qa360 2.1.7 → 2.2.0

package/core/src/__tests__/secrets/crypto.test.ts

@@ -0,0 +1,190 @@
+/**
+ * Secrets Crypto Tests
+ */
+
+import { SecretsCrypto, SecretEntry } from '../../secrets/crypto';
+
+describe('SecretsCrypto', () => {
+  const testPassword = 'test-password-123';
+  const testSecrets: Record<string, SecretEntry> = {
+    API_TOKEN: {
+      name: 'API_TOKEN',
+      value: 'sk-1234567890abcdef1234567890abcdef',
+      createdAt: '2025-01-01T00:00:00.000Z',
+      updatedAt: '2025-01-01T00:00:00.000Z'
+    },
+    DATABASE_URL: {
+      name: 'DATABASE_URL',
+      value: 'postgresql://user:pass@localhost:5432/db',
+      createdAt: '2025-01-01T00:00:00.000Z',
+      updatedAt: '2025-01-01T00:00:00.000Z'
+    }
+  };
+
+  describe('encryption and decryption', () => {
+    it('should encrypt and decrypt secrets correctly', () => {
+      const encrypted = SecretsCrypto.encrypt(testSecrets, testPassword);
+      
+      expect(encrypted.version).toBe('1.0.0');
+      expect(encrypted.encrypted.algorithm).toBe('aes-256-gcm');
+      expect(encrypted.encrypted.iterations).toBe(100000);
+      expect(encrypted.checksum).toBeDefined();
+      
+      const decrypted = SecretsCrypto.decrypt(encrypted, testPassword);
+      
+      expect(decrypted).toEqual(testSecrets);
+    });
+
+    it('should fail with wrong password', () => {
+      const encrypted = SecretsCrypto.encrypt(testSecrets, testPassword);
+      
+      expect(() => {
+        SecretsCrypto.decrypt(encrypted, 'wrong-password');
+      }).toThrow(/Invalid password or corrupted secrets store|Decryption failed/);
+    });
+
+    it('should fail with corrupted data', () => {
+      const encrypted = SecretsCrypto.encrypt(testSecrets, testPassword);
+      
+      // Corrupt the encrypted data
+      encrypted.encrypted.data = 'corrupted-data';
+      
+      expect(() => {
+        SecretsCrypto.decrypt(encrypted, testPassword);
+      }).toThrow();
+    });
+
+    it('should fail with wrong checksum', () => {
+      const encrypted = SecretsCrypto.encrypt(testSecrets, testPassword);
+      
+      // Corrupt the checksum
+      encrypted.checksum = 'wrong-checksum';
+      
+      expect(() => {
+        SecretsCrypto.decrypt(encrypted, testPassword);
+      }).toThrow('Secrets store integrity check failed');
+    });
+  });
+
+  describe('password generation', () => {
+    it('should generate password of correct length', () => {
+      const password = SecretsCrypto.generatePassword(32);
+      
+      expect(password).toHaveLength(32);
+      expect(typeof password).toBe('string');
+    });
+
+    it('should generate different passwords', () => {
+      const password1 = SecretsCrypto.generatePassword();
+      const password2 = SecretsCrypto.generatePassword();
+      
+      expect(password1).not.toBe(password2);
+    });
+
+    it('should generate password with mixed characters', () => {
+      const password = SecretsCrypto.generatePassword(100);
+      
+      // Should contain letters, numbers, and special chars
+      expect(/[a-z]/.test(password)).toBe(true);
+      expect(/[A-Z]/.test(password)).toBe(true);
+      expect(/[0-9]/.test(password)).toBe(true);
+      expect(/[!@#$%^&*]/.test(password)).toBe(true);
+    });
+  });
+
+  describe('secret redaction', () => {
+    it('should redact short secrets', () => {
+      const redacted = SecretsCrypto.redactSecret('abc');
+      expect(redacted).toBe('***');
+    });
+
+    it('should redact long secrets with prefix/suffix', () => {
+      const secret = 'sk-1234567890abcdef1234567890abcdef';
+      const redacted = SecretsCrypto.redactSecret(secret);
+      
+      expect(redacted).toBe('sk-***def');
+      expect(redacted).not.toContain('1234567890abcdef');
+    });
+
+    it('should redact medium secrets', () => {
+      const secret = 'password123';
+      const redacted = SecretsCrypto.redactSecret(secret);
+      
+      expect(redacted).toBe('pas***123');
+    });
+  });
+
+  describe('secret detection', () => {
+    it('should detect base64-like secrets', () => {
+      expect(SecretsCrypto.looksLikeSecret('YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXo=')).toBe(true);
+      expect(SecretsCrypto.looksLikeSecret('dGVzdC1zZWNyZXQtdmFsdWUtbG9uZy1lbm91Z2g=')).toBe(true);
+    });
+
+    it('should detect hex tokens', () => {
+      expect(SecretsCrypto.looksLikeSecret('1234567890abcdef1234567890abcdef')).toBe(true);
