48 lines
1.8 KiB
JavaScript
48 lines
1.8 KiB
JavaScript
|
import { test } from 'node:test'
|
||
|
|
import assert from 'node:assert/strict'
|
||
|
|
|
||
|
|
import { redact, redactDeep } from '../src/redact.mjs'
|
||
|
|
|
||
|
|
test('redact masks bearer tokens and provider keys', () => {
|
||
|
|
const out = redact('Authorization: Bearer abcdef1234567890 and sk-1234567890abcdefghij')
|
||
|
|
assert.doesNotMatch(out, /abcdef1234567890/)
|
||
|
|
assert.doesNotMatch(out, /sk-1234567890abcdefghij/)
|
||
|
|
assert.match(out, /Bearer \[REDACTED\]/)
|
||
|
|
assert.match(out, /\[REDACTED\]/)
|
||
|
|
})
|
||
|
|
|
||
|
|
test('redact keeps key names but drops values', () => {
|
||
|
|
const out = redact('token=supersecretvalue password: "hunter2" api_key=ABCDEF123456')
|
||
|
|
assert.match(out, /token=\[REDACTED\]/)
|
||
|
|
assert.match(out, /password: "\[REDACTED\]/)
|
||
|
|
assert.match(out, /api_key=\[REDACTED\]/)
|
||
|
|
assert.doesNotMatch(out, /supersecretvalue|hunter2|ABCDEF123456/)
|
||
|
|
})
|
||
|
|
|
||
|
|
test('redact strips credentials embedded in URLs', () => {
|
||
|
|
const out = redact('remote https://user:tok3n@forgejo.example.com/repo.git')
|
||
|
|
assert.doesNotMatch(out, /tok3n/)
|
||
|
|
assert.match(out, /https:\/\/\[REDACTED\]@forgejo\.example\.com/)
|
||
|
|
})
|
||
|
|
|
||
|
|
test('redact masks JWTs and github tokens', () => {
|
||
|
|
const jwt = 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.signaturepart'
|
||
|
|
const out = redact(`${jwt} ghp_abcdefghijklmnopqrstuvwxyz012345`)
|
||
|
|
assert.doesNotMatch(out, /eyJhbGciOiJIUzI1NiJ9/)
|
||
|
|
assert.doesNotMatch(out, /ghp_abcdefghijklmnopqrstuvwxyz012345/)
|
||
|
|
})
|
||
|
|
|
||
|
|
test('redact leaves ordinary text untouched', () => {
|
||
|
|
assert.equal(redact('pnpm test passed: 34/34'), 'pnpm test passed: 34/34')
|
||
|
|
assert.equal(redact(42), 42)
|
||
|
|
})
|
||
|
|
|
||
|
|
test('redactDeep walks objects without mutating the input', () => {
|
||
|
|
const input = { a: 'Bearer xxxxxxxxxxxxxxxx', b: ['token=zzzzzzzz'], c: 1 }
|
||
|
|
const out = redactDeep(input)
|
||
|
|
assert.equal(input.a, 'Bearer xxxxxxxxxxxxxxxx')
|
||
|
|
assert.match(out.a, /\[REDACTED\]/)
|
||
|
|
assert.match(out.b[0], /token=\[REDACTED\]/)
|
||
|
|
assert.equal(out.c, 1)
|
||
|
|
})
|