65 lines
2.1 KiB
Rust
65 lines
2.1 KiB
Rust
|
use std::collections::BTreeMap;
|
||
|
|
|
||
|
|
use remora_credentials::{SecretMaterial, VaultConfig};
|
||
|
|
|
||
|
|
#[test]
|
||
|
|
fn secret_material_debug_and_display_redact_values() {
|
||
|
|
let material = SecretMaterial::BearerToken {
|
||
|
|
token: "super-secret-token-value".into(),
|
||
|
|
};
|
||
|
|
let debug = format!("{material:?}");
|
||
|
|
let display = format!("{material}");
|
||
|
|
assert!(!debug.contains("super-secret-token-value"));
|
||
|
|
assert!(debug.contains("REDACTED"));
|
||
|
|
assert!(!display.contains("super-secret-token-value"));
|
||
|
|
assert_eq!(display, "SecretMaterial(bearer_token)");
|
||
|
|
|
||
|
|
let headers = SecretMaterial::HttpHeaders {
|
||
|
|
headers: BTreeMap::from([("x-api-key".into(), "header-secret".into())]),
|
||
|
|
};
|
||
|
|
let debug = format!("{headers:?}");
|
||
|
|
assert!(!debug.contains("header-secret"));
|
||
|
|
assert!(debug.contains("REDACTED"));
|
||
|
|
}
|
||
|
|
|
||
|
|
#[test]
|
||
|
|
fn vault_config_debug_redacts_token() {
|
||
|
|
let config = VaultConfig {
|
||
|
|
address: "http://vault:8200".into(),
|
||
|
|
token: "synthetic-vault-token".into(),
|
||
|
|
mount: "secret".into(),
|
||
|
|
path_prefix: "remora/lane-0".into(),
|
||
|
|
timeout: std::time::Duration::from_secs(1),
|
||
|
|
};
|
||
|
|
let debug = format!("{config:?}");
|
||
|
|
assert!(!debug.contains("synthetic-vault-token"));
|
||
|
|
assert!(debug.contains("REDACTED"));
|
||
|
|
}
|
||
|
|
|
||
|
|
#[test]
|
||
|
|
fn error_messages_never_embed_secret_literals() {
|
||
|
|
let material = SecretMaterial::BasicAuth {
|
||
|
|
username: "alice".into(),
|
||
|
|
password: "p@ssw0rd-should-not-leak".into(),
|
||
|
|
};
|
||
|
|
let err = remora_credentials::CredentialError::InvalidInput(format!(
|
||
|
|
"validated kind {}",
|
||
|
|
material.kind().as_str()
|
||
|
|
));
|
||
|
|
let text = err.to_string();
|
||
|
|
assert!(!text.contains("p@ssw0rd-should-not-leak"));
|
||
|
|
assert!(err.is_safe_for_logs());
|
||
|
|
}
|
||
|
|
|
||
|
|
#[test]
|
||
|
|
fn material_validation_rejects_empty_and_forbidden_headers() {
|
||
|
|
let empty = SecretMaterial::BearerToken {
|
||
|
|
token: String::new(),
|
||
|
|
};
|
||
|
|
assert!(empty.validate().is_err());
|
||
|
|
|
||
|
|
let forbidden = SecretMaterial::HttpHeaders {
|
||
|
|
headers: BTreeMap::from([("authorization".into(), "Bearer x".into())]),
|
||
|
|
};
|
||
|
|
assert!(forbidden.validate().is_err());
|
||
|
|
}
|