cg-code-graph 0.21.0__tar.gz → 0.21.1__tar.gz

{cg_code_graph-0.21.0/cg_code_graph.egg-info → cg_code_graph-0.21.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cg-code-graph
-Version: 0.21.0
+Version: 0.21.1
 Summary: cg: a code graph of routes, calls, data access and platform boundaries for agents and humans (CLI + MCP server)
 Author: cyberchronos00
 License-Expression: MIT

{cg_code_graph-0.21.0 → cg_code_graph-0.21.1}/cg_code_graph/__init__.py

@@ -1,2 +1,2 @@
 """code-graph: deterministic code knowledge graph (beta)."""
-__version__ = "0.21.0"
+__version__ = "0.21.1"

{cg_code_graph-0.21.0 → cg_code_graph-0.21.1}/cg_code_graph/core/redact.py

@@ -1,7 +1,9 @@
 """Secret values never reach the graph database (#47).
 
-A literal that belongs to a credential-looking key (password, secret, token, key, api_key, auth, private, credential,
-passphrase, dsn, ...) is stored as `redacted:hmac:<first 8 hex of HMAC-SHA-256(graph salt, value)>`: enough to see that
+A literal that belongs to a credential-looking key (its last word is password, secret, dsn, ..., or an
+explicit compound such as api_key; a bare `key` / `token` counts unless a known non-secret word precedes it
+(`primary_key`, `cache.key`), whatever the value looks like; `AUTH_GUARD` or `..._TOKEN_TABLE`
+do not count) is stored as `redacted:hmac:<first 8 hex of HMAC-SHA-256(graph salt, value)>`: enough to see that
 a literal exists and to tell two values apart within one graph, not enough to recover one, and not recognisable by
 hashing a common password. The salt is `secrets.token_hex(16)`, created on the first index of a graph DB, kept in its
 `meta` table (`redact_salt`) and carried over by a re-index or refresh of that DB; a new DB gets a new salt, so markers
@@ -20,29 +22,52 @@ import secrets
 
 MARK = "redacted:hmac:"
 LEGACY_MARK = "redacted:sha256:"
-SECRET_WORDS = ("PASSWORD", "PASS", "PASSWD", "SECRET", "TOKEN", "SECRET_KEY", "SECRET_ACCESS_KEY", "KEY", "AUTH", "PWD")
-_EXTRA_WORDS = {"PASSWORD", "PASSWD", "PWD", "PASSPHRASE", "SECRET", "SECRETS", "TOKEN", "TOKENS", "AUTH", "AUTHORIZATION",
-                "CREDENTIAL", "CREDENTIALS", "PRIVATE", "APIKEY", "DSN", "BEARER", "SALT", "SIGNATURE"}
-_NOT_SECRET_TAIL = ("_KEY_ID", "_PUBLIC_KEY", "_KEY_PATH")
+_SECRET_LAST = {"password", "passwd", "pwd", "pass", "passphrase", "secret", "dsn"}
+_SECRET_COMPOUNDS = {("api", "key"), ("apikey",), ("access", "key"), ("secret", "key"), ("private", "key"),
+                     ("signing", "key"), ("encryption", "key"), ("client", "secret"), ("webhook", "secret"),
+                     ("auth", "token"), ("api", "token"), ("access", "token"), ("refresh", "token"), ("bearer", "token")}
+_BARE_LAST = {"key", "token"}
+SECRET_WORDS = tuple(sorted({w.upper() for w in _SECRET_LAST} | {"_".join(c).upper() for c in _SECRET_COMPOUNDS}
+                            | {w.upper() for w in _BARE_LAST}))
+_NON_SECRET_BEFORE = {"primary", "foreign", "sort", "partition", "route", "cache", "idempotency", "remember", "csrf",
+                      "xsrf", "public", "i18n", "translation", "lookup", "unique", "index", "storage", "prefix"}
 _URL_PW = re.compile(r"(?P<head>\b[A-Za-z][\w+.-]*://[^/\s:@'\"]*:)(?P<pw>[^@/\s'\"]+)(?P<tail>@)")
 _PLACEHOLDER = ("${", "{{", "%(", "<", "$")
 
