规则的价值在于"能不能让维护者据此行动"，因此测试重点覆盖：
+- 不该报的不报（已合并、未到期、已完成评审的都不算待办）
+- 该报的报且给得出理由
+"""
+
+from datetime import UTC, datetime, timedelta
+
+import pytest
+
+from app.domain.attention import (
+    RULE_DESCRIPTIONS,
+    PullSnapshot,
+    Rule,
+    Severity,
+    Thresholds,
+    evaluate,
+)
+
+NOW = datetime(2026, 9, 16, 12, 0, tzinfo=UTC)
+
+
+def ago(days: float = 0, hours: float = 0) -> datetime:
+    return NOW - timedelta(days=days, hours=hours)
+
+
+def make_pull(**overrides) -> PullSnapshot:
+    base: dict = {
+        "number": 1000,
+        "title": "net: fix leak",
+        "state": "open",
+        "gate_stage": "ready_to_merge",
+        "created_at": ago(1),
+        "updated_at": ago(0.5),
+    }
+    base.update(overrides)
+    return PullSnapshot(**base)
+
+
+def rules_for(pull: PullSnapshot, **kw) -> set[Rule]:
+    return {hit.rule for hit in evaluate(pull, now=NOW, **kw)}
+
+
+# --- 不该报的情况 -----------------------------------------------------
+
+
+@pytest.mark.parametrize("state", ["merged", "closed"])
+def test_finished_pulls_produce_no_attention(state):
+    """对已合并/已关闭的 PR 提"待处理"是纯噪音。"""
+    pull = make_pull(state=state, gate_stage="review_pending", updated_at=ago(90))
+    assert evaluate(pull, now=NOW) == []
+
+
+def test_healthy_pull_produces_nothing():
+    """门禁就绪、刚更新过的 PR 不应产生任何告警。"""
+    assert evaluate(make_pull(), now=NOW) == []
+
+
+def test_recent_pull_within_sla_is_not_flagged():
+    pull = make_pull(gate_stage="review_pending", created_at=ago(2))
+    assert Rule.REVIEW_SLA_BREACH not in rules_for(pull)
+
+
+def test_pull_with_lgtm_is_not_review_sla_breach():
+    """已拿到 LGTM 的不算评审欠账，否则会把完成的评审算成超期。"""
+    pull = make_pull(gate_stage="ready_to_merge", created_at=ago(60))
+    assert Rule.REVIEW_SLA_BREACH not in rules_for(pull)
+
+
+def test_draft_is_not_stale_flagged_until_threshold():
+    pull = make_pull(is_draft=True, updated_at=ago(5))
+    assert Rule.STALE not in rules_for(pull)
+
+
+# --- CI ---------------------------------------------------------------
+
+
+def test_ci_failure_is_reported():
+    pull = make_pull(gate_stage="ci_failed", updated_at=ago(0.2))
+    hits = evaluate(pull, now=NOW)
+    assert Rule.CI_FAILED in {h.rule for h in hits}
+    hit = next(h for h in hits if h.rule is Rule.CI_FAILED)
+    assert hit.severity is Severity.WARNING
+
+
+def test_long_running_ci_failure_escalates():
+    pull = make_pull(gate_stage="ci_failed", updated_at=ago(10))
+    hit = next(h for h in evaluate(pull, now=NOW) if h.rule is Rule.CI_FAILED)
+    assert hit.severity is Severity.CRITICAL
+    assert "10 天" in hit.title
+
+
+# --- 合并冲突 ---------------------------------------------------------
+
+
+def test_merge_conflict_reported():
+    pull = make_pull(merge_conflict=True, updated_at=ago(0.5))
+    assert Rule.MERGE_CONFLICT in rules_for(pull)
+
+
+def test_old_conflict_escalates():
+    pull = make_pull(merge_conflict=True, updated_at=ago(5))
+    hit = next(h for h in evaluate(pull, now=NOW) if h.rule is Rule.MERGE_CONFLICT)
+    assert hit.severity is Severity.CRITICAL
+
+
+def test_conflict_on_closed_pull_not_reported():
+    pull = make_pull(merge_conflict=True, state="closed")
+    assert Rule.MERGE_CONFLICT not in rules_for(pull)
+
+
+# --- CVE --------------------------------------------------------------
