thuban 0.3.1 → 0.3.3

package/packages/scanner/secret-scanner.test.js

@@ -0,0 +1,103 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFileSync } = require('child_process');
+const SecretScanner = require('./secret-scanner');
+
+function createTempRepo() {
+  const rootPath = fs.mkdtempSync(path.join(os.tmpdir(), 'thuban-secret-scanner-'));
+  execFileSync('git', ['init'], { cwd: rootPath, stdio: 'ignore' });
+  execFileSync('git', ['config', 'user.email', 'test@example.com'], { cwd: rootPath, stdio: 'ignore' });
+  execFileSync('git', ['config', 'user.name', 'Test User'], { cwd: rootPath, stdio: 'ignore' });
+  return rootPath;
+}
+
+test('detects hardcoded secrets, .env exposure, and history leaks', async () => {
+  const rootPath = createTempRepo();
+
+  fs.writeFileSync(path.join(rootPath, '.gitignore'), 'node_modules/\n');
+  fs.writeFileSync(
+    path.join(rootPath, 'config.js'),
+    [
+      'const stripe = "sk_live_1234567890abcdefghijklmnop";',
+      'const password = "SuperSecret123!";',
+      'const token = "Bearer abcdefghijklmnopqrstuvwxyz123456";',
+      'const db = "postgres://appuser:dbpassword@localhost:5432/app";'
+    ].join('\n')
+  );
+  fs.writeFileSync(path.join(rootPath, '.env'), 'API_KEY=AIzaSyA123456789012345678901234567890123\n');
+
+  execFileSync('git', ['add', '.'], { cwd: rootPath, stdio: 'ignore' });
+  execFileSync('git', ['commit', '-m', 'initial'], { cwd: rootPath, stdio: 'ignore' });
+
+  fs.writeFileSync(path.join(rootPath, 'removed.js'), 'const oldKey = "ghp_abcdefghijklmnopqrstuvwxyz123456";\n');
+  execFileSync('git', ['add', 'removed.js'], { cwd: rootPath, stdio: 'ignore' });
+  execFileSync('git', ['commit', '-m', 'add leaked token'], { cwd: rootPath, stdio: 'ignore' });
+  fs.unlinkSync(path.join(rootPath, 'removed.js'));
+  execFileSync('git', ['add', '-A'], { cwd: rootPath, stdio: 'ignore' });
+  execFileSync('git', ['commit', '-m', 'remove leaked token'], { cwd: rootPath, stdio: 'ignore' });
+
+  const scanner = new SecretScanner({ rootPath });
+  const result = await scanner.scanAll();
+
+  assert.ok(result.issues.some((issue) => issue.type === 'Stripe Secret Key'));
+  assert.ok(result.issues.some((issue) => issue.type === 'Hardcoded Password or Secret Assignment'));
+  assert.ok(result.issues.some((issue) => issue.type === 'Database Connection String with Password'));
+  assert.ok(result.issues.some((issue) => issue.type === '.env File Present'));
+  assert.ok(result.issues.some((issue) => issue.type.includes('Git History')));
+  assert.ok(result.summary.bySeverity.critical >= 1);
+});
+
+test('does not flag gitignored env files as exposure issues', async () => {
+  const rootPath = createTempRepo();
+
+  fs.writeFileSync(path.join(rootPath, '.gitignore'), '.env\n');
+  fs.writeFileSync(path.join(rootPath, '.env'), 'TOKEN=example-value\n');
+
+  const scanner = new SecretScanner({ rootPath, includeGitHistory: false });
+  const issues = await scanner.scanFile(path.join(rootPath, '.env'));
+
+  assert.equal(issues.some((issue) => issue.type === '.env File Present'), false);
+});
+
+test('ignores placeholders, examples, tests, and virtualenv noise while catching modern keys', async () => {
+  const rootPath = createTempRepo();
+
+  fs.writeFileSync(path.join(rootPath, '.gitignore'), '.env.local\n');
+  fs.mkdirSync(path.join(rootPath, 'apps', 'api', 'tests'), { recursive: true });
+  fs.mkdirSync(path.join(rootPath, 'apps', 'web'), { recursive: true });
+  fs.mkdirSync(path.join(rootPath, '.venv', 'Lib', 'site-packages'), { recursive: true });
+
+  fs.writeFileSync(
+    path.join(rootPath, 'apps', 'api', 'tests', 'auth.test.js'),
+    'const header = "Bearer local-dev-token";\n'
+  );
+  fs.writeFileSync(
+    path.join(rootPath, 'apps', 'web', '.env.example'),
+    'CLERK_SECRET_KEY=sk_test_replace_me\nNEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_test_replace_me\n'
+  );
+  fs.writeFileSync(
+    path.join(rootPath, '.venv', 'Lib', 'site-packages', 'pkg.py'),
+    'TOKEN = "hf_94wBhPGp6KrrTH3KDchhKpRxZwd6dmHWLL"\n'
+  );
+  fs.writeFileSync(
+    path.join(rootPath, '.env.local'),
+    [
+      'OPENAI_API_KEY=sk-proj-abcdefghijklmnopqrstuvwxyzABCDE123456789',
+      'CARTESIA_API_KEY=sk_car_LbvdTSQmrEYgi5KCHN3C6m',
+      'LIVEKIT_API_SECRET=M06JDMQfH0ZsfzFYmxgu1OnqhiSOHQJfH8jcn4kkcgmA'
+    ].join('\n')
+  );
+
+  const scanner = new SecretScanner({ rootPath, includeGitHistory: false });
+  const result = await scanner.scanAll();
+
+  assert.ok(result.issues.some((issue) => issue.type === 'OpenAI Project Key'));
+  assert.ok(result.issues.some((issue) => issue.type === 'Cartesia API Key'));
+  assert.ok(result.issues.some((issue) => issue.type === 'LiveKit API Secret'));
+  assert.equal(result.issues.some((issue) => issue.code.includes('local-dev-token')), false);
+  assert.equal(result.issues.some((issue) => issue.type === '.env File Present' && issue.file.includes('.env.example')), false);
+  assert.equal(result.issues.some((issue) => issue.file.includes('.venv')), false);
+});