 
-def secret_key(key: str) -> bool:
-    """The `cg surface` rule for a config key / env name that holds a credential."""
-    k = re.sub(r"[^A-Za-z0-9]+", "_", key).upper().strip("_")
-    return any(k.endswith("_" + s) or k == s for s in SECRET_WORDS) and not k.endswith(_NOT_SECRET_TAIL)
-
-
-def looks_secret(key: str) -> bool:
-    """Wider than `secret_key`: any word of the name says credential (private_key_pem, db_dsn, apiKey, auth_header)."""
-    if secret_key(key):
+def _words(segment: str) -> list[str]:
+    spaced = re.sub(r"([a-z])([A-Z])", r"\1_\2", segment)
+    return [w for w in re.split(r"[^A-Za-z0-9]+", spaced.lower()) if w]
+
+
+def secret_key(key: str, value=None) -> bool:
+    """Whether a config key / env name holds a credential, from the words of the name (split on `.`, `_`, `-` and
+    camelCase). A credential when the last word is password, passwd, pwd, pass, passphrase, secret or dsn, when the
+    name ends in an explicit compound (api_key, access_key, signing_key, client_secret, auth_token, refresh_token, ...),
+    or for Laravel's `app.key` / `APP_KEY`. A bare `key` or `token` as last word is a credential by default, as it
+    was in 0.21.0, and is kept only when the word before it (a dotted segment counts) is a known non-secret one
+    (primary, foreign, sort, partition, route, cache, idempotency, remember, csrf, xsrf, public, i18n, translation,
+    lookup, unique, index, storage, prefix). The value never decides: a token can be any shape (lowercase words,
+    dotted, `key-` prefixed), so `value` is accepted for the callers' signature only. A credential word earlier in the name never counts
+    (`AUTH_GUARD`, `AUTH_PASSWORD_BROKER`, `AUTH_PASSWORD_RESET_TOKEN_TABLE`, `try_it_credentials_policy`), and
+    `*_PUBLIC_KEY`, `*_KEY_ID`, `*_KEY_PATH`, `*_KEY_FILE` are not credentials."""
+    key = str(key)
+    words = _words(key.rsplit(".", 1)[-1])
+    if not words:
+        return False
+    all_words = _words(key)
+    if all_words == ["app", "key"]:
         return True
-    spaced = re.sub(r"([a-z0-9])([A-Z])", r"\1_\2", str(key))
-    words = [w for w in re.split(r"[^A-Za-z0-9]+", spaced.upper()) if w]
-    if any(w in _EXTRA_WORDS for w in words):
+    if words[-1] in _SECRET_LAST or any(tuple(words[-n:]) in _SECRET_COMPOUNDS for n in (1, 2) if len(words) >= n):
         return True
-    return "KEY" in words and not set(words) & {"PUBLIC", "ID", "PATH", "FILE", "NAME", "PREFIX", "TYPE", "SIZE", "LENGTH"}
+    if words[-1] not in _BARE_LAST:
+        return False
+    if len(all_words) > 1 and all_words[-2] in _NON_SECRET_BEFORE:
+        return False
+    return True
+
+
+looks_secret = secret_key
 
 
 def is_redacted(v) -> bool:
@@ -79,7 +104,7 @@ def redact(value, key: str | None, salt: str):
     by one, anything else unchanged. Non-strings and placeholders pass through."""
     if not isinstance(value, str):
         return value
-    if key is not None and looks_secret(key) and not placeholder(value):
+    if key is not None and looks_secret(key, value) and not placeholder(value):
         return marker(value, salt)
     return redact_url(value, salt)
 
@@ -100,7 +125,7 @@ def _holds_secret(d: dict, k: str) -> bool:
     if k.lower() in _DIRECT:
         return not _REFERENCE.match(str(d[k]))
     if k in _VALUE_KEYS:
-        return any(isinstance(d.get(nk), str) and looks_secret(d[nk]) for nk in _NAME_KEYS)
+        return any(isinstance(d.get(nk), str) and looks_secret(d[nk], d.get(k)) for nk in _NAME_KEYS)
     return False
 
 

{cg_code_graph-0.21.0 → cg_code_graph-0.21.1}/cg_code_graph/plugins/laravel/plugin.py

@@ -216,7 +216,7 @@ class LaravelPlugin(FrameworkPlugin):
                         attrs["value"] = redact(n["literal"], n["key"], self.b.redact_salt)
                     if n.get("envs"):
                         attrs["env"] = [e["env"] for e in n["envs"]]
-                        attrs["env_default"] = [redact(e["default"], e["env"] if looks_secret(e["env"]) else n["key"], self.b.redact_salt)
+                        attrs["env_default"] = [redact(e["default"], e["env"] if looks_secret(e["env"], e["default"]) else n["key"], self.b.redact_salt)
                                                 for e in n["envs"]]
                     cid = b.add_node("config", key, file=f, line=n["line"], module="config", lang="php", attrs=attrs)
                     self.config_keys[key] = n

