secretshield 0.6.1__tar.gz → 0.7.0__tar.gz

{secretshield-0.6.1/secretshield.egg-info → secretshield-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secretshield
-Version: 0.6.1
+Version: 0.7.0
 Summary: Stop secrets before they leak -- runtime redaction, multi-language scanning, auto-fix, Git hooks, and CI, all in one CLI.
 Author: Samarth Chugh (Sam3360)
 License-Expression: MIT
@@ -104,6 +104,21 @@ secretshield init
 No required dependencies, no telemetry, no network calls. Everything
 runs locally, in your own process.
 
+## Custom rules
+
+Have a credential format of your own? Drop a
+`.secretshield-rules.toml` in your project root:
+
+```toml
+[[rules]]
+name = "My API Key"
+pattern = "MYAPP_[A-Za-z0-9]{32}"
+```
+
+`secretshield scan .` picks it up automatically — no flag needed.
+Validate the file with `secretshield rules check`, or create a rule
+interactively with `secretshield rule create`.
+
 For the full command reference, configuration options, and exactly how
 Auto-Fix decides what's safe to rewrite, see the
 **[usage guide](https://github.com/Sam3360/secretshield/blob/main/USAGE.md)**.

{secretshield-0.6.1 → secretshield-0.7.0}/README.md

@@ -78,6 +78,21 @@ secretshield init
 No required dependencies, no telemetry, no network calls. Everything
 runs locally, in your own process.
 
+## Custom rules
+
+Have a credential format of your own? Drop a
+`.secretshield-rules.toml` in your project root:
+
+```toml
+[[rules]]
+name = "My API Key"
+pattern = "MYAPP_[A-Za-z0-9]{32}"
+```
+
+`secretshield scan .` picks it up automatically — no flag needed.
+Validate the file with `secretshield rules check`, or create a rule
+interactively with `secretshield rule create`.
+
 For the full command reference, configuration options, and exactly how
 Auto-Fix decides what's safe to rewrite, see the
 **[usage guide](https://github.com/Sam3360/secretshield/blob/main/USAGE.md)**.

{secretshield-0.6.1 → secretshield-0.7.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "secretshield"
-version = "0.6.1"
+version = "0.7.0"
 description = "Stop secrets before they leak -- runtime redaction, multi-language scanning, auto-fix, Git hooks, and CI, all in one CLI."
 readme = "README.md"
 license = "MIT"

{secretshield-0.6.1 → secretshield-0.7.0}/secretshield/__init__.py

@@ -23,7 +23,7 @@ from .detector import Match, detect
 from .guardian import disable, enable, is_enabled
 from .redactor import redact
 
-__version__ = "0.6.1"
+__version__ = "0.7.0"
 
 __all__ = [
     "__version__",

{secretshield-0.6.1 → secretshield-0.7.0}/secretshield/autofix/fixer.py

@@ -14,6 +14,7 @@ from pathlib import Path
 from typing import Callable
 
 from ..detector import detect
+from ..custom_rules import scan_text_with_rules
 from . import javascript as jsfix
 from . import python as pyfix
 from .env import append_env_example_var, append_env_var, unique_env_key
@@ -86,6 +87,7 @@ def run_autofix(
     entropy_threshold: float = 4.2,
     print_func: Callable[[str], None] = _default_print,
     input_func: Callable[[str], str] = _default_input,
+    custom_rules: list | None = None,
 ) -> FixSummary:
     """
     Run the interactive Auto-Fix flow.
@@ -94,6 +96,12 @@ def run_autofix(
     `secretshield.detector.Match` objects found in that file (already
     filtered for placeholders by the caller). Files are processed in
     sorted order for deterministic output.
+
+    `custom_rules` (optional): the same `.secretshield-rules.toml`
+    rules used to build `findings_by_file`, if any. Needed here too so
+    that the internal re-scan (used to get fresh, accurate line numbers
+    after an `import os` insertion) can re-locate a match that only a
+    custom rule -- not a built-in pattern -- would find.
     """
     summary = FixSummary()
     env_path = project_root / ".env"
@@ -163,9 +171,13 @@ def run_autofix(
             source = pyfix.insert_import_os(source)
 
         # Re-scan the (possibly import-adjusted) source fresh, so line
-        # numbers reflect the current content exactly.
+        # numbers reflect the current content exactly. Custom rules are
+        # merged in too, so a match only a custom rule (not a built-in
+        # pattern) would find isn't lost here.
         try:
             current_matches = detect(source, entropy_threshold=entropy_threshold)
+            if custom_rules:
+                current_matches = current_matches + scan_text_with_rules(source, custom_rules)
         except Exception:
             current_matches = []
 

