1package domain
2
3import (
4 "testing"
5
6 "github.com/stretchr/testify/assert"
7)
8
9func TestRedactSecrets(t *testing.T) {
10 tests := []struct {
11 name string
12 in string
13 want string
14 }{
15 {"password env", "PASSWORD=hunter2", "PASSWORD=[REDACTED]"},
16 {"token env", "TOKEN=abc123", "TOKEN=[REDACTED]"},
17 {"secret env", "SECRET=shh", "SECRET=[REDACTED]"},
18 {"api key env", "API_KEY=key-value", "API_KEY=[REDACTED]"},
19 {"database url env", "DATABASE_URL=postgres://user:pass@db/app", "DATABASE_URL=[REDACTED]"},
20 {"quoted password env with spaces", `PASSWORD="hunter 2"`, "PASSWORD=[REDACTED]"},
21 {"single quoted token env with spaces", `TOKEN='abc 123'`, "TOKEN=[REDACTED]"},
22 {"json password field", `{"PASSWORD":"hunter2","ok":"value"}`, `{"PASSWORD":"[REDACTED]","ok":"value"}`},
23 {"json token field with spaces", `{"TOKEN": "abc123"}`, `{"TOKEN": "[REDACTED]"}`},
24 {"case insensitive", "database_url=postgres://user:pass@db/app", "database_url=[REDACTED]"},
25 {"prefixed password env", "POSTGRES_PASSWORD=hunter2", "POSTGRES_PASSWORD=[REDACTED]"},
26 {"prefixed token env", "GORDON_TOKEN=abc123", "GORDON_TOKEN=[REDACTED]"},
27 {"secret key env", "SECRET_KEY=shh", "SECRET_KEY=[REDACTED]"},
28 {"api token env", "API_TOKEN=abc123", "API_TOKEN=[REDACTED]"},
29 {"authorization bearer", "Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.secret", "Authorization: Bearer [REDACTED]"},
30 {"json prefixed password field", `{"POSTGRES_PASSWORD":"hunter2"}`, `{"POSTGRES_PASSWORD":"[REDACTED]"}`},
31 {"json secret key field", `{"secret_key": "shh"}`, `{"secret_key": "[REDACTED]"}`},
32 }
33
34 for _, tt := range tests {
35 t.Run(tt.name, func(t *testing.T) {
36 assert.Equal(t, tt.want, RedactSecrets(tt.in))
37 })
38 }
39}
40
41func TestRedactSecretLinesPreservesEmptySlice(t *testing.T) {
42 assert.Nil(t, RedactSecretLines(nil))
43 assert.Empty(t, RedactSecretLines([]string{}))
44 assert.NotNil(t, RedactSecretLines([]string{}))
45}