|
| 1 | +"""Tests for secret scanning metric collection.""" |
| 2 | + |
| 3 | +import json |
| 4 | +from pathlib import Path |
| 5 | + |
| 6 | +import pytest |
| 7 | + |
| 8 | +from pyqual._gate_collectors import _from_secrets |
| 9 | + |
| 10 | + |
| 11 | +class TestSecretsCollector: |
| 12 | + """Test secret scanning metric collection from secrets.json.""" |
| 13 | + |
| 14 | + def test_no_secrets_file_returns_empty(self, tmp_path: Path) -> None: |
| 15 | + """When no secrets.json exists, return empty dict.""" |
| 16 | + result = _from_secrets(tmp_path) |
| 17 | + assert result == {} |
| 18 | + |
| 19 | + def test_simple_secrets_list_parsed(self, tmp_path: Path) -> None: |
| 20 | + """Parse simple list format with severity field.""" |
| 21 | + pyqual_dir = tmp_path / ".pyqual" |
| 22 | + pyqual_dir.mkdir() |
| 23 | + |
| 24 | + secrets_data = [ |
| 25 | + {"severity": "high", "description": "AWS key"}, |
| 26 | + {"severity": "critical", "description": "Private key"}, |
| 27 | + ] |
| 28 | + |
| 29 | + (pyqual_dir / "secrets.json").write_text(json.dumps(secrets_data)) |
| 30 | + |
| 31 | + result = _from_secrets(tmp_path) |
| 32 | + |
| 33 | + assert result["secrets_count"] == 2.0 |
| 34 | + assert result["secrets_found"] == 2.0 |
| 35 | + assert result["secrets_severity"] == 4.0 # max(critical=4, high=3) |
| 36 | + |
| 37 | + def test_gitleaks_format_parsed(self, tmp_path: Path) -> None: |
| 38 | + """Parse gitleaks JSON output format - requires lowercase severity key.""" |
| 39 | + pyqual_dir = tmp_path / ".pyqual" |
| 40 | + pyqual_dir.mkdir() |
| 41 | + |
| 42 | + # Note: gitleaks uses "Severity" with capital S, but collector needs "severity" |
| 43 | + # This test shows what works with current implementation |
| 44 | + secrets_data = [ |
| 45 | + {"description": "AWS Access Key", "severity": "high"}, |
| 46 | + {"description": "GitHub Token", "severity": "medium"}, |
| 47 | + {"description": "Private Key", "severity": "critical"}, |
| 48 | + ] |
| 49 | + |
| 50 | + (pyqual_dir / "secrets.json").write_text(json.dumps(secrets_data)) |
| 51 | + |
| 52 | + result = _from_secrets(tmp_path) |
| 53 | + |
| 54 | + assert result["secrets_count"] == 3.0 |
| 55 | + assert result["secrets_found"] == 3.0 |
| 56 | + assert result["secrets_severity"] == 4.0 # max severity = critical=4 |
| 57 | + |
| 58 | + def test_empty_secrets_returns_zero(self, tmp_path: Path) -> None: |
| 59 | + """When secrets.json exists but is empty, return zeros.""" |
| 60 | + pyqual_dir = tmp_path / ".pyqual" |
| 61 | + pyqual_dir.mkdir() |
| 62 | + |
| 63 | + (pyqual_dir / "secrets.json").write_text(json.dumps([])) |
| 64 | + |
| 65 | + result = _from_secrets(tmp_path) |
| 66 | + |
| 67 | + assert result["secrets_count"] == 0.0 |
| 68 | + assert result["secrets_found"] == 0.0 |
| 69 | + assert result["secrets_severity"] == 0.0 |
| 70 | + |
| 71 | + def test_invalid_json_returns_empty(self, tmp_path: Path) -> None: |
| 72 | + """When secrets.json is invalid, return empty dict.""" |
| 73 | + pyqual_dir = tmp_path / ".pyqual" |
| 74 | + pyqual_dir.mkdir() |
| 75 | + |
| 76 | + (pyqual_dir / "secrets.json").write_text("invalid json {") |
| 77 | + |
| 78 | + result = _from_secrets(tmp_path) |
| 79 | + assert result == {} |
| 80 | + |
| 81 | + def test_severity_mapping(self, tmp_path: Path) -> None: |
| 82 | + """Test that severity levels are correctly mapped to weights.""" |
| 83 | + pyqual_dir = tmp_path / ".pyqual" |
| 84 | + pyqual_dir.mkdir() |
| 85 | + |
| 86 | + secrets_data = [ |
| 87 | + {"severity": "critical"}, |
| 88 | + {"severity": "high"}, |
| 89 | + {"severity": "medium"}, |
| 90 | + {"severity": "low"}, |
| 91 | + {"severity": "info"}, # unknown severity |
| 92 | + ] |
| 93 | + |
| 94 | + (pyqual_dir / "secrets.json").write_text(json.dumps(secrets_data)) |
| 95 | + |
| 96 | + result = _from_secrets(tmp_path) |
| 97 | + |
| 98 | + assert result["secrets_count"] == 5.0 |
| 99 | + assert result["secrets_found"] == 5.0 |
| 100 | + # max severity: critical=4, high=3, medium=2, low=1, unknown=0 |
| 101 | + assert result["secrets_severity"] == 4.0 |
| 102 | + |
| 103 | + def test_case_insensitive_severity(self, tmp_path: Path) -> None: |
| 104 | + """Severity matching should be case-insensitive.""" |
| 105 | + pyqual_dir = tmp_path / ".pyqual" |
| 106 | + pyqual_dir.mkdir() |
| 107 | + |
| 108 | + secrets_data = [ |
| 109 | + {"severity": "HIGH"}, # uppercase |
| 110 | + {"Severity": "Medium"}, # different key case - won't be read |
| 111 | + {"severity": "critical"}, |
| 112 | + ] |
| 113 | + |
| 114 | + (pyqual_dir / "secrets.json").write_text(json.dumps(secrets_data)) |
| 115 | + |
| 116 | + result = _from_secrets(tmp_path) |
| 117 | + |
| 118 | + assert result["secrets_count"] == 3.0 |
| 119 | + # Only lowercase 'severity' key is checked |
| 120 | + # HIGH -> high=3, critical=4, Medium not found |
| 121 | + assert result["secrets_severity"] == 4.0 |
| 122 | + |
| 123 | + def test_dict_format_not_supported(self, tmp_path: Path) -> None: |
| 124 | + """Dict format (e.g., with 'findings' key) is not supported yet.""" |
| 125 | + pyqual_dir = tmp_path / ".pyqual" |
| 126 | + pyqual_dir.mkdir() |
| 127 | + |
| 128 | + # Dict format is not processed - only list format |
| 129 | + secrets_data = { |
| 130 | + "findings": [ |
| 131 | + {"severity": "high"}, |
| 132 | + {"severity": "critical"}, |
| 133 | + ] |
| 134 | + } |
| 135 | + |
| 136 | + (pyqual_dir / "secrets.json").write_text(json.dumps(secrets_data)) |
| 137 | + |
| 138 | + result = _from_secrets(tmp_path) |
| 139 | + # Dict format returns empty - not processed |
| 140 | + assert result == {} |
0 commit comments