{secretshield-0.6.1 → secretshield-0.7.0}/secretshield/cli.py

@@ -408,6 +408,7 @@ def _iter_scan_sources(args: argparse.Namespace, target: Path, include_patterns:
 
 def _run_scan(args: argparse.Namespace) -> int:
     from .baseline import baseline_exists, compute_finding_id, load_baseline_ids, write_baseline
+    from .custom_rules import load_custom_rules, scan_text_with_rules
     from .project_config import load_project_config
 
     project_cfg = load_project_config()
@@ -428,6 +429,20 @@ def _run_scan(args: argparse.Namespace) -> int:
 
     exclude_patterns.extend(load_ignore_patterns(Path.cwd()))
 
+    # Custom rules (.secretshield-rules.toml), if present, become
+    # additional detectors alongside the built-in patterns -- no flag
+    # required. A broken rules file never blocks the scan (valid rules
+    # in the same file still load and run); it's surfaced as a single
+    # warning pointing at `rules check` rather than silently ignored.
+    custom_rules, custom_rule_errors = load_custom_rules(Path.cwd())
+    if custom_rule_errors:
+        print(
+            f"secretshield: warning: {len(custom_rule_errors)} invalid custom "
+            f"rule(s) in .secretshield-rules.toml -- run `secretshield rules "
+            f"check` for details.",
+            file=sys.stderr,
+        )
+
     json_output = bool(args.json) or (project_cfg.output_format == "json")
 
     target = Path(args.path)
@@ -455,6 +470,11 @@ def _run_scan(args: argparse.Namespace) -> int:
         _progress_update(show_progress, files_scanned)
 
         file_matches = _scan_text_matches(text, entropy_threshold=entropy_threshold)
+        if custom_rules:
+            custom_matches = [
+                m for m in scan_text_with_rules(text, custom_rules) if not _is_placeholder(m.value)
+            ]
+            file_matches = file_matches + custom_matches
         if file_matches:
             matches_by_file[display_path] = file_matches
         for match in file_matches:
@@ -503,7 +523,12 @@ def _run_scan(args: argparse.Namespace) -> int:
     if getattr(args, "fix", False):
         from .autofix import run_autofix
 
-        summary = run_autofix(project_root, matches_by_file, entropy_threshold=entropy_threshold)
+        summary = run_autofix(
+            project_root,
+            matches_by_file,
+            entropy_threshold=entropy_threshold,
+            custom_rules=custom_rules,
+        )
         return 1 if summary.fixed < summary.detected else 0
 
     if json_output:
@@ -734,6 +759,124 @@ def _cmd_init(args: argparse.Namespace) -> int:
     return 0
 
 
+# --- `rules` / `rule create` commands -----------------------------------
+
+
+def _cmd_rules_check(args: argparse.Namespace) -> int:
+    from .custom_rules import load_custom_rules, rules_file_path
+
+    use_color = supports_color(sys.stdout)
+    path = rules_file_path(Path.cwd())
+
+    if not path.exists():
+        print(f"No {path.name} found.")
+        return 0
+
+    rules, errors = load_custom_rules(Path.cwd())
+
+    print("SecretShield Rules\n")
+
+    if errors:
+        for err in errors:
+            if err.name:
+                print(f'{red(chr(0x2717), use_color)} Invalid custom rule "{err.name}"')
+                print(f"  {err.message}")
+            else:
+                label = f"rule #{err.rule_index + 1}" if err.rule_index is not None else path.name
+                print(f"{red(chr(0x2717), use_color)} {label}: {err.message}")
+        return 1
+
+    print(f"{green(chr(0x2713), use_color)} {path.name}")
+    print(f"{green(chr(0x2713), use_color)} {len(rules)} rule(s) loaded")
+    print(f"{green(chr(0x2713), use_color)} All patterns are valid")
+    return 0
+
+
+def _cmd_rules_list(args: argparse.Namespace) -> int:
+    from .custom_rules import load_custom_rules, rules_file_path
+
+    path = rules_file_path(Path.cwd())
+    if not path.exists():
+        print(f"No {path.name} found.")
+        return 0
+
+    rules, errors = load_custom_rules(Path.cwd())
+
+    if not rules and not errors:
+        print("No custom rules defined.")
+        return 0
+
+    if rules:
+        print("SecretShield Custom Rules\n")
+        for i, rule in enumerate(rules, start=1):
+            print(f"{i}. {rule.name}")
+            print(f"   {rule.pattern}")
+
+    if errors:
+        use_color = supports_color(sys.stdout)
+        print(
+            f"\n{red(chr(0x2717), use_color)} {len(errors)} rule(s) failed to load "
+            f"-- run `secretshield rules check` for details."
+        )
+    return 0
+
+
+def _cmd_rules_no_subcommand(args: argparse.Namespace) -> int:
+    # `secretshield rules` with no further action -> list.
+    return _cmd_rules_list(args)
+
+
+def _cmd_rule_no_subcommand(args: argparse.Namespace) -> int:
+    print("secretshield rule: missing subcommand. Try `secretshield rule create`.", file=sys.stderr)
+    return 1
+
+
+def _cmd_rule_create(args: argparse.Namespace) -> int:
+    import re as _re
+
+    from .custom_rules import append_rule, rules_file_path
+
+    try:
+        interactive = sys.stdin.isatty()
+    except Exception:
+        interactive = False
+
+    if not interactive:
+        print("secretshield rule create requires an interactive terminal.")
+        print("No rule was created.")
+        return 1
+
+    print("SecretShield \u2014 Create custom rule\n")
+
+    name = input("Rule name: ").strip()
+    if not name:
+        print("Rule name cannot be empty. No rule was created.", file=sys.stderr)
+        return 1
+
+    while True:
+        pattern = input("Pattern: ").strip()
+        if not pattern:
+            print("Pattern cannot be empty.", file=sys.stderr)
+            continue
+        try:
+            _re.compile(pattern)
+        except _re.error as exc:
+            print(f"Invalid regular expression: {exc}", file=sys.stderr)
+            print("Please try again.\n")
+            continue
+        break
+
+    path = rules_file_path(Path.cwd())
+    try:
+        append_rule(path, name, pattern)
+    except Exception as exc:
+        print(f"\u2717 Could not write {path.name}: {exc}", file=sys.stderr)
+        return 1
+
+    print(f"{green(chr(0x2713), supports_color(sys.stdout))} Added rule to {path.name}")
+    return 0
+
+
 # --- argparse wiring -----------------------------------------------------
 
