thuban 0.3.3 → 0.3.4

package/packages/scanner/secret-scanner.test.js

@@ -1,103 +0,0 @@
-const test = require('node:test');
-const assert = require('node:assert/strict');
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-const { execFileSync } = require('child_process');
-const SecretScanner = require('./secret-scanner');
-
-function createTempRepo() {
-  const rootPath = fs.mkdtempSync(path.join(os.tmpdir(), 'thuban-secret-scanner-'));
-  execFileSync('git', ['init'], { cwd: rootPath, stdio: 'ignore' });
-  execFileSync('git', ['config', 'user.email', 'test@example.com'], { cwd: rootPath, stdio: 'ignore' });
-  execFileSync('git', ['config', 'user.name', 'Test User'], { cwd: rootPath, stdio: 'ignore' });
-  return rootPath;
-}
-
-test('detects hardcoded secrets, .env exposure, and history leaks', async () => {
-  const rootPath = createTempRepo();
-
-  fs.writeFileSync(path.join(rootPath, '.gitignore'), 'node_modules/\n');
-  fs.writeFileSync(
-    path.join(rootPath, 'config.js'),
-    [
-      'const stripe = "sk_live_1234567890abcdefghijklmnop";',
-      'const password = "SuperSecret123!";',
-      'const token = "Bearer abcdefghijklmnopqrstuvwxyz123456";',
-      'const db = "postgres://appuser:dbpassword@localhost:5432/app";'
-    ].join('\n')
-  );
-  fs.writeFileSync(path.join(rootPath, '.env'), 'API_KEY=AIzaSyA123456789012345678901234567890123\n');
-
-  execFileSync('git', ['add', '.'], { cwd: rootPath, stdio: 'ignore' });
-  execFileSync('git', ['commit', '-m', 'initial'], { cwd: rootPath, stdio: 'ignore' });
-
-  fs.writeFileSync(path.join(rootPath, 'removed.js'), 'const oldKey = "ghp_abcdefghijklmnopqrstuvwxyz123456";\n');
-  execFileSync('git', ['add', 'removed.js'], { cwd: rootPath, stdio: 'ignore' });
-  execFileSync('git', ['commit', '-m', 'add leaked token'], { cwd: rootPath, stdio: 'ignore' });
-  fs.unlinkSync(path.join(rootPath, 'removed.js'));
-  execFileSync('git', ['add', '-A'], { cwd: rootPath, stdio: 'ignore' });
-  execFileSync('git', ['commit', '-m', 'remove leaked token'], { cwd: rootPath, stdio: 'ignore' });
-
-  const scanner = new SecretScanner({ rootPath });
-  const result = await scanner.scanAll();
-
-  assert.ok(result.issues.some((issue) => issue.type === 'Stripe Secret Key'));
-  assert.ok(result.issues.some((issue) => issue.type === 'Hardcoded Password or Secret Assignment'));
-  assert.ok(result.issues.some((issue) => issue.type === 'Database Connection String with Password'));
-  assert.ok(result.issues.some((issue) => issue.type === '.env File Present'));
-  assert.ok(result.issues.some((issue) => issue.type.includes('Git History')));
-  assert.ok(result.summary.bySeverity.critical >= 1);
-});
-
-test('does not flag gitignored env files as exposure issues', async () => {
-  const rootPath = createTempRepo();
-
-  fs.writeFileSync(path.join(rootPath, '.gitignore'), '.env\n');
-  fs.writeFileSync(path.join(rootPath, '.env'), 'TOKEN=example-value\n');
-
-  const scanner = new SecretScanner({ rootPath, includeGitHistory: false });
-  const issues = await scanner.scanFile(path.join(rootPath, '.env'));
-
-  assert.equal(issues.some((issue) => issue.type === '.env File Present'), false);
-});
-
-test('ignores placeholders, examples, tests, and virtualenv noise while catching modern keys', async () => {
-  const rootPath = createTempRepo();
-
-  fs.writeFileSync(path.join(rootPath, '.gitignore'), '.env.local\n');
-  fs.mkdirSync(path.join(rootPath, 'apps', 'api', 'tests'), { recursive: true });
-  fs.mkdirSync(path.join(rootPath, 'apps', 'web'), { recursive: true });
-  fs.mkdirSync(path.join(rootPath, '.venv', 'Lib', 'site-packages'), { recursive: true });
-
-  fs.writeFileSync(
-    path.join(rootPath, 'apps', 'api', 'tests', 'auth.test.js'),
-    'const header = "Bearer local-dev-token";\n'
-  );
-  fs.writeFileSync(
-    path.join(rootPath, 'apps', 'web', '.env.example'),
-    'CLERK_SECRET_KEY=sk_test_replace_me\nNEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_test_replace_me\n'
-  );
-  fs.writeFileSync(
-    path.join(rootPath, '.venv', 'Lib', 'site-packages', 'pkg.py'),
-    'TOKEN = "hf_94wBhPGp6KrrTH3KDchhKpRxZwd6dmHWLL"\n'
-  );
-  fs.writeFileSync(
-    path.join(rootPath, '.env.local'),
-    [
-      'OPENAI_API_KEY=sk-proj-abcdefghijklmnopqrstuvwxyzABCDE123456789',
-      'CARTESIA_API_KEY=sk_car_LbvdTSQmrEYgi5KCHN3C6m',
-      'LIVEKIT_API_SECRET=M06JDMQfH0ZsfzFYmxgu1OnqhiSOHQJfH8jcn4kkcgmA'
-    ].join('\n')
-  );
-
-  const scanner = new SecretScanner({ rootPath, includeGitHistory: false });
-  const result = await scanner.scanAll();
-
-  assert.ok(result.issues.some((issue) => issue.type === 'OpenAI Project Key'));
-  assert.ok(result.issues.some((issue) => issue.type === 'Cartesia API Key'));
-  assert.ok(result.issues.some((issue) => issue.type === 'LiveKit API Secret'));
-  assert.equal(result.issues.some((issue) => issue.code.includes('local-dev-token')), false);
-  assert.equal(result.issues.some((issue) => issue.type === '.env File Present' && issue.file.includes('.env.example')), false);
-  assert.equal(result.issues.some((issue) => issue.file.includes('.venv')), false);
-});