deepdebug-local-agent 1.1.0 → 1.2.0

package/test/dlp/index.test.js

@@ -0,0 +1,166 @@
+import { test, describe, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+    protectEgress, protectEgressAsync, protectDeep, dlpConfigFromEnv, getDlpStats, resetDlpStats,
+    DENIED, rulesetHash, RULESET_VERSION,
+} from '../../src/dlp/index.js';
+import { IncidentForwarder } from '../../src/siblings/incident-forwarder.js';
+import { POSITIVES } from './fixtures.js';
+
+const GH = POSITIVES.find(([id]) => id === 'github_token')[1];
+const KEY = POSITIVES.find(([id]) => id === 'pem_private_key')[1];
+const env = (mode, extra = {}) => ({ LOCAL_AGENT_DLP_MODE: mode, ...extra });
+
+beforeEach(() => resetDlpStats());
+
+describe('config', () => {
+    test('default is off', () => {
+        assert.equal(dlpConfigFromEnv({}).mode, 'off');
+        assert.deepEqual(dlpConfigFromEnv({}).blockClasses, []);
+    });
+    test('parses mode, block classes (unknown ignored) and max bytes', () => {
+        const c = dlpConfigFromEnv(env('enforce', { LOCAL_AGENT_DLP_BLOCK_CLASSES: 'private-key, nope ,cloud-credential', LOCAL_AGENT_DLP_MAX_BYTES: '1000' }));
+        assert.equal(c.mode, 'enforce');
+        assert.deepEqual(c.blockClasses, ['private-key', 'cloud-credential']);
+        assert.equal(c.maxBytes, 1000);
+        assert.equal(dlpConfigFromEnv(env('enforce', { LOCAL_AGENT_DLP_MAX_BYTES: 'x' })).maxBytes, 2_000_000);
+    });
+});
+
+describe('protectEgress', () => {
+    test('off (default): identical output and no counters', () => {
+        const r = protectEgress(GH, { env: {} });
+        assert.equal(r.text, GH);
+        assert.equal(getDlpStats({}).scanned, 0);
+    });
+    test('warn: identical output, counters move', () => {
+        const r = protectEgress(GH, { env: env('warn') });
+        assert.equal(r.text, GH);
+        assert.equal(r.total, 1);
+        assert.equal(getDlpStats(env('warn')).dlp_redactions_total.github_token, 1);
+    });
+    test('enforce: redacted, stats by rule, local log has counts but not the value', () => {
+        const logs = [];
+        const r = protectEgress(`x ${GH}`, { env: env('enforce'), source: 'unit', log: (o, m) => logs.push([o, m]) });
+        assert.equal(r.text, 'x [REDACTED:github_token]');
+        assert.equal(logs.length, 1);
+        assert.deepEqual(logs[0][0].rules, { github_token: 1 });
+        assert.ok(!JSON.stringify(logs).includes(GH));
+        const stats = getDlpStats(env('enforce'));
+        assert.equal(stats.mode, 'enforce');
+        assert.equal(stats.ruleset_version, RULESET_VERSION);
+        assert.equal(stats.ruleset_hash, rulesetHash());
+        assert.deepEqual(stats.dlp_redactions_total, { github_token: 1 });
+        assert.ok(!JSON.stringify(stats).includes(GH));
+    });
+    test('clean text produces no log record', () => {
+        let called = 0;
+        protectEgress('hello world', { env: env('enforce'), log: () => { called++; } });
+        assert.equal(called, 0);
+    });
+    test('a throwing logger never breaks the data path', () => {
+        const r = protectEgress(GH, { env: env('enforce'), log: () => { throw new Error('boom'); } });
+        assert.equal(r.text, '[REDACTED:github_token]');
+    });
+    test('block class withholds everything and counts', () => {
+        const r = protectEgress(`a ${KEY} b`, { env: env('enforce', { LOCAL_AGENT_DLP_BLOCK_CLASSES: 'private-key' }) });