 
@@ -925,6 +1068,27 @@ def build_parser() -> argparse.ArgumentParser:
     )
     init_parser.set_defaults(func=_cmd_init)
 
+    rules_parser = subparsers.add_parser(
+        "rules",
+        help="List or validate .secretshield-rules.toml custom detection rules.",
+    )
+    rules_subparsers = rules_parser.add_subparsers(dest="rules_action")
+    rules_check_parser = rules_subparsers.add_parser(
+        "check", help="Validate .secretshield-rules.toml (TOML syntax, required fields, regex validity)."
+    )
+    rules_check_parser.set_defaults(func=_cmd_rules_check)
+    rules_parser.set_defaults(func=_cmd_rules_list)
+
+    rule_parser = subparsers.add_parser(
+        "rule", help="Create a custom detection rule."
+    )
+    rule_parser.set_defaults(func=_cmd_rule_no_subcommand)
+    rule_subparsers = rule_parser.add_subparsers(dest="rule_action")
+    rule_create_parser = rule_subparsers.add_parser(
+        "create", help="Interactively create a new rule in .secretshield-rules.toml."
+    )
+    rule_create_parser.set_defaults(func=_cmd_rule_create)
+
     return parser
 
 

secretshield-0.7.0/secretshield/custom_rules.py

@@ -0,0 +1,163 @@
+"""
+`.secretshield-rules.toml` -- simple, project-local regex rules that
+become additional detectors alongside SecretShield's built-in
+patterns, automatically, for any project that has the file.
+
+Deliberately minimal by design: a rule has a `name` and a `pattern`,
+nothing else. No severity, no IDs, no capture-group logic, no path
+filters -- see the project's USAGE.md for the reasoning. This module
+only loads and compiles rules and runs them against already-loaded
+text; everything else (scanning, ignoring, reporting, redaction,
+Auto-Fix) is the existing SecretShield pipeline, unchanged.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from pathlib import Path
+
+try:
+    import tomllib  # Python 3.11+
+except ModuleNotFoundError:  # pragma: no cover -- exercised only on 3.10
+    try:
+        import tomli as tomllib  # type: ignore[no-redef]
+    except ModuleNotFoundError:
+        tomllib = None  # type: ignore[assignment]
+
+from .detector import Match
+
+RULES_FILENAME = ".secretshield-rules.toml"
+
+
+@dataclass
+class CustomRule:
+    name: str
+    pattern: str
+    regex: re.Pattern
+
+
+@dataclass
+class RuleError:
+    """A problem found while loading the rules file. `rule_index` and
+    `name` are None for file-level errors (bad TOML, wrong shape)."""
+
+    rule_index: int | None
+    name: str | None
+    message: str
+
+
+def rules_file_path(root: Path) -> Path:
+    return root / RULES_FILENAME
+
+
+def load_custom_rules(root: Path | None = None) -> tuple[list[CustomRule], list[RuleError]]:
+    """
+    Load and compile custom rules from `.secretshield-rules.toml` in
+    `root` (default: current directory).
+
+    Returns `(rules, errors)`. A rule with a problem is skipped and
+    recorded as an error rather than silently dropped or aborting the
+    whole file -- one bad rule doesn't disable the rest. No file, an
+    empty file, or an empty `rules` list all return `([], [])`, which
+    is a valid, non-error state.
+    """
+    path = rules_file_path(root or Path.cwd())
+    rules: list[CustomRule] = []
+    errors: list[RuleError] = []
+
+    if not path.exists():
+        return rules, errors
+
+    if tomllib is None:
+        errors.append(
+            RuleError(None, None, "No TOML parser available to read this file.")
+        )
+        return rules, errors
+
+    try:
+        with open(path, "rb") as f:
+            data = tomllib.load(f)
+    except Exception as exc:
+        errors.append(RuleError(None, None, f"Invalid TOML: {exc}"))
+        return rules, errors
+
+    if not data:
+        return rules, errors
+
+    raw_rules = data.get("rules")
+    if raw_rules is None:
+        return rules, errors