{cg_code_graph-0.21.0 → cg_code_graph-0.21.1}/cg_code_graph/surface.py

@@ -306,13 +306,13 @@ def _config_literals(ctx: Ctx) -> list[dict]:
         key = r["name"] or r["id"][len("config:"):]
         last = key.split(".")[-1]
         repo = ctx.repo_of(a, r["file"])
-        if secret_key(last) and not _placeholder(a.get("value")):
+        if secret_key(last, a.get("value")) and not _placeholder(a.get("value")):
             out.append(make_finding(ctx, "hardcoded", protocol="config", node=r["id"], file=r["file"], line=r["line"],
                                     confidence="resolved", repo=repo, attrs=a, see=f"cg node '{r['id']}'",
                                     entry_ids=[r["id"]], detail=f"literal {_kind_of_key(last)} in config key {key} (value not shown)"))
         envs, defaults = a.get("env") or [], a.get("env_default") or []
         for env, dflt in zip(envs, defaults):
-            if secret_key(str(env)) and not _placeholder(dflt):
+            if secret_key(str(env), dflt) and not _placeholder(dflt):
                 out.append(make_finding(ctx, "hardcoded", protocol="config", node=r["id"], file=r["file"], line=r["line"],
                                         confidence="heuristic", repo=repo, attrs=a, see=f"cg node '{r['id']}'",
                                         entry_ids=[r["id"]], detail=f"literal default for env {env} in config key {key} (value not shown)"))

{cg_code_graph-0.21.0 → cg_code_graph-0.21.1/cg_code_graph.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cg-code-graph
-Version: 0.21.0
+Version: 0.21.1
 Summary: cg: a code graph of routes, calls, data access and platform boundaries for agents and humans (CLI + MCP server)
 Author: cyberchronos00
 License-Expression: MIT