+
+
+def test_cve_aging_reported_after_threshold():
+    pull = make_pull(cve_ids=["CVE-2026-1234"], created_at=ago(2))
+    hits = evaluate(pull, now=NOW)
+    hit = next(h for h in hits if h.rule is Rule.CVE_AGING)
+    assert hit.severity is Severity.CRITICAL
+    assert "CVE-2026-1234" in hit.detail
+
+
+def test_fresh_cve_not_flagged():
+    pull = make_pull(cve_ids=["CVE-2026-1234"], created_at=ago(0.2))
+    assert Rule.CVE_AGING not in rules_for(pull)
+
+
+def test_non_cve_pull_never_gets_cve_aging():
+    pull = make_pull(created_at=ago(100))
+    assert Rule.CVE_AGING not in rules_for(pull)
+
+
+def test_many_cves_are_summarised_not_dumped():
+    """一次涉及几十个 CVE 的补丁（实测存在）不能把详情铺满。
+
+    待办的价值在于「要做什么」，一串编号占满整屏反而淹没了这句话。
+    完整列表仍然完整地留在 evidence 里 —— 摘要不等于丢信息。
+    """
+    cves = [f"CVE-2026-{1000 + i}" for i in range(34)]
+    pull = make_pull(cve_ids=cves, created_at=ago(2))
+    hit = next(h for h in evaluate(pull, now=NOW) if h.rule is Rule.CVE_AGING)
+
+    assert "等 34 项" in hit.detail
+    assert len(hit.detail) < 200, f"详情过长：{len(hit.detail)} 字符"
+    assert hit.evidence["cve_ids"] == cves, "evidence 中保留完整列表"
+
+
+def test_few_cves_are_listed_in_full():
+    """少数几个 CVE 直接列出，不必加"等 N 项"的噪音。"""
+    pull = make_pull(cve_ids=["CVE-2026-1", "CVE-2026-2"], created_at=ago(2))
+    hit = next(h for h in evaluate(pull, now=NOW) if h.rule is Rule.CVE_AGING)
+    assert "CVE-2026-1" in hit.detail and "CVE-2026-2" in hit.detail
+    assert "等" not in hit.detail
+
+
+# --- CLA / Issue / NACK -----------------------------------------------
+
+
+def test_cla_denied_is_critical():
+    pull = make_pull(gate_stage="cla_denied")
+    hit = next(h for h in evaluate(pull, now=NOW) if h.rule is Rule.CLA_DENIED)
+    assert hit.severity is Severity.CRITICAL
+
+
+def test_cla_pending_only_flagged_after_a_day():
+    fresh = make_pull(gate_stage="cla_pending", created_at=ago(0.2))
+    assert Rule.CLA_PENDING_LONG not in rules_for(fresh)
+
+    old = make_pull(gate_stage="cla_pending", created_at=ago(3))
+    assert Rule.CLA_PENDING_LONG in rules_for(old)
+
+
+def test_needs_issue_reported():
+    pull = make_pull(gate_stage="needs_issue")
+    assert Rule.NEEDS_ISSUE in rules_for(pull)
+
+
+def test_rejected_reported():
+    pull = make_pull(gate_stage="rejected", label_names=["NACK"])
+    hit = next(h for h in evaluate(pull, now=NOW) if h.rule is Rule.REJECTED)
+    assert hit.severity is Severity.CRITICAL
+
+
+# --- 二进制文件 -------------------------------------------------------
+
+
+def test_binary_file_is_blocker():
+    """内核仓库禁止二进制文件，属阻塞性问题而非提示。"""
+    pull = make_pull(binary_files=["drivers/fw.bin", "drivers/other.bin"])
+    hit = next(h for h in evaluate(pull, now=NOW) if h.rule is Rule.BINARY_FILE)
+    assert hit.severity is Severity.BLOCKER
+    assert "2 个" in hit.title
+    assert hit.evidence["files"] == ["drivers/fw.bin", "drivers/other.bin"]
+
+
+def test_no_binary_files_no_hit():
+    assert Rule.BINARY_FILE not in rules_for(make_pull())
+
+
+# --- Signed-off-by ----------------------------------------------------
+
+
+def test_missing_signed_off_reported():
+    pull = make_pull(total_commits=3, commits_without_signed_off=1)
+    hit = next(h for h in evaluate(pull, now=NOW) if h.rule is Rule.MISSING_SIGNED_OFF)