+    if not isinstance(raw_rules, list):
+        errors.append(RuleError(None, None, '"rules" must be a list of [[rules]] tables.'))
+        return rules, errors
+
+    for index, raw in enumerate(raw_rules):
+        if not isinstance(raw, dict):
+            errors.append(RuleError(index, None, "Each rule must be a [[rules]] table."))
+            continue
+
+        name = raw.get("name")
+        if not name or not isinstance(name, str):
+            errors.append(RuleError(index, None, 'Missing or invalid "name".'))
+            continue
+
+        pattern = raw.get("pattern")
+        if not pattern or not isinstance(pattern, str):
+            errors.append(RuleError(index, name, 'Missing or invalid "pattern".'))
+            continue
+
+        try:
+            compiled = re.compile(pattern)
+        except re.error as exc:
+            errors.append(RuleError(index, name, f"Invalid regular expression: {exc}"))
+            continue
+
+        rules.append(CustomRule(name=name, pattern=pattern, regex=compiled))
+
+    return rules, errors
+
+
+def scan_text_with_rules(text: str, rules: list[CustomRule]) -> list[Match]:
+    """
+    Run custom rules against already-loaded text, returning
+    `secretshield.detector.Match` objects -- the same shape built-in
+    detection produces. `kind` is set to the rule's own name, so a
+    custom-rule finding flows through the existing finding/report/
+    JSON/--fix pipeline with no separate output system: it's
+    identified simply by its name, e.g. "My API Key".
+    """
+    if not text or not rules:
+        return []
+    matches: list[Match] = []
+    for rule in rules:
+        for m in rule.regex.finditer(text):
+            value = m.group(0)
+            if not value:
+                continue
+            matches.append(Match(start=m.start(), end=m.end(), value=value, kind=rule.name))
+    return matches
+
+
+def append_rule(path: Path, name: str, pattern: str) -> None:
+    """
+    Append a new `[[rules]]` block to `path`, creating it if it
+    doesn't exist. Never rewrites or reformats whatever's already
+    there -- existing rules (and any manual edits) are preserved
+    byte-for-byte, the same append-only convention used elsewhere in
+    SecretShield (.env, .gitignore, .secretshieldignore).
+    """
+
+    def _toml_string(s: str) -> str:
+        return '"' + s.replace("\\", "\\\\").replace('"', '\\"') + '"'
+
+    block = f"[[rules]]\nname = {_toml_string(name)}\npattern = {_toml_string(pattern)}\n"
+
+    prefix = ""
+    if path.exists():
+        existing = path.read_text(encoding="utf-8", errors="ignore")
+        if existing and not existing.endswith("\n"):
+            prefix = "\n"
+
+    with open(path, "a", encoding="utf-8", newline="") as f:
+        f.write(f"{prefix}{block}")

{secretshield-0.6.1 → secretshield-0.7.0/secretshield.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secretshield
-Version: 0.6.1
+Version: 0.7.0
 Summary: Stop secrets before they leak -- runtime redaction, multi-language scanning, auto-fix, Git hooks, and CI, all in one CLI.
 Author: Samarth Chugh (Sam3360)
 License-Expression: MIT
@@ -104,6 +104,21 @@ secretshield init
 No required dependencies, no telemetry, no network calls. Everything
 runs locally, in your own process.
 
+## Custom rules
+
+Have a credential format of your own? Drop a
+`.secretshield-rules.toml` in your project root:
+
+```toml
+[[rules]]
+name = "My API Key"
+pattern = "MYAPP_[A-Za-z0-9]{32}"
+```
+
+`secretshield scan .` picks it up automatically — no flag needed.
+Validate the file with `secretshield rules check`, or create a rule
+interactively with `secretshield rule create`.
+
 For the full command reference, configuration options, and exactly how
 Auto-Fix decides what's safe to rewrite, see the
 **[usage guide](https://github.com/Sam3360/secretshield/blob/main/USAGE.md)**.