+        assert.equal(r.text, '[BLOCKED:private-key]');
+        assert.equal(r.blocked, true);
+        assert.equal(getDlpStats(env('enforce')).blocked, 1);
+    });
+    test('oversize fails closed in enforce', () => {
+        const r = protectEgress('a'.repeat(200), { env: env('enforce', { LOCAL_AGENT_DLP_MAX_BYTES: '100' }) });
+        assert.equal(r.text, '[REDACTED:dlp_oversize]');
+    });
+});
+
+describe('protectEgressAsync (PolicyGate, D19)', () => {
+    test('enforce without policyDecision just masks', async () => {
+        const r = await protectEgressAsync(GH, { env: env('enforce') });
+        assert.equal(r.text, '[REDACTED:github_token]');
+    });
+    test('ALLOW lets masked content out', async () => {
+        const r = await protectEgressAsync(`x ${GH}`, { env: env('enforce'), policyDecision: async () => 'ALLOW' });
+        assert.equal(r.text, 'x [REDACTED:github_token]');
+        assert.equal(r.denied, false);
+    });
+    for (const [name, fn] of [
+        ['DENY', async () => 'DENY'],
+        ['unknown answer', async () => 'MAYBE'],
+        ['undefined (no answer)', async () => undefined],
+        ['offline (throws)', async () => { throw new Error('ECONNREFUSED'); }],
+        ['sync throw', () => { throw new Error('x'); }],
+    ]) {
+        test(`${name} = DENY`, async () => {
+            const r = await protectEgressAsync('clean text', { env: env('enforce'), policyDecision: fn });
+            assert.equal(r.text, DENIED);
+            assert.equal(r.denied, true);
+        });
+    }
+    test('timeout = DENY', async () => {
+        const r = await protectEgressAsync('clean', { env: env('enforce'), timeoutMs: 20, policyDecision: () => new Promise(() => {}) });
+        assert.equal(r.denied, true);
+    });
+    test('policyDecision is ignored when the flag is off or warn', async () => {
+        for (const m of ['off', 'warn']) {
+            const r = await protectEgressAsync('clean', { env: env(m), policyDecision: async () => 'DENY' });
+            assert.equal(r.text, 'clean');
+            assert.equal(r.denied, false);
+        }
+    });
+});
+
+describe('protectDeep', () => {
+    test('off returns the same reference', () => {
+        const v = { a: GH };
+        assert.equal(protectDeep(v, { env: {} }).value, v);
+    });
+    test('enforce masks nested payloads', () => {
+        const r = protectDeep({ a: [GH], b: { c: 'ok' } }, { env: env('enforce') });
+        assert.deepEqual(r.value, { a: ['[REDACTED:github_token]'], b: { c: 'ok' } });
+        assert.equal(getDlpStats(env('enforce')).dlp_redactions_total.github_token, 1);
+    });
+});
+
+describe('integration: incident forwarder (log excerpts leaving the network)', () => {
+    const NOOP_LOGGER = { info() {}, warn() {}, error() {}, debug() {} };
+    const evt = (message) => ({ adapter: 'sap', errorCode: 'E1', file: '/logs/a', message, source: 'svc', timestamp: '2026-10-28T10:00:00Z' });
+    const prev = process.env.LOCAL_AGENT_DLP_MODE;
+    const restore = () => { if (prev === undefined) delete process.env.LOCAL_AGENT_DLP_MODE; else process.env.LOCAL_AGENT_DLP_MODE = prev; };
+
+    async function sendOne(message) {
+        const bodies = [];
+        const f = new IncidentForwarder({
+            logger: NOOP_LOGGER,
+            suppressor: { shouldSuppress: () => false },
+            fetchImpl: async (_u, init) => { bodies.push(JSON.parse(init.body)); return { ok: true, status: 200 }; },