+    assert hit.evidence == {"missing": 1, "total": 3}
+
+
+def test_all_signed_off_no_hit():
+    pull = make_pull(total_commits=3, commits_without_signed_off=0)
+    assert Rule.MISSING_SIGNED_OFF not in rules_for(pull)
+
+
+def test_no_commits_means_no_signed_off_judgement():
+    """提交尚未同步时不能断定"缺少签名" —— 那是数据缺失，不是问题。"""
+    pull = make_pull(total_commits=0, commits_without_signed_off=0)
+    assert Rule.MISSING_SIGNED_OFF not in rules_for(pull)
+
+
+# --- Stale ------------------------------------------------------------
+
+
+def test_stale_after_threshold():
+    pull = make_pull(updated_at=ago(45))
+    hit = next(h for h in evaluate(pull, now=NOW) if h.rule is Rule.STALE)
+    assert "45 天" in hit.title
+
+
+def test_custom_thresholds_respected():
+    pull = make_pull(updated_at=ago(10))
+    assert Rule.STALE not in rules_for(pull)
+    assert Rule.STALE in rules_for(pull, thresholds=Thresholds(stale_days=7))
+
+
+# --- 输出契约 ---------------------------------------------------------
+
+
+def test_hits_sorted_by_severity():
+    """阻塞性问题必须排在提示类之前 —— 界面按此顺序渲染。"""
+    pull = make_pull(
+        gate_stage="needs_issue",
+        binary_files=["a.bin"],
+        updated_at=ago(60),
+    )
+    hits = evaluate(pull, now=NOW)
+    severities = [h.severity for h in hits]
+    order = [
+        Severity.BLOCKER,
+        Severity.CRITICAL,
+        Severity.WARNING,
+        Severity.INFO,
+    ]
+    assert severities == sorted(severities, key=lambda s: order.index(s))
+
+
+def test_every_hit_carries_actionable_evidence():
+    """只给"有问题"的结论无法据以行动，每条命中都必须带证据。"""
+    pull = make_pull(
+        gate_stage="ci_failed",
+        binary_files=["a.bin"],
+        merge_conflict=True,
+        created_at=ago(30),
+        updated_at=ago(10),
+        total_commits=2,
+        commits_without_signed_off=2,
+    )
+    hits = evaluate(pull, now=NOW)
+    assert len(hits) >= 4
+    for hit in hits:
+        assert hit.title
+        assert hit.detail
+        assert hit.evidence, f"{hit.rule} 缺少证据"
+
+
+def test_every_rule_has_a_description():
+    """界面要解释"这条规则是什么意思"，缺描述会让使用者无从判断。"""
+    for rule in Rule:
+        assert rule in RULE_DESCRIPTIONS, f"{rule.value} 缺少说明文案"
+
+
+def test_naive_datetime_is_tolerated():
+    """数据库可能返回不带时区的时间，规则不应因此崩溃。"""
+    naive = datetime(2026, 8, 1)
+    pull = make_pull(created_at=naive, updated_at=naive)
+    assert evaluate(pull, now=NOW) is not None
+
+
+def test_missing_timestamps_do_not_crash():
+    pull = make_pull(created_at=None, updated_at=None)
+    assert evaluate(pull, now=NOW) == []

package/backend/tests/test_audit_middleware.py

@@ -0,0 +1,135 @@
+"""审计中间件的行为约束。
+
+关键不变量：中间件在请求处理完成、数据库会话关闭**之后**才写日志，
+因此绝不能触碰 ORM 实例（会触发 DetachedInstanceError）。
+归属信息必须以标量形式从 request.state 读取。
+"""
+
+import uuid
+
+import pytest
+from starlette.requests import Request
+
+from app.middleware.audit import AuditMiddleware, _redact, _username_from
+from app.models.audit import AuditResult
+
+
+class ExplodingUser:
+    """访问任何属性都抛错，用于证明中间件不会触碰 ORM 实例。"""
+
+    def __getattr__(self, name: str):
+        raise AssertionError(f"审计中间件不应读取 user.{name}")
+
+
+class _FakeSession:
+    def __init__(self, sink: list) -> None:
+        self._sink = sink
+
+    def add(self, obj: object) -> None:
