Перенесены секреты из .env в SM

codebase/backend/api-backend/tests/unit/test_logging_security.py

@@ -0,0 +1,31 @@
+from app.logging_security import REDACTED, redact_event, sanitize_text
+
+
+def test_redacts_sensitive_fields_recursively() -> None:
+    event = {
+        "authorization": "Bearer top-secret",
+        "nested": {
+            "database_url": "postgresql://user:password@db/app",
+            "safe": "kept",
+        },
+    }
+
+    redacted = redact_event(None, "info", event)
+
+    assert redacted["authorization"] == REDACTED
+    assert redacted["nested"]["database_url"] == REDACTED
+    assert redacted["nested"]["safe"] == "kept"
+
+
+def test_redacts_credentials_embedded_in_text() -> None:
+    value = (
+        "POST https://callback-user:callback-password@example.test/cb"
+        "?token=query-secret Authorization=Bearer header-secret"
+    )
+
+    redacted = sanitize_text(value)
+
+    assert "callback-password" not in redacted
+    assert "query-secret" not in redacted
+    assert "header-secret" not in redacted
+    assert redacted.count(REDACTED) == 3