{secretshield-0.6.1 → secretshield-0.7.0}/secretshield.egg-info/SOURCES.txt

@@ -6,6 +6,7 @@ secretshield/baseline.py
 secretshield/cli.py
 secretshield/color.py
 secretshield/config.py
+secretshield/custom_rules.py
 secretshield/detector.py
 secretshield/guardian.py
 secretshield/ignorefile.py
@@ -33,6 +34,8 @@ tests/test_autofix.py
 tests/test_baseline.py
 tests/test_color.py
 tests/test_color_cli_integration.py
+tests/test_custom_rules.py
+tests/test_custom_rules_cli_integration.py
 tests/test_detector.py
 tests/test_git_hooks.py
 tests/test_github_action.py

secretshield-0.7.0/tests/test_custom_rules.py

@@ -0,0 +1,240 @@
+"""
+Tests for secretshield.custom_rules -- .secretshield-rules.toml loading,
+compiling, and running custom detection rules.
+
+All secrets used are fake / non-functional.
+"""
+
+from __future__ import annotations
+
+from secretshield.custom_rules import (
+    append_rule,
+    load_custom_rules,
+    rules_file_path,
+    scan_text_with_rules,
+)
+
+FAKE_MATCH = "MYAPP_12345678901234567890123456789012"
+
+
+# --- Loading -----------------------------------------------------------------
+
+
+def test_no_rules_file_returns_empty(tmp_path):
+    rules, errors = load_custom_rules(tmp_path)
+    assert rules == []
+    assert errors == []
+
+
+def test_one_rule_loads(tmp_path):
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "My API Key"\npattern = "MYAPP_[A-Za-z0-9]{32}"\n'
+    )
+    rules, errors = load_custom_rules(tmp_path)
+    assert errors == []
+    assert len(rules) == 1
+    assert rules[0].name == "My API Key"
+    assert rules[0].pattern == "MYAPP_[A-Za-z0-9]{32}"
+
+
+def test_multiple_rules_load(tmp_path):
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "Acme API Key"\npattern = "ACME_[A-Za-z0-9]{32}"\n'
+        '[[rules]]\nname = "Internal Token"\npattern = "internal_[a-f0-9]{40}"\n'
+        '[[rules]]\nname = "Company Credential"\npattern = "company_[A-Za-z0-9_-]+"\n'
+    )
+    rules, errors = load_custom_rules(tmp_path)
+    assert errors == []
+    assert [r.name for r in rules] == ["Acme API Key", "Internal Token", "Company Credential"]
+
+
+def test_empty_file_is_valid_no_rules(tmp_path):
+    (tmp_path / ".secretshield-rules.toml").write_text("")
+    rules, errors = load_custom_rules(tmp_path)
+    assert rules == []
+    assert errors == []
+
+
+def test_empty_rules_list_is_valid(tmp_path):
+    (tmp_path / ".secretshield-rules.toml").write_text("rules = []\n")
+    rules, errors = load_custom_rules(tmp_path)
+    assert rules == []
+    assert errors == []
+
+
+def test_rules_file_path_helper(tmp_path):
+    path = rules_file_path(tmp_path)
+    assert path.name == ".secretshield-rules.toml"
+    assert path.parent == tmp_path
+
+
+# --- Detection -----------------------------------------------------------------
+
+
+def test_matching_regex_is_detected(tmp_path):
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "My API Key"\npattern = "MYAPP_[A-Za-z0-9]{32}"\n'
+    )
+    rules, _ = load_custom_rules(tmp_path)
+    text = f'API_KEY = "{FAKE_MATCH}"'
+    matches = scan_text_with_rules(text, rules)
+    assert len(matches) == 1
+    assert matches[0].kind == "My API Key"
+    assert matches[0].value == FAKE_MATCH
+
+
+def test_non_matching_content_is_ignored(tmp_path):
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "My API Key"\npattern = "MYAPP_[A-Za-z0-9]{32}"\n'
+    )
+    rules, _ = load_custom_rules(tmp_path)
+    matches = scan_text_with_rules("nothing interesting here", rules)
+    assert matches == []
+
+
+def test_multiple_rules_detect_multiple_findings(tmp_path):
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "Rule A"\npattern = "AAA_[0-9]{6}"\n'
+        '[[rules]]\nname = "Rule B"\npattern = "BBB_[0-9]{6}"\n'
+    )
+    rules, _ = load_custom_rules(tmp_path)
+    text = "x = AAA_123456\ny = BBB_654321"
+    matches = scan_text_with_rules(text, rules)
+    kinds = sorted(m.kind for m in matches)
+    assert kinds == ["Rule A", "Rule B"]
+
+
+def test_custom_rule_name_appears_as_kind(tmp_path):
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "Stripe Test Key"\npattern = "sk_test_[A-Za-z0-9]+"\n'
+    )
+    rules, _ = load_custom_rules(tmp_path)
+    matches = scan_text_with_rules("key = sk_test_abcdef123456", rules)
+    assert matches[0].kind == "Stripe Test Key"
+
+
+def test_no_rules_scans_nothing(tmp_path):