+        self._sink.append(obj)
+
+    async def commit(self) -> None:
+        return None
+
+    async def __aenter__(self) -> "_FakeSession":
+        return self
+
+    async def __aexit__(self, *exc_info: object) -> bool:
+        return False
+
+
+@pytest.fixture
+def captured(monkeypatch):
+    sink: list = []
+
+    class _Factory:
+        def __call__(self) -> _FakeSession:
+            return _FakeSession(sink)
+
+    monkeypatch.setattr("app.middleware.audit.get_session_factory", lambda: _Factory())
+    return sink
+
+
+def _request() -> Request:
+    return Request(
+        {
+            "type": "http",
+            "method": "POST",
+            "path": "/api/v1/users",
+            "headers": [],
+            "client": ("10.0.0.1", 12345),
+            "state": {},
+        }
+    )
+
+
+async def test_write_log_reads_primitives_not_orm(captured):
+    middleware = AuditMiddleware(app=lambda *a, **kw: None)
+    request = _request()
+    actor_id = uuid.uuid4()
+    request.state.actor_user_id = actor_id
+    request.state.actor_username = "alice"
+    request.state.request_id = "rid-1"
+    # 若中间件去读 user 的属性，这里会抛 AssertionError
+    request.state.user = ExplodingUser()
+
+    await middleware._write_log(request, {"action": "create"}, AuditResult.SUCCESS)
+
+    assert len(captured) == 1
+    entry = captured[0]
+    assert entry.actor_username == "alice"
+    assert entry.actor_user_id == actor_id
+    assert entry.actor_ip == "10.0.0.1"
+    assert entry.request_id == "rid-1"
+    assert entry.result is AuditResult.SUCCESS
+
+
+async def test_write_log_falls_back_to_claimed_actor(captured):
+    """未认证请求（如登录尝试）用载荷中的账号名作为归属。"""
+    middleware = AuditMiddleware(app=lambda *a, **kw: None)
+    request = _request()
+    request.state.request_id = "rid-2"
+
+    await middleware._write_log(
+        request, {"username": "attacker"}, AuditResult.FAILURE, claimed_actor="attacker"
+    )
+
+    assert captured[0].actor_username == "attacker"
+    assert captured[0].actor_user_id is None
+
+
+async def test_write_log_swallows_session_failure(monkeypatch):
+    """审计写入失败绝不能影响主请求。"""
+    middleware = AuditMiddleware(app=lambda *a, **kw: None)
+
+    class _Boom:
+        def __call__(self):
+            raise RuntimeError("数据库不可用")
+
+    monkeypatch.setattr("app.middleware.audit.get_session_factory", lambda: _Boom())
+    request = _request()
+    request.state.actor_username = "alice"
+
+    await middleware._write_log(request, None, AuditResult.SUCCESS)
+
+
+def test_redact_masks_credential_fields():
+    payload = {
+        "username": "alice",
+        "password": "hunter2",
+        "nested": {"api_key": "k-123", "safe": "visible"},
+        "items": [{"token": "t-1"}],
+    }
+    result = _redact(payload)
+    assert result["username"] == "alice"
+    assert result["password"] == "***"
+    assert result["nested"]["api_key"] == "***"
+    assert result["nested"]["safe"] == "visible"
+    assert result["items"][0]["token"] == "***"
+
+
+def test_username_from_extracts_only_username():
+    assert _username_from({"username": "bob", "password": "x"}) == "bob"
+    assert _username_from({"password": "x"}) is None
+    assert _username_from("not-a-dict") is None
+    assert _username_from({"username": ""}) is None