cg_code_graph-0.21.1/tests/test_redact_salt.py

@@ -0,0 +1,235 @@
+"""Salted secret fingerprints (#47 part 2d): `redacted:hmac:<8 hex>` is an HMAC-SHA-256 keyed with a per-graph salt kept
+in the `meta` table (`redact_salt`), so a common password is not recognisable from its marker and markers only compare
+within one graph (and across re-indexes of it)."""
+import hashlib
+import json
+import shutil
+import sqlite3
+import sys
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT))
+from cg_code_graph.core import redact as R  # noqa: E402
+from cg_code_graph.indexer import index_project  # noqa: E402
+
+PHP_FIX = ROOT / "tests" / "surface_fixture" / "php"
+needs_php = pytest.mark.skipif(shutil.which("php") is None, reason="php is not installed (PHP extractor)")
+
+
+def test_marker_is_keyed_not_a_plain_digest():
+    plain = hashlib.sha256(b"password").hexdigest()[:8]
+    assert plain == "5e884898"
+    m = R.marker("password", "salt-a-0000")
+    assert m.startswith(R.MARK) and m != R.MARK + plain and m != R.LEGACY_MARK + plain
+    assert plain not in m
+
+
+def test_two_graphs_give_different_markers_and_one_graph_a_stable_one():
+    assert R.marker("hunter2", "salt-a") != R.marker("hunter2", "salt-b")
+    assert R.marker("hunter2", "salt-a") == R.marker("hunter2", "salt-a")
+    assert R.marker("hunter2", "salt-a") != R.marker("hunter3", "salt-a")
+    with pytest.raises(ValueError):
+        R.marker("hunter2", "")
+
+
+def test_redact_and_urls_use_the_salt_and_both_prefixes_count_as_redacted():
+    assert R.redact("fake-bookstore-pw-0000", "db_password", "s1") == R.marker("fake-bookstore-pw-0000", "s1")
+    url = R.redact("mysql://reader:fake-bookstore-pw-0000@replica.example.test/shop", None, "s1")
+    assert url == f"mysql://reader:{R.marker('fake-bookstore-pw-0000', 's1')}@replica.example.test/shop"
+    assert R.is_redacted(R.marker("x", "s1")) and R.is_redacted("redacted:sha256:5e884898")
+    assert R.redact(R.marker("x", "s1"), "password", "s2") == R.marker("x", "s1")     # a marker is never re-hashed
+
+
+def _config(db):
+    con = sqlite3.connect(db)
+    try:
+        salt = json.loads(con.execute("SELECT value FROM meta WHERE key='redact_salt'").fetchone()[0])
+        attrs = {r[0]: json.loads(r[1] or "{}") for r in con.execute("SELECT id, attrs FROM nodes WHERE kind='config'")}
+    finally:
+        con.close()
+    return salt, attrs["config:services.github.secret"]["value"]
+
+
+@needs_php
+def test_salt_is_created_per_graph_and_kept_on_reindex(tmp_path):
+    a, b = tmp_path / "a.db", tmp_path / "b.db"
+    index_project(PHP_FIX, a, "php")
+    index_project(PHP_FIX, b, "php")
+    salt_a, marker_a = _config(a)
+    salt_b, marker_b = _config(b)
+    assert len(salt_a) == 32 and salt_a != salt_b
+    assert marker_a.startswith("redacted:hmac:") and marker_a != marker_b                    # two graphs, same value
+    index_project(PHP_FIX, a, "php")                                                           # re-index the same DB
+    assert _config(a) == (salt_a, marker_a)
+
+
+@needs_php
+def test_refresh_keeps_the_salt(tmp_path):
+    from cg_code_graph import hooks
+    root = tmp_path / "php"
+    shutil.copytree(PHP_FIX, root, ignore=shutil.ignore_patterns("vendor"))
+    db = tmp_path / "graph.db"
+    index_project(root, db, "php")
+    before = _config(db)
+    (root / "app" / "Services" / "Extra.php").write_text("<?php\nnamespace App\\Services;\nclass Extra {}\n")
+    assert hooks.refresh(str(root), str(db), "php", quiet=True) == 0
+    assert _config(db) == before
+
+
+@needs_php
+def test_cg_link_keeps_markers_and_has_no_salt_of_its_own(tmp_path):
+    from cg_code_graph.link import link_many
+    a, b, out = tmp_path / "a.db", tmp_path / "b.db", tmp_path / "combined.db"
+    index_project(PHP_FIX, a, "php-a")
+    index_project(PHP_FIX, b, "php-b")
+    link_many([("one", str(a), "both"), ("two", str(b), "both")], str(out))
+    con = sqlite3.connect(out)
+    try:
+        assert con.execute("SELECT 1 FROM meta WHERE key='redact_salt'").fetchone() is None