+        });
+        f.configure({ gatewayUrl: 'http://gw.invalid', apiKey: 'k', tenantId: 't' });
+        f.handleAdapterEvent(evt(message), 'sap');
+        await f.flush();
+        return bodies[0];
+    }
+
+    test('flag off: payload is byte-identical to the original message', async () => {
+        delete process.env.LOCAL_AGENT_DLP_MODE;
+        try {
+            const body = await sendOne(`login failed token=${GH} user maria@acme-corp.pt`);
+            assert.equal(body.message, `login failed token=${GH} user maria@acme-corp.pt`);
+        } finally { restore(); }
+    });
+    test('enforce: secrets and e-mails are masked before the POST', async () => {
+        process.env.LOCAL_AGENT_DLP_MODE = 'enforce';
+        try {
+            const body = await sendOne(`login failed ${GH} user maria@acme-corp.pt`);
+            assert.equal(body.message, 'login failed [REDACTED:github_token] user [REDACTED:email]');
+            assert.equal(body.service, 'svc');
+        } finally { restore(); }
+    });
+    test('warn: payload unchanged', async () => {
+        process.env.LOCAL_AGENT_DLP_MODE = 'warn';
+        try {
+            const body = await sendOne(`x ${GH}`);
+            assert.equal(body.message, `x ${GH}`);
+        } finally { restore(); }
+    });
+});

package/test/next-version.test.js

@@ -0,0 +1,48 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { classify, bumpFor, nextVersion } from '../scripts/next-version.mjs'
+
+test('fix and other non-feature types are a patch', () => {
+  for (const s of ['fix: handle empty body', 'fix(ci): x', 'chore: tidy', 'docs: readme', 'ci: workflow', 'perf: faster', 'refactor: split', 'Update thing']) {
+    assert.equal(classify(s), 'patch', s)
+  }
+})
+
+test('feat is a minor', () => {
+  assert.equal(classify('feat: add DLP masking'), 'minor')
+  assert.equal(classify('feat(ws): metadata only channel'), 'minor')
+})
+
+test('breaking changes are a major, by "!" or by footer', () => {
+  assert.equal(classify('feat!: drop node 18'), 'major')
+  assert.equal(classify('fix(api)!: rename endpoint'), 'major')
+  assert.equal(classify('fix: x\n\nBREAKING CHANGE: signature enforce is mandatory'), 'major')
+  assert.equal(classify('chore: y\n\nBREAKING-CHANGE: z'), 'major')
+})
+
+test('auto-bump and merge commits are ignored', () => {
+  assert.equal(classify('ci: auto bump to 1.1.0 [skip ci]'), null)
+  assert.equal(classify('Merge pull request #55 from x/y'), null)
+  assert.equal(classify(''), null)
+})
+
+test('the highest level wins', () => {
+  assert.equal(bumpFor(['fix: a', 'fix: b']), 'patch')
+  assert.equal(bumpFor(['fix: a', 'feat: b', 'chore: c']), 'minor')
+  assert.equal(bumpFor(['feat: a', 'fix!: b', 'fix: c']), 'major')
+  assert.equal(bumpFor([]), 'patch')
+  assert.equal(bumpFor(['ci: auto bump to 1.2.0 [skip ci]']), 'patch')
+})
+
+test('a footer that is not at the start of a line is not breaking', () => {
+  assert.equal(classify('fix: mention BREAKING CHANGE: in prose'), 'patch')
+})
+
+test('nextVersion resets the lower levels', () => {
+  assert.equal(nextVersion('1.1.0', 'patch'), '1.1.1')
+  assert.equal(nextVersion('1.1.7', 'minor'), '1.2.0')
+  assert.equal(nextVersion('1.9.4', 'major'), '2.0.0')
+  assert.equal(nextVersion('0.0.1', 'minor'), '0.1.0')
+  assert.throws(() => nextVersion('1.1', 'patch'))
+  assert.throws(() => nextVersion('1.x.0', 'patch'))
+})