+      expect(SecretsCrypto.looksLikeSecret('ABCDEF1234567890ABCDEF1234567890')).toBe(true);
+    });
+
+    it('should detect API key patterns', () => {
+      expect(SecretsCrypto.looksLikeSecret('sk-1234567890abcdef1234567890abcdef')).toBe(true);
+      expect(SecretsCrypto.looksLikeSecret('ghp_1234567890abcdef1234567890abcdef123456')).toBe(true);
+      expect(SecretsCrypto.looksLikeSecret('xoxb-1234567890-1234567890-abcdefghijk')).toBe(true);
+    });
+
+    it('should not detect normal text', () => {
+      expect(SecretsCrypto.looksLikeSecret('hello world')).toBe(false);
+      expect(SecretsCrypto.looksLikeSecret('test')).toBe(false);
+      expect(SecretsCrypto.looksLikeSecret('123')).toBe(false);
+      expect(SecretsCrypto.looksLikeSecret('production')).toBe(false);
+    });
+
+    it('should not detect short strings', () => {
+      expect(SecretsCrypto.looksLikeSecret('abc')).toBe(false);
+      expect(SecretsCrypto.looksLikeSecret('1234')).toBe(false);
+    });
+  });
+
+  describe('empty secrets handling', () => {
+    it('should handle empty secrets object', () => {
+      const emptySecrets = {};
+      const encrypted = SecretsCrypto.encrypt(emptySecrets, testPassword);
+      const decrypted = SecretsCrypto.decrypt(encrypted, testPassword);
+      
+      expect(decrypted).toEqual({});
+    });
+  });
+
+  describe('special characters in secrets', () => {
+    it('should handle secrets with special characters', () => {
+      const specialSecrets = {
+        COMPLEX_SECRET: {
+          name: 'COMPLEX_SECRET',
+          value: 'secret!@#$%^&*()_+-={}[]|\\:";\'<>?,./',
+          createdAt: '2025-01-01T00:00:00.000Z',
+          updatedAt: '2025-01-01T00:00:00.000Z'
+        }
+      };
+      
+      const encrypted = SecretsCrypto.encrypt(specialSecrets, testPassword);
+      const decrypted = SecretsCrypto.decrypt(encrypted, testPassword);
+      
+      expect(decrypted).toEqual(specialSecrets);
+    });
+
+    it('should handle unicode secrets', () => {
+      const unicodeSecrets = {
+        UNICODE_SECRET: {
+          name: 'UNICODE_SECRET',
+          value: 'sécret-with-ñ-and-中文-and-🔐',
+          createdAt: '2025-01-01T00:00:00.000Z',
+          updatedAt: '2025-01-01T00:00:00.000Z'
+        }
+      };
+      
+      const encrypted = SecretsCrypto.encrypt(unicodeSecrets, testPassword);
+      const decrypted = SecretsCrypto.decrypt(encrypted, testPassword);
+      
+      expect(decrypted).toEqual(unicodeSecrets);
+    });
+  });
+});

package/core/src/__tests__/secrets/manager.test.ts

@@ -0,0 +1,316 @@
+/**
+ * Secrets Manager Tests
+ */
+
+import { SecretsManager } from '../../secrets/manager';
+import { existsSync, mkdirSync, rmSync, writeFileSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+
+describe('SecretsManager', () => {
+  let testDir: string;
+  let manager: SecretsManager;
+
+  beforeEach(() => {
+    // Create temporary test directory
+    testDir = join(tmpdir(), `qa360-test-${Date.now()}`);
+    mkdirSync(testDir, { recursive: true });
+    
+    manager = new SecretsManager({ 
+      qa360Dir: testDir,
+      password: 'test-password-123'
+    });
+  });
+
+  afterEach(() => {
+    // Cleanup test directory
+    if (existsSync(testDir)) {
+      rmSync(testDir, { recursive: true, force: true });
+    }
+  });
+
+  describe('secret management', () => {
+    it('should add and retrieve secrets', async () => {
+      await manager.initialize();
+      
+      await manager.addSecret('API_TOKEN', 'sk-test123');
+      const value = await manager.getSecret('API_TOKEN');
+      
+      expect(value).toBe('sk-test123');
+    });
+
+    it('should return null for non-existent secret', async () => {
+      await manager.initialize();
+      
+      const value = await manager.getSecret('NON_EXISTENT');
+      
+      expect(value).toBeNull();
+    });
+
+    it('should update existing secret', async () => {
+      await manager.initialize();
+      
+      await manager.addSecret('API_TOKEN', 'old-value');
+      await manager.addSecret('API_TOKEN', 'new-value');
+      
+      const value = await manager.getSecret('API_TOKEN');
+      expect(value).toBe('new-value');
+    });
+
+    it('should remove secrets', async () => {
+      await manager.initialize();
+      
+      await manager.addSecret('API_TOKEN', 'sk-test123');
+      const removed = await manager.removeSecret('API_TOKEN');
+      
+      expect(removed).toBe(true);
+      
+      const value = await manager.getSecret('API_TOKEN');