+        vals = {r[0]: json.loads(r[1] or "{}").get("value") for r in con.execute(
+            "SELECT id, attrs FROM nodes WHERE id LIKE '%config:services.github.secret'")}
+    finally:
+        con.close()
+    assert len(vals) == 2 and all(str(v).startswith("redacted:hmac:") for v in vals.values())
+    assert len(set(vals.values())) == 2          # fingerprints of different source graphs do not compare
+
+
+LARAVEL_FIX = ROOT / "tests" / "redact_fixture" / "laravel-bookstore"
+
+
+@pytest.mark.parametrize("key", ["AUTH_GUARD", "AUTH_PASSWORD_BROKER", "AUTH_PASSWORD_RESET_TOKEN_TABLE",
+                                 "try_it_credentials_policy", "auth.defaults.guard", "auth.passwords.readers.table",
+                                 "DB_PASSWORD_TABLE", "S3_PUBLIC_KEY", "SIGNING_KEY_ID", "SESSION_DRIVER", "tokenTtl",
+                                 "REPORTS_KEY_PATH", "primary_key", "foreign_key", "sort_key", "cache.key", "route_key",
+                                 "partition_key", "idempotency_key", "remember_token"])
+def test_last_word_rule_leaves_framework_settings_alone(key):
+    assert not R.looks_secret(key, "created_at") and not R.secret_key(key, "created_at")
+
+
+@pytest.mark.parametrize("key", ["AUTH_TOKEN", "DB_PASSWORD", "STRIPE_SECRET", "password", "client_secret", "api_key",
+                                 "apiKey", "REPORTS_DSN", "private_key", "signing_key", "ENCRYPTION_KEY",
+                                 "webhook_secret", "access_token", "refresh_token", "bearer_token", "DB_PASS",
+                                 "app.key", "APP_KEY", "STRIPE_SECRET_KEY"])
+def test_last_word_rule_keeps_credentials(key):
+    assert R.looks_secret(key) and R.secret_key(key)
+
+
+_HEX32 = "a" + ("fake" + "0a1b" * 7)[:31]                 # 32 chars, lowercase hex-looking, starts with a letter
+_REDACTED_ROWS = [
+    ("LEDGER_TOKEN", "fake-bookstore-token-0000"),
+    ("LEDGER_TOKEN", "SURF-PHP-LEDGER-DEFAULT-d7e2"),
+    ("services.ledger.token", _HEX32),
+    ("MAILGUN_KEY", "key-" + "fake0a1b" * 3 + "fake0a"),
+    ("PUSHER_APP_KEY", "fakebookstore" + "abcdefghijk"[:9] + "0042"),
+    ("services.x.key", "FakeBook" + "Store12345" + "AbC"),
+]
+
+
+@pytest.mark.parametrize("key,value", _REDACTED_ROWS)
+def test_bare_key_and_token_with_credential_looking_values_are_redacted(key, value):
+    assert R.secret_key(key, value) and R.looks_secret(key, value)
+    assert R.redact(value, key, "s1").startswith(R.MARK)
+
+
+_HOSTILE_ROWS = [
+    "key-abcdef", "key-fakebookstorekeynodigits", "key-FAKE",            # key- prefixed, with and without digits
+    "abc.def.ghi", "fake.bookstore.token",                                # dotted, JWT-segment-like
+    "eyJmYWtlIjoiYm9va3N0b3JlIn0", "FakeBookstoreTokenNoDigits",          # base64url segment, mixed case no digits
+    "fake_bookstore_token", "xoxb-fake-bookstore-token", "fakebookstore",  # lowercase words only
+]
+
+
+@pytest.mark.parametrize("key", ["services.ledger.token", "services.ledger.key", "LEDGER_TOKEN", "MAILGUN_KEY"])
+@pytest.mark.parametrize("value", _HOSTILE_ROWS)
+def test_bare_key_and_token_redact_any_value_shape(key, value):
+    assert R.secret_key(key, value)
+    assert R.redact(value, key, "s1").startswith(R.MARK)
+
+
+@pytest.mark.parametrize("key", ["services.ledger.token", "services.ledger.key", "LEDGER_TOKEN", "STRIPE_KEY"])
+def test_bare_key_and_token_are_redacted_whatever_the_value(key):
+    assert R.secret_key(key) and R.secret_key(key, None) and R.secret_key(key, 12345)      # no value: redact
+    assert R.secret_key(key, "sk_test_FAKE_bookstore_000000")
+    assert R.secret_key(key, "sk_fakebookstore") and R.secret_key(key, "pk_live_fakebookstore")
+    assert R.secret_key(key, "rk-fakebookstore")
+    assert R.secret_key(key, "base64:FAKEBOOKSTOREAPPKEY0000000000000000000000=")
+    assert R.secret_key(key, "Remember_Token") and R.secret_key(key, "token1")
+    assert R.secret_key(key, "a" * 41) and R.secret_key(key, R.marker("x", "s1"))
+    assert R.secret_key(key, "a" * 40)
