File size: 1,296 Bytes
108e227 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 | """Export redaction tests — the security-critical layer.
Invariants:
* One unconditional scrub: secrets AND PII, no modes, no knobs.
* Fails CLOSED: if the redactor can't run, the raw string is never emitted.
* Structure (subsystem names, error codes) survives; free-text PII does not.
"""
from __future__ import annotations
from unittest import mock
import agent.monitoring.redaction as R
def test_secret_key_always_stripped():
fake_key = "sk-ant-api03-" + "A" * 24 # constructed to dodge literal-scrubbers
out = R.redact_for_export(f"calling with key {fake_key} and moving on")
assert out is not None
assert fake_key not in out
def test_bearer_header_stripped():
out = R.redact_for_export("Authorization: Bearer abc.def-ghi_jkl")
assert out is not None
assert "abc.def-ghi_jkl" not in out
def test_structure_preserved():
out = R.redact_for_export("platform.slack entered fatal after auth_failed")
assert out is not None
assert "platform.slack" in out
assert "auth_failed" in out
def test_fails_closed_when_redactor_unavailable():
with mock.patch("agent.redact.redact_sensitive_text", side_effect=RuntimeError):
out = R.redact_for_export("secret sauce sk-live-key")
assert out == "[redaction-unavailable]"
|