+    assert scan_text_with_rules("MYAPP_12345678901234567890123456789012", []) == []
+
+
+def test_empty_text_scans_nothing(tmp_path):
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "X"\npattern = "MYAPP_[A-Za-z0-9]{32}"\n'
+    )
+    rules, _ = load_custom_rules(tmp_path)
+    assert scan_text_with_rules("", rules) == []
+
+
+# --- Validation -----------------------------------------------------------------
+
+
+def test_malformed_toml_reports_error(tmp_path):
+    (tmp_path / ".secretshield-rules.toml").write_text("this is [ not valid toml {{{")
+    rules, errors = load_custom_rules(tmp_path)
+    assert rules == []
+    assert len(errors) == 1
+    assert "toml" in errors[0].message.lower() or "expected" in errors[0].message.lower()
+
+
+def test_missing_name_reports_error(tmp_path):
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\npattern = "MYAPP_[A-Za-z0-9]{32}"\n'
+    )
+    rules, errors = load_custom_rules(tmp_path)
+    assert rules == []
+    assert len(errors) == 1
+    assert "name" in errors[0].message.lower()
+
+
+def test_missing_pattern_reports_error(tmp_path):
+    (tmp_path / ".secretshield-rules.toml").write_text('[[rules]]\nname = "Broken Rule"\n')
+    rules, errors = load_custom_rules(tmp_path)
+    assert rules == []
+    assert len(errors) == 1
+    assert errors[0].name == "Broken Rule"
+    assert "pattern" in errors[0].message.lower()
+
+
+def test_invalid_regex_reports_error(tmp_path):
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "Bad Regex"\npattern = "["\n'
+    )
+    rules, errors = load_custom_rules(tmp_path)
+    assert rules == []
+    assert len(errors) == 1
+    assert errors[0].name == "Bad Regex"
+    assert "regular expression" in errors[0].message.lower()
+
+
+def test_invalid_rule_structure_reports_error(tmp_path):
+    (tmp_path / ".secretshield-rules.toml").write_text("rules = [1, 2, 3]\n")
+    rules, errors = load_custom_rules(tmp_path)
+    assert rules == []
+    assert len(errors) == 3
+
+
+def test_one_bad_rule_does_not_block_others(tmp_path):
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "Good Rule"\npattern = "MYAPP_[A-Za-z0-9]{32}"\n'
+        '[[rules]]\nname = "Bad Rule"\npattern = "["\n'
+    )
+    rules, errors = load_custom_rules(tmp_path)
+    assert [r.name for r in rules] == ["Good Rule"]
+    assert len(errors) == 1
+    assert errors[0].name == "Bad Rule"
+
+
+# --- Rule creation -----------------------------------------------------------------
+
+
+def test_append_rule_creates_file_when_missing(tmp_path):
+    path = rules_file_path(tmp_path)
+    assert not path.exists()
+    append_rule(path, "My API Key", "MYAPP_[A-Za-z0-9]{32}")
+    assert path.exists()
+
+
+def test_append_rule_creates_valid_toml(tmp_path):
+    path = rules_file_path(tmp_path)
+    append_rule(path, "My API Key", "MYAPP_[A-Za-z0-9]{32}")
+    rules, errors = load_custom_rules(tmp_path)
+    assert errors == []
+    assert len(rules) == 1
+    assert rules[0].name == "My API Key"
+
+
+def test_append_rule_preserves_existing_rules(tmp_path):
+    path = rules_file_path(tmp_path)
+    append_rule(path, "First Rule", "FIRST_[0-9]{6}")
+    append_rule(path, "Second Rule", "SECOND_[0-9]{6}")
+    rules, errors = load_custom_rules(tmp_path)
+    assert errors == []
+    assert [r.name for r in rules] == ["First Rule", "Second Rule"]
+
+
+def test_append_rule_does_not_overwrite_existing_content(tmp_path):
+    path = rules_file_path(tmp_path)
+    append_rule(path, "First Rule", "FIRST_[0-9]{6}")
+    original = path.read_text()
+    append_rule(path, "Second Rule", "SECOND_[0-9]{6}")
+    updated = path.read_text()
+    assert updated.startswith(original)
+
+
+def test_append_rule_escapes_special_characters(tmp_path):
+    path = rules_file_path(tmp_path)
+    append_rule(path, 'Rule "with" quotes', r'a\b"c')
+    rules, errors = load_custom_rules(tmp_path)
+    assert errors == []
+    assert rules[0].name == 'Rule "with" quotes'
+    assert rules[0].pattern == r'a\b"c'
+
+
+def test_append_rule_never_creates_broken_config(tmp_path):
+    path = rules_file_path(tmp_path)
+    append_rule(path, "Rule One", "ONE_[0-9]{4}")
+    append_rule(path, "Rule Two", "TWO_[0-9]{4}")
+    append_rule(path, "Rule Three", "THREE_[0-9]{4}")
+    rules, errors = load_custom_rules(tmp_path)
+    assert errors == []
+    assert len(rules) == 3

