@ryanfw/prompt-orchestration-pipeline 1.3.2 → 1.3.4

package/src/core/__tests__/redact.test.ts

@@ -0,0 +1,153 @@
+import { describe, it, expect } from "bun:test";
+import { redactSecrets, REDACTED } from "../redact";
+
+describe("redactSecrets — key-based masking (AC-1)", () => {
+  it("masks Authorization value at top level", () => {
+    const input = { Authorization: "Bearer abc", path: "/x" };
+    const out = redactSecrets(input) as Record<string, unknown>;
+    expect(out.Authorization).toBe("[REDACTED]");
+    expect(out.path).toBe("/x");
+  });
+
+  it("masks token value case-insensitively (TOKEN)", () => {
+    const input = { TOKEN: "t", other: 1 };
+    const out = redactSecrets(input) as Record<string, unknown>;
+    expect(out.TOKEN).toBe("[REDACTED]");
+    expect(out.other).toBe(1);
+  });
+
+  it("masks bearer value", () => {
+    const out = redactSecrets({ bearer: "x" }) as Record<string, unknown>;
+    expect(out.bearer).toBe("[REDACTED]");
+  });
+
+  it("masks apiKey value", () => {
+    const out = redactSecrets({ apiKey: "k" }) as Record<string, unknown>;
+    expect(out.apiKey).toBe("[REDACTED]");
+  });
+
+  it("masks api_key value (snake)", () => {
+    const out = redactSecrets({ api_key: "k" }) as Record<string, unknown>;
+    expect(out.api_key).toBe("[REDACTED]");
+  });
+
+  it("masks api-key value (kebab)", () => {
+    const out = redactSecrets({ "api-key": "k" }) as Record<string, unknown>;
+    expect(out["api-key"]).toBe("[REDACTED]");
+  });
+
+  it("masks secret value", () => {
+    const out = redactSecrets({ secret: "s" }) as Record<string, unknown>;
+    expect(out.secret).toBe("[REDACTED]");
+  });
+
+  it("masks password value", () => {
+    const out = redactSecrets({ password: "p" }) as Record<string, unknown>;
+    expect(out.password).toBe("[REDACTED]");
+  });
+
+  it("masks x-api-key value", () => {
+    const out = redactSecrets({ "x-api-key": "k" }) as Record<string, unknown>;
+    expect(out["x-api-key"]).toBe("[REDACTED]");
+  });
+
+  it("masks nested secret key inside an inner object", () => {
+    const input = { outer: { Authorization: "Bearer abc", keep: "yes" } };
+    const out = redactSecrets(input) as { outer: { Authorization: string; keep: string } };
+    expect(out.outer.Authorization).toBe("[REDACTED]");
+    expect(out.outer.keep).toBe("yes");
+  });
+
+  it("masks secret key inside an array element", () => {
+    const input = [{ token: "t", label: "a" }, { keep: "b" }];
+    const out = redactSecrets(input) as Array<Record<string, unknown>>;
+    expect(out[0]!.token).toBe("[REDACTED]");
+    expect(out[0]!.label).toBe("a");
+    expect(out[1]!.keep).toBe("b");
+  });
+});
+
+describe("redactSecrets — known-secret substring replacement (AC-2)", () => {
+  it("replaces every occurrence of a supplied secret in a string", () => {
+    const out = redactSecrets("a abc123 b abc123 c", { secrets: ["abc123"] });
+    expect(out).toBe(`a ${REDACTED} b ${REDACTED} c`);
+  });
+
+  it("replaces the supplied secret inside an array of strings", () => {
+    const out = redactSecrets(["abc123", "x abc123 y", "z"], {
+      secrets: ["abc123"],
+    }) as string[];
+    expect(out).toEqual(["[REDACTED]", `x ${REDACTED} y`, "z"]);
+  });
+
+  it("replaces the supplied secret inside a nested object string value", () => {
+    const input = { outer: { msg: "abc123 here" } };
+    const out = redactSecrets(input, { secrets: ["abc123"] }) as {
+      outer: { msg: string };
+    };
+    expect(out.outer.msg).toBe(`${REDACTED} here`);
+  });
+
+  it("ignores an empty-string secret entry and returns the string unchanged", () => {
+    const out = redactSecrets("nothing changed", { secrets: [""] });
+    expect(out).toBe("nothing changed");
+  });
+});
+
+describe("redactSecrets — preservation and no mutation (AC-3)", () => {
+  it("preserves non-secret keys and values by value", () => {
+    const input = { a: 1, nested: { b: "two", list: [1, 2] } };
+    const out = redactSecrets(input) as Record<string, unknown>;
+    expect(out.a).toBe(1);
+    expect(out.nested).toEqual({ b: "two", list: [1, 2] });
+  });
+
+  it("does not mutate the input object", () => {
+    const input = { Authorization: "Bearer abc", keep: "yes" };
+    const frozen = { Authorization: "Bearer abc", keep: "yes" };
+    redactSecrets(input);
+    expect(input).toEqual(frozen);
+  });
+
+  it("returns a different object than the input", () => {
+    const input = { a: 1 };
+    const out = redactSecrets(input);
+    expect(out).not.toBe(input);
+  });
+});
+
+describe("redactSecrets — never throws (AC-4)", () => {
+  it("returns a number primitive unchanged", () => {
+    expect(redactSecrets(42)).toBe(42);
+  });
+
+  it("returns a string with no configured secret unchanged", () => {
+    expect(redactSecrets("hi")).toBe("hi");
+  });
+
+  it("returns null unchanged", () => {
+    expect(redactSecrets(null)).toBe(null);
+  });
+
+  it("returns undefined unchanged", () => {
+    expect(redactSecrets(undefined)).toBe(undefined);
+  });
+
+  it("returns an array of primitives by value", () => {
+    expect(redactSecrets([1, 2, 3])).toEqual([1, 2, 3]);
+  });
+
+  it("returns a self-referential object with a Circular marker and does not throw", () => {
+    const a: { self?: unknown } = {};
+    a.self = a;
+    const out = redactSecrets(a) as { self: string };
+    expect(out.self).toBe("[Circular]");
+  });
+
+  it("returns a self-referential array with a Circular marker and does not throw", () => {
+    const a: unknown[] = [];
+    a.push(a);
+    const out = redactSecrets(a) as string[];
+    expect(out).toEqual(["[Circular]"]);
+  });
+});