+      expect(value).toBeNull();
+    });
+
+    it('should return false when removing non-existent secret', async () => {
+      await manager.initialize();
+      
+      const removed = await manager.removeSecret('NON_EXISTENT');
+      
+      expect(removed).toBe(false);
+    });
+  });
+
+  describe('secret listing', () => {
+    it('should list secrets with metadata', async () => {
+      await manager.initialize();
+      
+      await manager.addSecret('API_TOKEN', 'sk-test123');
+      await manager.addSecret('DATABASE_URL', 'postgresql://...');
+      
+      const secrets = await manager.listSecrets();
+      
+      expect(secrets).toHaveLength(2);
+      expect(secrets.map(s => s.name)).toContain('API_TOKEN');
+      expect(secrets.map(s => s.name)).toContain('DATABASE_URL');
+      
+      secrets.forEach(secret => {
+        expect(secret.createdAt).toBeDefined();
+        expect(secret.updatedAt).toBeDefined();
+        expect(new Date(secret.createdAt)).toBeInstanceOf(Date);
+        expect(new Date(secret.updatedAt)).toBeInstanceOf(Date);
+      });
+    });
+
+    it('should return empty list when no secrets', async () => {
+      await manager.initialize();
+      
+      const secrets = await manager.listSecrets();
+      
+      expect(secrets).toHaveLength(0);
+    });
+  });
+
+  describe('secret name validation', () => {
+    it('should accept valid secret names', async () => {
+      await manager.initialize();
+      
+      await expect(manager.addSecret('API_TOKEN', 'value')).resolves.not.toThrow();
+      await expect(manager.addSecret('DATABASE_URL', 'value')).resolves.not.toThrow();
+      await expect(manager.addSecret('OAUTH_CLIENT_SECRET', 'value')).resolves.not.toThrow();
+      await expect(manager.addSecret('_PRIVATE_KEY', 'value')).resolves.not.toThrow();
+    });
+
+    it('should reject invalid secret names', async () => {
+      await manager.initialize();
+      
+      await expect(manager.addSecret('api-token', 'value')).rejects.toThrow('uppercase with underscores');
+      await expect(manager.addSecret('123TOKEN', 'value')).rejects.toThrow('uppercase with underscores');
+      await expect(manager.addSecret('API TOKEN', 'value')).rejects.toThrow('uppercase with underscores');
+      await expect(manager.addSecret('api.token', 'value')).rejects.toThrow('uppercase with underscores');
+    });
+  });
+
+  describe('doctor functionality', () => {
+    it('should report healthy state when initialized', async () => {
+      await manager.initialize();
+      await manager.addSecret('API_TOKEN', 'sk-test123');
+      
+      const diagnosis = await manager.doctor();
+      
+      expect(diagnosis.exists).toBe(true);
+      expect(diagnosis.accessible).toBe(true);
+      expect(diagnosis.count).toBe(1);
+      expect(diagnosis.errors).toHaveLength(0);
+    });
+
+    it('should report missing file when no secrets exist', async () => {
+      await manager.initialize();
+      
+      const diagnosis = await manager.doctor();
+      
+      expect(diagnosis.exists).toBe(false);
+      expect(diagnosis.accessible).toBe(false);
+      expect(diagnosis.count).toBe(0);
+      expect(diagnosis.errors).toHaveLength(0);
+    });
+
+    it('should report errors when file is corrupted', async () => {
+      await manager.initialize();
+      
+      // Create corrupted secrets file
+      const secretsPath = join(testDir, 'secrets.enc');
+      writeFileSync(secretsPath, 'invalid-json-content');
+      
+      const diagnosis = await manager.doctor();
+      
+      expect(diagnosis.exists).toBe(true);
+      expect(diagnosis.accessible).toBe(false);
+      expect(diagnosis.errors.length).toBeGreaterThan(0);
+    });
+  });
+
+  describe('redacted export', () => {
+    it('should export secrets with redacted values', async () => {
+      await manager.initialize();
+      
+      await manager.addSecret('API_TOKEN', 'sk-1234567890abcdef1234567890abcdef');
+      await manager.addSecret('SHORT_SECRET', 'abc');
+      
+      const redacted = await manager.exportRedacted();
+      
+      expect(redacted['API_TOKEN']).toBe('sk-***def');
+      expect(redacted['SHORT_SECRET']).toBe('***');
+    });
+
+    it('should return empty object when no secrets', async () => {
+      await manager.initialize();
+      
+      const redacted = await manager.exportRedacted();
+      
+      expect(redacted).toEqual({});
+    });
+  });
+
+  describe('secret interpolation', () => {
