mi
32 lines
952 B
Python
32 lines
952 B
Python
from app.logging_security import REDACTED, redact_event, sanitize_text
|
|
|
|
|
|
def test_redacts_sensitive_fields_recursively() -> None:
|
|
event = {
|
|
"authorization": "Bearer top-secret",
|
|
"nested": {
|
|
"database_url": "postgresql://user:password@db/app",
|
|
"safe": "kept",
|
|
},
|
|
}
|
|
|
|
redacted = redact_event(None, "info", event)
|
|
|
|
assert redacted["authorization"] == REDACTED
|
|
assert redacted["nested"]["database_url"] == REDACTED
|
|
assert redacted["nested"]["safe"] == "kept"
|
|
|
|
|
|
def test_redacts_credentials_embedded_in_text() -> None:
|
|
value = (
|
|
"POST https://callback-user:callback-password@example.test/cb"
|
|
"?token=query-secret Authorization=Bearer header-secret"
|
|
)
|
|
|
|
redacted = sanitize_text(value)
|
|
|
|
assert "callback-password" not in redacted
|
|
assert "query-secret" not in redacted
|
|
assert "header-secret" not in redacted
|
|
assert redacted.count(REDACTED) == 3
|