secretshield-0.7.0/tests/test_custom_rules_cli_integration.py

@@ -0,0 +1,305 @@
+"""
+CLI-level integration tests for custom rules: `secretshield scan`
+automatically picking up `.secretshield-rules.toml`, `secretshield
+rules check`, `secretshield rules`, `secretshield rule create`, and
+their interaction with .secretshieldignore, --fix, --json, and
+redaction safety.
+"""
+
+from __future__ import annotations
+
+import json
+
+from secretshield.cli import main
+
+FAKE_MATCH = "MYAPP_12345678901234567890123456789012"
+
+
+# --- Automatic inclusion in scans --------------------------------------------
+
+
+def test_scan_automatically_picks_up_custom_rules(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "My API Key"\npattern = "MYAPP_[A-Za-z0-9]{32}"\n'
+    )
+    (tmp_path / "test.py").write_text(f'value = "{FAKE_MATCH}"\n')
+
+    exit_code = main(["scan", "."])
+    assert exit_code == 1
+
+
+def test_scan_behaves_normally_without_rules_file(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / "test.py").write_text("print('nothing secret here')\n")
+    exit_code = main(["scan", "."])
+    assert exit_code == 0
+
+
+def test_scan_json_includes_custom_rule_name_as_kind(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "My API Key"\npattern = "MYAPP_[A-Za-z0-9]{32}"\n'
+    )
+    (tmp_path / "test.py").write_text(f'value = "{FAKE_MATCH}"\n')
+
+    main(["scan", ".", "--json"])
+    out = capsys.readouterr().out
+    payload = json.loads(out)
+    kinds = [m["kind"] for m in payload["matches"]]
+    assert "My API Key" in kinds
+
+
+def test_scan_no_custom_rules_flag_needed(tmp_path, monkeypatch):
+    # The core requirement: no --custom-rules / --rules-file / etc.
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "My API Key"\npattern = "MYAPP_[A-Za-z0-9]{32}"\n'
+    )
+    (tmp_path / "test.py").write_text(f'value = "{FAKE_MATCH}"\n')
+    # Plain `scan .` with nothing extra must find it.
+    assert main(["scan", "."]) == 1
+
+
+def test_built_in_rules_still_work_alongside_custom(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "My API Key"\npattern = "MYAPP_[A-Za-z0-9]{32}"\n'
+    )
+    aws_key = "AKIAABCDEFGHIJKLMNOP"
+    (tmp_path / "test.py").write_text(f'aws = "{aws_key}"\nother = "{FAKE_MATCH}"\n')
+
+    main(["scan", ".", "--json"])
+    out = capsys.readouterr().out
+    payload = json.loads(out)
+    kinds = {m["kind"] for m in payload["matches"]}
+    assert "aws_access_key_id" in kinds
+    assert "My API Key" in kinds
+
+
+def test_multiple_custom_rules_all_scanned(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "Acme API Key"\npattern = "ACME_[0-9]{6}"\n'
+        '[[rules]]\nname = "Internal Token"\npattern = "internal_[a-f0-9]{8}"\n'
+        '[[rules]]\nname = "Company Credential"\npattern = "company_[A-Za-z0-9_-]+"\n'
+    )
+    (tmp_path / "test.py").write_text(
+        'a = "ACME_123456"\nb = "internal_deadbeef"\nc = "company_secretvalue"\n'
+    )
+    main(["scan", ".", "--json"])
+    out = capsys.readouterr().out
+    payload = json.loads(out)
+    kinds = {m["kind"] for m in payload["matches"]}
+    assert {"Acme API Key", "Internal Token", "Company Credential"}.issubset(kinds)
+
+
+# --- Broken rules file doesn't block a scan ---------------------------------
+
+
+def test_broken_custom_rules_does_not_block_scan(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "Bad Rule"\npattern = "["\n'
+    )
+    (tmp_path / "clean.py").write_text("print('hello')\n")
+    exit_code = main(["scan", "."])
+    assert exit_code == 0  # scan still runs
+    err = capsys.readouterr().err
+    assert "rules check" in err  # points the user at how to see details
+
+
+# --- `secretshield rules check` ---------------------------------------------
+
+
+def test_rules_check_no_file(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    exit_code = main(["rules", "check"])
+    assert exit_code == 0
+    out = capsys.readouterr().out
+    assert "No .secretshield-rules.toml found" in out
+
+
+def test_rules_check_success(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "A"\npattern = "AAA_[0-9]{4}"\n'
+        '[[rules]]\nname = "B"\npattern = "BBB_[0-9]{4}"\n'
+    )
+    exit_code = main(["rules", "check"])
+    assert exit_code == 0
+    out = capsys.readouterr().out
+    assert "2 rule(s) loaded" in out
+    assert "All patterns are valid" in out
+
+
+def test_rules_check_reports_errors(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "Internal Token"\npattern = "["\n'
+    )
+    exit_code = main(["rules", "check"])
+    assert exit_code == 1
+    out = capsys.readouterr().out
+    assert "Internal Token" in out
+    assert "regular expression" in out.lower()
+
+
+def test_rules_check_never_dumps_traceback(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text("not [ valid toml {{{")