+    assert R.secret_key(key, "created_at") and R.secret_key(key, "x-idempotency-key")
+
+
+@pytest.mark.parametrize("key,value", [("primary_key", "id"), ("foreign_key", "author_id"), ("sort_key", "created_at"),
+                                       ("remember_token", "remember_token"), ("cache.key", "bookstore_cache"),
+                                       ("idempotency_key", "x-idempotency-key"), ("AUTH_GUARD", "web"),
+                                       ("AUTH_PASSWORD_BROKER", "readers"),
+                                       ("AUTH_PASSWORD_RESET_TOKEN_TABLE", "reader_password_resets"),
+                                       ("try_it_credentials_policy", "include")])
+def test_kept_cases(key, value):
+    assert not R.secret_key(key, value)
+    assert R.redact(value, key, "s1") == value
+
+
+@pytest.mark.parametrize("word", ["primary", "foreign", "sort", "partition", "route", "cache", "idempotency",
+                                  "remember", "csrf", "xsrf", "public", "i18n", "translation", "lookup", "unique",
+                                  "index", "storage", "prefix"])
+@pytest.mark.parametrize("last", ["key", "token"])
+def test_known_non_secret_compounds_keep_any_value(word, last):
+    assert not R.secret_key(f"{word}_{last}", "Fake0a1b" * 4)
+    assert not R.secret_key(f"{word.upper()}_{last.upper()}", "Fake0a1b" * 4)
+    assert not R.secret_key(f"app.{word}.{last}", "Fake0a1b" * 4)
+
+
+@pytest.mark.parametrize("key", ["S3_KEY_ID", "S3_PUBLIC_KEY", "SIGNING_KEY_PATH", "SIGNING_KEY_FILE"])
+def test_key_id_public_key_and_path_are_never_credentials(key):
+    assert not R.secret_key(key, "Fake0a1b" * 4)
+
+
+def test_redact_keeps_a_guard_name_and_hides_a_password():
+    assert R.redact("web", "guard", "s1") == "web"
+    assert R.redact("readers", "AUTH_PASSWORD_BROKER", "s1") == "readers"
+    assert R.redact("fake-bookstore-pw-0000", "DB_PASSWORD", "s1").startswith(R.MARK)
+
+
+@needs_php
+def test_laravel_bookstore_config_keeps_defaults_and_redacts_secrets(tmp_path):
+    db = tmp_path / "laravel.db"
+    index_project(LARAVEL_FIX, db, "laravel-bookstore")
+    con = sqlite3.connect(db)
+    try:
+        attrs = {r[0]: json.loads(r[1] or "{}") for r in con.execute("SELECT id, attrs FROM nodes WHERE kind='config'")}
+    finally:
+        con.close()
+    assert attrs["config:auth.defaults.guard"]["env_default"] == ["web"]
+    assert attrs["config:auth.defaults.passwords"]["env_default"] == ["readers"]
+    assert attrs["config:auth.passwords.readers.table"]["env_default"] == ["reader_password_resets"]
+    assert attrs["config:shelfdocs.try_it_credentials_policy"]["value"] == "include"
+    assert attrs["config:models.primary_key"]["value"] == "id"
+    assert attrs["config:models.foreign_key"]["value"] == "author_id"
+    assert attrs["config:models.sort_key"]["value"] == "created_at"
+    assert attrs["config:models.remember_token"]["value"] == "remember_token"
+    assert attrs["config:models.cache.key"]["value"] == "bookstore_cache"
+    assert attrs["config:services.ledger.idempotency_key"]["value"] == "x-idempotency-key"
+    redacted = ["config:database.connections.pgsql.password", "config:services.ledger.token", "config:app.key",
+                "config:services.stripe.secret"]
+    for nid in redacted:
+        assert attrs[nid]["env_default"][0].startswith(R.MARK), nid
+    assert attrs["config:services.ledger.key"]["value"].startswith(R.MARK)
+    assert attrs["config:shelfdocs.client_secret"]["value"].startswith(R.MARK)
+    assert "fake-bookstore" not in json.dumps(attrs) and "FAKE" not in json.dumps(attrs)
+
+
+@needs_php
+def test_surface_php_fixture_still_redacts_exactly_three_values(tmp_path):
+    db = tmp_path / "php.db"
+    index_project(PHP_FIX, db, "php")
+    con = sqlite3.connect(db)
+    try:
+        attrs = [json.loads(r[0] or "{}") for r in con.execute("SELECT attrs FROM nodes WHERE kind='config'")]
+    finally:
+        con.close()
+    n = sum(1 for a in attrs for v in [a.get("value"), *(a.get("env_default") or [])] if R.is_redacted(v))
+    assert n == 3