+    beforeEach(async () => {
+      await manager.initialize();
+      await manager.addSecret('API_TOKEN', 'sk-test123');
+      await manager.addSecret('DATABASE_URL', 'postgresql://user:pass@localhost/db');
+    });
+
+    it('should interpolate single secret reference', async () => {
+      const text = 'Authorization: Bearer ${{ secrets.API_TOKEN }}';
+      const result = await manager.interpolateSecrets(text);
+      
+      expect(result).toBe('Authorization: Bearer sk-test123');
+    });
+
+    it('should interpolate multiple secret references', async () => {
+      const text = 'API_KEY=${{ secrets.API_TOKEN }} DB_URL=${{ secrets.DATABASE_URL }}';
+      const result = await manager.interpolateSecrets(text);
+      
+      expect(result).toBe('API_KEY=sk-test123 DB_URL=postgresql://user:pass@localhost/db');
+    });
+
+    it('should handle text without secret references', async () => {
+      const text = 'No secrets here';
+      const result = await manager.interpolateSecrets(text);
+      
+      expect(result).toBe('No secrets here');
+    });
+
+    it('should throw error for missing secret', async () => {
+      const text = 'Missing: ${{ secrets.NON_EXISTENT }}';
+      
+      await expect(manager.interpolateSecrets(text)).rejects.toThrow('Secret not found: NON_EXISTENT');
+    });
+
+    it('should handle whitespace in secret references', async () => {
+      const text = 'Token: ${{  secrets.API_TOKEN  }}';
+      const result = await manager.interpolateSecrets(text);
+      
+      expect(result).toBe('Token: sk-test123');
+    });
+  });
+
+  describe('secret reference finding', () => {
+    it('should find secret references in text', () => {
+      const text = 'API_KEY=${{ secrets.API_TOKEN }} DB_URL=${{ secrets.DATABASE_URL }}';
+      const references = manager.findSecretReferences(text);
+      
+      expect(references).toEqual(['API_TOKEN', 'DATABASE_URL']);
+    });
+
+    it('should return empty array when no references', () => {
+      const text = 'No secret references here';
+      const references = manager.findSecretReferences(text);
+      
+      expect(references).toEqual([]);
+    });
+
+    it('should handle duplicate references', () => {
+      const text = '${{ secrets.API_TOKEN }} and ${{ secrets.API_TOKEN }} again';
+      const references = manager.findSecretReferences(text);
+      
+      expect(references).toEqual(['API_TOKEN', 'API_TOKEN']);
+    });
+  });
+
+  describe('secret reference validation', () => {
+    beforeEach(async () => {
+      await manager.initialize();
+      await manager.addSecret('API_TOKEN', 'sk-test123');
+    });
+
+    it('should return empty array when all secrets exist', async () => {
+      const text = 'Token: ${{ secrets.API_TOKEN }}';
+      const missing = await manager.validateSecretReferences(text);
+      
+      expect(missing).toEqual([]);
+    });
+
+    it('should return missing secret names', async () => {
+      const text = 'Token: ${{ secrets.MISSING_TOKEN }} URL: ${{ secrets.API_TOKEN }}';
+      const missing = await manager.validateSecretReferences(text);
+      
+      expect(missing).toEqual(['MISSING_TOKEN']);
+    });
+
+    it('should handle text without references', async () => {
+      const text = 'No references here';
+      const missing = await manager.validateSecretReferences(text);
+      
+      expect(missing).toEqual([]);
+    });
+  });
+
+  describe('persistence and caching', () => {
+    it('should persist secrets across manager instances', async () => {
+      // First manager instance
+      await manager.initialize();
+      await manager.addSecret('API_TOKEN', 'sk-test123');
+      
+      // Second manager instance with same directory
+      const manager2 = new SecretsManager({ 
+        qa360Dir: testDir,
+        password: 'test-password-123'
+      });
+      await manager2.initialize();
+      
+      const value = await manager2.getSecret('API_TOKEN');
+      expect(value).toBe('sk-test123');
+    });
+
+    it('should cache secrets for performance', async () => {
+      await manager.initialize();
+      await manager.addSecret('API_TOKEN', 'sk-test123');
+      
+      // First access loads from file
+      const value1 = await manager.getSecret('API_TOKEN');
+      
+      // Second access should use cache
+      const value2 = await manager.getSecret('API_TOKEN');
+      
+      expect(value1).toBe(value2);
+      expect(value1).toBe('sk-test123');
+    });
+  });
+});