1package publictls
2
3import (
4 "testing"
5
6 "github.com/stretchr/testify/assert"
7)
8
9func TestSanitizeError_Empty(t *testing.T) {
10 assert.Equal(t, "", sanitizeError(""))
11}
12
13func TestSanitizeError_NoSensitiveData(t *testing.T) {
14 msg := "failed to obtain certificate: acme server returned 429"
15 assert.Equal(t, msg, sanitizeError(msg))
16}
17
18func TestSanitizeError_KeyEqValue(t *testing.T) {
19 result := sanitizeError("token=sk-secret-goes-here provider said invalid")
20 assert.NotContains(t, result, "sk-secret-goes-here")
21 assert.Contains(t, result, "token=redacted")
22}
23
24func TestSanitizeError_KeyEqQuotedValue(t *testing.T) {
25 result := sanitizeError(`secret="my-secret-value" is invalid`)
26 assert.NotContains(t, result, "my-secret-value")
27 assert.Contains(t, result, `secret="redacted"`)
28}
29
30func TestSanitizeError_KeyEqSingleQuotedValue(t *testing.T) {
31 result := sanitizeError(`key='my-api-key-12345' not found`)
32 assert.NotContains(t, result, "my-api-key-12345")
33 assert.Contains(t, result, "key='redacted'")
34}
35
36func TestSanitizeError_JSONKeyValue(t *testing.T) {
37 result := sanitizeError(`{"token":"s3kr1t","domain":"example.com"}`)
38 assert.NotContains(t, result, "s3kr1t")
39 assert.Contains(t, result, `"token":"redacted"`)
40 // Non-sensitive fields should be preserved
41 assert.Contains(t, result, `"domain":"example.com"`)
42}
43
44func TestSanitizeError_YAMLKeyValue(t *testing.T) {
45 result := sanitizeError("configuration error:\n api_key: abcdef123456\n password: hunter2")
46 assert.NotContains(t, result, "abcdef123456")
47 assert.NotContains(t, result, "hunter2")
48 assert.Contains(t, result, "api_key: redacted")
49 assert.Contains(t, result, "password: redacted")
50 // Non-sensitive context preserved
51 assert.Contains(t, result, "configuration error:")
52}
53
54func TestSanitizeError_CaseInsensitive(t *testing.T) {
55 result := sanitizeError("Token=sk-live-abc123 and SECRET=top-secret-value")
56 assert.NotContains(t, result, "sk-live-abc123")
57 assert.NotContains(t, result, "top-secret-value")
58 assert.Contains(t, result, "Token=redacted")
59 assert.Contains(t, result, "SECRET=redacted")
60}
61
62func TestSanitizeError_MixedFormats(t *testing.T) {
63 result := sanitizeError(`token=plain, secret="quoted", auth='single-quoted', and json {"password":"p4ss"}`)
64 assert.NotContains(t, result, "plain")
65 assert.NotContains(t, result, "quoted")
66 assert.NotContains(t, result, "single-quoted")
67 assert.NotContains(t, result, "p4ss")
68 assert.Contains(t, result, "token=redacted")
69 assert.Contains(t, result, `secret="redacted"`)
70 assert.Contains(t, result, "auth='redacted'")
71 assert.Contains(t, result, `"password":"redacted"`)
72}
73
74func TestSanitizeError_PreservesSafeContext(t *testing.T) {
75 msg := "certificate for example.com failed: acme error 403"
76 assert.Equal(t, msg, sanitizeError(msg))
77}