server-management-lib 0.2.0__tar.gz → 0.2.1__tar.gz

{server_management_lib-0.2.0 → server_management_lib-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: server-management-lib
-Version: 0.2.0
+Version: 0.2.1
 Summary: Shared security, SSH/local execution, configuration and HTTP clients for the Server MCP suite.
 Author-email: Alessio Elmi <alessio.elmi@gmail.com>
 License-Expression: MIT

{server_management_lib-0.2.0 → server_management_lib-0.2.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "server-management-lib"
-version = "0.2.0"
+version = "0.2.1"
 description = "Shared security, SSH/local execution, configuration and HTTP clients for the Server MCP suite."
 readme = "README.md"
 license = "MIT"

{server_management_lib-0.2.0 → server_management_lib-0.2.1}/src/server_management_lib/__init__.py

@@ -121,4 +121,4 @@ __all__ = [
     "validate_http_binding",
 ]
 
-__version__ = "0.2.0"
+__version__ = "0.2.1"

{server_management_lib-0.2.0 → server_management_lib-0.2.1}/src/server_management_lib/redaction.py

@@ -63,16 +63,37 @@ def redact_env_content(text: str) -> str:
 # General secret redaction (service config files and host status/log output)
 # ============================================================================
 
-# Key names whose values are secrets. Matching is on the key itself, so
-# ``POSTGRES_PASSWORD``, ``GITHUB_TOKEN`` and ``api_key`` are covered without
-# treating unrelated ``*.key`` file names as secrets (that policy lives in
-# ``security.BLOCKED_PATH_*``).
-_SENSITIVE_KEY_WORD = re.compile(
-    r"(?:password|passwd|pwd|secret|token|api[_-]?key|private[_-]?key|"
-    r"authorization|access[_-]?key|client[_-]?secret|credential)",
-    re.IGNORECASE,
+# Key names whose values are secrets. Keys are split into words on separators
+# (``_``, ``-``, ``.``, ...) and each word is checked, so ``POSTGRES_PASSWORD``,
+# ``GITHUB_TOKEN``, ``api_key``, ``db-pass`` and a bare INI ``pass`` are covered
+# without treating unrelated ``*.key`` file names as secrets (that policy lives
+# in ``security.BLOCKED_PATH_*``).
+#
+# Short generic names are matched as word suffixes rather than substrings:
+# ``dbpass``/``smtpPass`` are credentials, while ``tokenizer`` and ``keyboard``
+# are not. The trade-off is deliberate: ``bypass`` is masked too, because a
+# spurious mask is harmless and a missed credential is not.
+_SENSITIVE_KEY_WORDS: tuple[str, ...] = (
+    "auth",
+    "authorization",
+    "credential",
+    "credentials",
+    "key",
+    "pass",
+    "passphrase",
+    "passwd",
+    "password",
+    "pw",
+    "pwd",
+    "secret",
+    "secrets",
+    "token",
+    "tokens",
 )
 
+# Word separators used when normalizing a key (``db_pass`` -> ``db``, ``pass``).
+_KEY_SEPARATOR = re.compile(r"[^A-Za-z0-9]+")
+
 # JSON object member: "key": "value" or "key": value
 _JSON_MEMBER = re.compile(
     r'(?P<prefix>"(?P<key>[^"\n]+)"\s*:\s*)'
@@ -108,10 +129,23 @@ _URL_PASSWORD = re.compile(
 )
 
 
+def _key_words(key: str) -> list[str]:
+    """Split a normalized key into lowercase words on non-alphanumerics."""
+    return [word.lower() for word in _KEY_SEPARATOR.split(key) if word]
+
+
 def _is_sensitive_key(key: str) -> bool:
-    """Return True when an assignment key names a credential."""
-    cleaned = key.strip().strip("\"'").lstrip("-")
-    return bool(cleaned) and _SENSITIVE_KEY_WORD.search(cleaned) is not None
+    """Return True when an assignment key names a credential.
+
+    The key is normalized (quotes and leading CLI dashes removed) and split
+    into words. A word matches when it equals a sensitive name or ends with
+    one, so separators and concatenation (``api_key``, ``apikey``,
+    ``db-pass``, ``dbpass``) are all recognized.
+    """
+    cleaned = key.strip().strip("\"'").lstrip("-").strip()
+    if not cleaned:
+        return False
+    return any(word.endswith(_SENSITIVE_KEY_WORDS) for word in _key_words(cleaned))
 
 
 def _redact_line(line: str) -> str:

{server_management_lib-0.2.0 → server_management_lib-0.2.1}/src/server_management_lib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: server-management-lib
-Version: 0.2.0
+Version: 0.2.1
 Summary: Shared security, SSH/local execution, configuration and HTTP clients for the Server MCP suite.
 Author-email: Alessio Elmi <alessio.elmi@gmail.com>
 License-Expression: MIT

{server_management_lib-0.2.0 → server_management_lib-0.2.1}/tests/test_redaction.py

@@ -1,5 +1,7 @@
 """Tests for the file-content redaction helpers."""
 
+import pytest
+
 from server_management_lib.redaction import REDACTED_VALUE, redact_env_content
 
 
@@ -130,3 +132,67 @@ class TestRedactSecrets:
         text = "# token=comment\nmonkey.txt is readable\n"
 
         assert redact_secrets(text) == text
+
+    def test_ini_short_password_key_is_masked(self):
+        from server_management_lib.redaction import redact_secrets
+
+        text = "[mail]\npass = hunter2\nuser = bob\n"
+
+        result = redact_secrets(text)
+
+        assert "hunter2" not in result
+        assert "[mail]" in result
+        assert "user = bob" in result
+        assert result.splitlines()[1] == f"pass = {REDACTED_VALUE}"
+
+    @pytest.mark.parametrize(
+        "key",
+        [
+            "pass",
+            "PASS",
+            "Pass",
+            "pw",
+            "pwd",
+            "passphrase",
+            "passwd",
+            "db_pass",
+            "db-pass",
+            "dbpass",
+            "smtpPass",
+            "api_key",
+            "apikey",
+            "apiKey",
+            "auth_token",
+            "authToken",
+            "secret_key",
+            "client_secret",
+            "credentials",
+        ],
+    )
+    def test_credential_key_spellings_are_masked(self, key):
+        from server_management_lib.redaction import redact_secrets
+
+        result = redact_secrets(f"{key} = hunter2")
+
+        assert "hunter2" not in result, f"leaked value for key {key!r}: {result}"
+        assert result == f"{key} = {REDACTED_VALUE}"
+
+    @pytest.mark.parametrize(
+        "key",
+        ["user", "username", "host", "port", "tokenizer", "keyboard", "mode"],
+    )
+    def test_non_credential_keys_stay_readable(self, key):
+        from server_management_lib.redaction import redact_secrets
+
+        assert redact_secrets(f"{key} = visible") == f"{key} = visible"
+
+    def test_short_password_key_is_masked_in_yaml_and_json(self):
+        from server_management_lib.redaction import redact_secrets
+
+        yaml_result = redact_secrets("  pass: hunter2\n")
+        json_result = redact_secrets('{"pass": "hunter2"}')
+
+        assert "hunter2" not in yaml_result
+        assert f"pass: {REDACTED_VALUE}" in yaml_result
+        assert "hunter2" not in json_result
+        assert f'"pass": "{REDACTED_VALUE}"' in json_result