cg_code_graph-0.21.0/tests/test_redact_salt.py

@@ -1,97 +0,0 @@
-"""Salted secret fingerprints (#47 part 2d): `redacted:hmac:<8 hex>` is an HMAC-SHA-256 keyed with a per-graph salt kept
-in the `meta` table (`redact_salt`), so a common password is not recognisable from its marker and markers only compare
-within one graph (and across re-indexes of it)."""
-import hashlib
-import json
-import shutil
-import sqlite3
-import sys
-from pathlib import Path
-
-import pytest
-
-ROOT = Path(__file__).resolve().parents[1]
-sys.path.insert(0, str(ROOT))
-from cg_code_graph.core import redact as R  # noqa: E402
-from cg_code_graph.indexer import index_project  # noqa: E402
-
-PHP_FIX = ROOT / "tests" / "surface_fixture" / "php"
-needs_php = pytest.mark.skipif(shutil.which("php") is None, reason="php is not installed (PHP extractor)")
-
-
-def test_marker_is_keyed_not_a_plain_digest():
-    plain = hashlib.sha256(b"password").hexdigest()[:8]
-    assert plain == "5e884898"
-    m = R.marker("password", "salt-a-0000")
-    assert m.startswith(R.MARK) and m != R.MARK + plain and m != R.LEGACY_MARK + plain
-    assert plain not in m
-
-
-def test_two_graphs_give_different_markers_and_one_graph_a_stable_one():
-    assert R.marker("hunter2", "salt-a") != R.marker("hunter2", "salt-b")
-    assert R.marker("hunter2", "salt-a") == R.marker("hunter2", "salt-a")
-    assert R.marker("hunter2", "salt-a") != R.marker("hunter3", "salt-a")
-    with pytest.raises(ValueError):
-        R.marker("hunter2", "")
-
-
-def test_redact_and_urls_use_the_salt_and_both_prefixes_count_as_redacted():
-    assert R.redact("fake-bookstore-pw-0000", "db_password", "s1") == R.marker("fake-bookstore-pw-0000", "s1")
-    url = R.redact("mysql://reader:fake-bookstore-pw-0000@replica.example.test/shop", None, "s1")
-    assert url == f"mysql://reader:{R.marker('fake-bookstore-pw-0000', 's1')}@replica.example.test/shop"
-    assert R.is_redacted(R.marker("x", "s1")) and R.is_redacted("redacted:sha256:5e884898")
-    assert R.redact(R.marker("x", "s1"), "password", "s2") == R.marker("x", "s1")     # a marker is never re-hashed
-
-
-def _config(db):
-    con = sqlite3.connect(db)
-    try:
-        salt = json.loads(con.execute("SELECT value FROM meta WHERE key='redact_salt'").fetchone()[0])
-        attrs = {r[0]: json.loads(r[1] or "{}") for r in con.execute("SELECT id, attrs FROM nodes WHERE kind='config'")}
-    finally:
-        con.close()
-    return salt, attrs["config:services.github.secret"]["value"]
-
-
-@needs_php
-def test_salt_is_created_per_graph_and_kept_on_reindex(tmp_path):
-    a, b = tmp_path / "a.db", tmp_path / "b.db"
-    index_project(PHP_FIX, a, "php")
-    index_project(PHP_FIX, b, "php")
-    salt_a, marker_a = _config(a)
-    salt_b, marker_b = _config(b)
-    assert len(salt_a) == 32 and salt_a != salt_b
-    assert marker_a.startswith("redacted:hmac:") and marker_a != marker_b                    # two graphs, same value
-    index_project(PHP_FIX, a, "php")                                                           # re-index the same DB
-    assert _config(a) == (salt_a, marker_a)
-
-
-@needs_php
-def test_refresh_keeps_the_salt(tmp_path):
-    from cg_code_graph import hooks
-    root = tmp_path / "php"
-    shutil.copytree(PHP_FIX, root, ignore=shutil.ignore_patterns("vendor"))
-    db = tmp_path / "graph.db"
-    index_project(root, db, "php")
-    before = _config(db)
-    (root / "app" / "Services" / "Extra.php").write_text("<?php\nnamespace App\\Services;\nclass Extra {}\n")
-    assert hooks.refresh(str(root), str(db), "php", quiet=True) == 0
-    assert _config(db) == before
-
-
-@needs_php
-def test_cg_link_keeps_markers_and_has_no_salt_of_its_own(tmp_path):
-    from cg_code_graph.link import link_many
-    a, b, out = tmp_path / "a.db", tmp_path / "b.db", tmp_path / "combined.db"
-    index_project(PHP_FIX, a, "php-a")
-    index_project(PHP_FIX, b, "php-b")
-    link_many([("one", str(a), "both"), ("two", str(b), "both")], str(out))
-    con = sqlite3.connect(out)
-    try:
-        assert con.execute("SELECT 1 FROM meta WHERE key='redact_salt'").fetchone() is None
-        vals = {r[0]: json.loads(r[1] or "{}").get("value") for r in con.execute(
-            "SELECT id, attrs FROM nodes WHERE id LIKE '%config:services.github.secret'")}
-    finally:
-        con.close()
-    assert len(vals) == 2 and all(str(v).startswith("redacted:hmac:") for v in vals.values())
-    assert len(set(vals.values())) == 2          # fingerprints of different source graphs do not compare