|
| 1 | +package redact |
| 2 | + |
| 3 | +import ( |
| 4 | + "strings" |
| 5 | + "testing" |
| 6 | +) |
| 7 | + |
| 8 | +func TestRedactBody_Email(t *testing.T) { |
| 9 | + r := New() |
| 10 | + got := r.RedactBody(`{"email":"alice@example.com","name":"Alice"}`) |
| 11 | + if strings.Contains(got, "alice@example.com") { |
| 12 | + t.Errorf("email not redacted: %s", got) |
| 13 | + } |
| 14 | + if !strings.Contains(got, "[EMAIL]") { |
| 15 | + t.Errorf("expected [EMAIL] placeholder: %s", got) |
| 16 | + } |
| 17 | + if !strings.Contains(got, "Alice") { |
| 18 | + t.Errorf("name should be preserved: %s", got) |
| 19 | + } |
| 20 | +} |
| 21 | + |
| 22 | +func TestRedactBody_CreditCard(t *testing.T) { |
| 23 | + r := New() |
| 24 | + got := r.RedactBody(`{"card":"4111-1111-1111-1111","amount":99}`) |
| 25 | + if strings.Contains(got, "4111") { |
| 26 | + t.Errorf("card not redacted: %s", got) |
| 27 | + } |
| 28 | + if !strings.Contains(got, "[CARD]") { |
| 29 | + t.Errorf("expected [CARD]: %s", got) |
| 30 | + } |
| 31 | +} |
| 32 | + |
| 33 | +func TestRedactBody_BearerToken(t *testing.T) { |
| 34 | + r := New() |
| 35 | + got := r.RedactBody(`{"auth":"Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.abc123"}`) |
| 36 | + if strings.Contains(got, "eyJhbGci") { |
| 37 | + t.Errorf("bearer token not redacted: %s", got) |
| 38 | + } |
| 39 | +} |
| 40 | + |
| 41 | +func TestRedactBody_AWSKey(t *testing.T) { |
| 42 | + r := New() |
| 43 | + got := r.RedactBody(`{"key":"AKIAIOSFODNN7EXAMPLE"}`) |
| 44 | + if strings.Contains(got, "AKIAIOSFODNN7EXAMPLE") { |
| 45 | + t.Errorf("AWS key not redacted: %s", got) |
| 46 | + } |
| 47 | +} |
| 48 | + |
| 49 | +func TestRedactBody_NoSecrets(t *testing.T) { |
| 50 | + r := New() |
| 51 | + input := `{"name":"Alice","age":30,"active":true}` |
| 52 | + got := r.RedactBody(input) |
| 53 | + if got != input { |
| 54 | + t.Errorf("clean body should be unchanged: %s", got) |
| 55 | + } |
| 56 | +} |
| 57 | + |
| 58 | +func TestRedactHeaders_Authorization(t *testing.T) { |
| 59 | + r := New() |
| 60 | + headers := map[string][]string{ |
| 61 | + "Authorization": {"Bearer sk-abc123xyz"}, |
| 62 | + "Content-Type": {"application/json"}, |
| 63 | + } |
| 64 | + got := r.RedactHeaders(headers) |
| 65 | + if got["Authorization"][0] != "[REDACTED]" { |
| 66 | + t.Errorf("auth header not redacted: %s", got["Authorization"][0]) |
| 67 | + } |
| 68 | + if got["Content-Type"][0] != "application/json" { |
| 69 | + t.Errorf("content-type should be unchanged: %s", got["Content-Type"][0]) |
| 70 | + } |
| 71 | +} |
| 72 | + |
| 73 | +func TestRedactHeaders_Cookie(t *testing.T) { |
| 74 | + r := New() |
| 75 | + headers := map[string][]string{ |
| 76 | + "Cookie": {"session=abc123; token=xyz789"}, |
| 77 | + "Set-Cookie": {"session=new123; Path=/"}, |
| 78 | + } |
| 79 | + got := r.RedactHeaders(headers) |
| 80 | + if got["Cookie"][0] != "[REDACTED]" { |
| 81 | + t.Errorf("cookie not redacted: %s", got["Cookie"][0]) |
| 82 | + } |
| 83 | + if got["Set-Cookie"][0] != "[REDACTED]" { |
| 84 | + t.Errorf("set-cookie not redacted: %s", got["Set-Cookie"][0]) |
| 85 | + } |
| 86 | +} |
| 87 | + |
| 88 | +func TestHasSensitiveContent(t *testing.T) { |
| 89 | + r := New() |
| 90 | + if !r.HasSensitiveContent("alice@test.com") { |
| 91 | + t.Error("should detect email") |
| 92 | + } |
| 93 | + if !r.HasSensitiveContent("AKIAIOSFODNN7EXAMPLE") { |
| 94 | + t.Error("should detect AWS key") |
| 95 | + } |
| 96 | + if r.HasSensitiveContent("just a normal string") { |
| 97 | + t.Error("should not flag normal text") |
| 98 | + } |
| 99 | +} |
| 100 | + |
| 101 | +func TestRedactBody_SSN(t *testing.T) { |
| 102 | + r := New() |
| 103 | + got := r.RedactBody(`{"ssn":"123-45-6789"}`) |
| 104 | + if strings.Contains(got, "123-45-6789") { |
| 105 | + t.Errorf("SSN not redacted: %s", got) |
| 106 | + } |
| 107 | +} |
0 commit comments