+    exit_code = main(["rules", "check"])
+    assert exit_code == 1
+    out = capsys.readouterr().out
+    assert "Traceback" not in out
+
+
+# --- `secretshield rules` (list) --------------------------------------------
+
+
+def test_rules_list_shows_rules(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "My API Key"\npattern = "MYAPP_[A-Za-z0-9]{32}"\n'
+    )
+    main(["rules"])
+    out = capsys.readouterr().out
+    assert "My API Key" in out
+    assert "MYAPP_[A-Za-z0-9]{32}" in out
+
+
+def test_rules_list_no_file(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    exit_code = main(["rules"])
+    assert exit_code == 0
+    out = capsys.readouterr().out
+    assert "No .secretshield-rules.toml found" in out
+
+
+# --- `secretshield rule create` ---------------------------------------------
+
+
+def test_rule_create_non_interactive_refuses(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    exit_code = main(["rule", "create"])
+    assert exit_code == 1
+    assert not (tmp_path / ".secretshield-rules.toml").exists()
+
+
+def test_rule_no_subcommand_shows_message(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    exit_code = main(["rule"])
+    assert exit_code == 1
+
+
+# --- .secretshieldignore interaction ----------------------------------------
+
+
+def test_ignored_files_not_scanned_by_custom_rules(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "My API Key"\npattern = "MYAPP_[A-Za-z0-9]{32}"\n'
+    )
+    (tmp_path / ".secretshieldignore").write_text("ignored/\n")
+    (tmp_path / "ignored").mkdir()
+    (tmp_path / "ignored" / "secret.py").write_text(f'x = "{FAKE_MATCH}"\n')
+    (tmp_path / "clean.py").write_text("print('clean')\n")
+
+    exit_code = main(["scan", "."])
+    assert exit_code == 0
+
+
+def test_non_ignored_file_still_caught_by_custom_rule(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "My API Key"\npattern = "MYAPP_[A-Za-z0-9]{32}"\n'
+    )
+    (tmp_path / ".secretshieldignore").write_text("ignored/\n")
+    (tmp_path / "ignored").mkdir()
+    (tmp_path / "ignored" / "secret.py").write_text(f'x = "{FAKE_MATCH}"\n')
+    (tmp_path / "not_ignored.py").write_text(f'x = "{FAKE_MATCH}"\n')
+
+    exit_code = main(["scan", "."])
+    assert exit_code == 1
+
+
+# --- Redaction / no-leak safety ----------------------------------------------
+
+
+def test_custom_rule_value_never_printed_in_scan_output(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "My API Key"\npattern = "MYAPP_[A-Za-z0-9]{32}"\n'
+    )
+    (tmp_path / "test.py").write_text(f'x = "{FAKE_MATCH}"\n')
+
+    main(["scan", "."])
+    out = capsys.readouterr().out
+    assert FAKE_MATCH not in out
+
+
+def test_custom_rule_value_never_in_json_output(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "My API Key"\npattern = "MYAPP_[A-Za-z0-9]{32}"\n'
+    )
+    (tmp_path / "test.py").write_text(f'x = "{FAKE_MATCH}"\n')
+
+    main(["scan", ".", "--json"])
+    out = capsys.readouterr().out
+    assert FAKE_MATCH not in out
+
+
+# --- --fix integration -------------------------------------------------------
+
+
+def test_fix_moves_safe_custom_rule_match_to_env(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "My API Key"\npattern = "MYAPP_[A-Za-z0-9]{32}"\n'
+    )
+    app = tmp_path / "app.py"
+    app.write_text(f'CUSTOM_KEY = "{FAKE_MATCH}"\n')
+
+    import secretshield.autofix.fixer as fixer_mod
+
+    monkeypatch.setattr(fixer_mod, "is_interactive", lambda: True)
+    answers = iter(["y", ""])
+    monkeypatch.setattr("builtins.input", lambda prompt="": next(answers))
+
+    exit_code = main(["scan", ".", "--fix"])
+    assert exit_code == 0
+    assert FAKE_MATCH not in app.read_text()
+    assert FAKE_MATCH in (tmp_path / ".env").read_text()
+
+
+def test_fix_leaves_ambiguous_custom_rule_match_untouched(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "My API Key"\npattern = "MYAPP_[A-Za-z0-9]{32}"\n'
+    )
+    app = tmp_path / "app.py"
+    original = f'headers = {{"X-Key": "{FAKE_MATCH}"}}\n'
+    app.write_text(original)
+
+    import secretshield.autofix.fixer as fixer_mod
+
+    monkeypatch.setattr(fixer_mod, "is_interactive", lambda: True)
+    monkeypatch.setattr("builtins.input", lambda prompt="": (_ for _ in ()).throw(AssertionError))
+
+    main(["scan", ".", "--fix"])
+    assert app.read_text() == original
+
+
+# --- Compatibility ------------------------------------------------------------
+
+
+def test_built_in_only_scan_unaffected_by_absent_rules_file(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    aws_key = "AKIAABCDEFGHIJKLMNOP"
+    (tmp_path / "test.py").write_text(f'x = "{aws_key}"\n')
+    main(["scan", ".", "--json"])
+    out = capsys.readouterr().out
+    payload = json.loads(out)
+    assert payload["secrets_found"] == 1
+    assert payload["matches"][0]["kind"] == "aws_access_key_id"