a9a7a328e6
Mechanical rename produced by scripts/msd-rename.cjs: gsd/Gsd/GSD -> msd/Msd/MSD across contents and paths, upstream package/repo coordinates -> @golem15/msd-core and golem15com/msd-core. Deep links into upstream history, sibling upstream packages, the GSD-2 import feature, CHANGELOG.md and .changeset/ are kept as-is. Hand edits on top: MSD block-letter banner and logos, LICENSE copyright line, package/plugin identity, regenerated lockfile, install-tree fixtures, derived registries and benchmark baseline; migration checksum baseline re-locked (MSD keeps its own install state, so no install had applied the old sums); sort-order and regex-escaped expectations in tests adjusted.
105 lines
3.4 KiB
JavaScript
105 lines
3.4 KiB
JavaScript
'use strict';
|
|
|
|
/**
|
|
* Dedicated coverage for src/secrets.cts (compiled to msd-core/bin/lib/secrets.cjs).
|
|
* Closes #3322 (H8 of epic #3053): the module previously had one incidental masking
|
|
* assertion (landed via #2299) exercising only the >8-char branch; the s.length < 8
|
|
* reveal boundary was uncovered. See .msd/phase/test-3322-secrets-reveal-boundary-coverage/
|
|
* for the design rationale and full test matrix.
|
|
*/
|
|
|
|
const { test, describe } = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
|
|
const { maskSecret, isSecretKey, maskIfSecret } = require('../msd-core/bin/lib/secrets.cjs');
|
|
|
|
describe('maskSecret — unset triad', () => {
|
|
test('maskSecretReturnsUnsetForNull', () => {
|
|
assert.equal(maskSecret(null), '(unset)');
|
|
});
|
|
|
|
test('maskSecretReturnsUnsetForUndefined', () => {
|
|
assert.equal(maskSecret(undefined), '(unset)');
|
|
});
|
|
|
|
test('maskSecretReturnsUnsetForEmptyString', () => {
|
|
assert.equal(maskSecret(''), '(unset)');
|
|
});
|
|
});
|
|
|
|
describe('maskSecret — 8-char reveal boundary', () => {
|
|
test('maskSecretFullyMasksBelowEightChars', () => {
|
|
// length 7 (limit-1): fully masked, nothing revealed
|
|
assert.equal(maskSecret('abcdefg'), '****');
|
|
});
|
|
|
|
test('maskSecretRevealsLastFourAtEightChars', () => {
|
|
// length 8 (limit): threshold itself falls into the reveal branch
|
|
assert.equal(maskSecret('abcdefgh'), '****efgh');
|
|
});
|
|
|
|
test('maskSecretRevealsLastFourAboveEightChars', () => {
|
|
// length 9 (limit+1)
|
|
assert.equal(maskSecret('abcdefghi'), '****fghi');
|
|
});
|
|
});
|
|
|
|
describe('maskSecret — falsy-but-valid values are not treated as unset', () => {
|
|
test('maskSecretDoesNotTreatZeroAsUnset', () => {
|
|
assert.equal(maskSecret(0), '****');
|
|
});
|
|
|
|
test('maskSecretDoesNotTreatFalseAsUnset', () => {
|
|
assert.equal(maskSecret(false), '****');
|
|
});
|
|
|
|
test('maskSecretMasksBooleanTrue', () => {
|
|
assert.equal(maskSecret(true), '****');
|
|
});
|
|
});
|
|
|
|
describe('maskSecret — non-string scalar coercion and negative space', () => {
|
|
test('maskSecretRevealsLastFourForNumericAtEightDigits', () => {
|
|
assert.equal(maskSecret(12345678), '****5678');
|
|
});
|
|
|
|
test('maskSecretMasksLiteralNullString', () => {
|
|
// The string "null" (4 chars) must be masked like any other short secret,
|
|
// not mistaken for the actual `null` unset sentinel.
|
|
assert.equal(maskSecret('null'), '****');
|
|
});
|
|
});
|
|
|
|
describe('isSecretKey — membership', () => {
|
|
test('isSecretKeyMatchesConfiguredKeys', () => {
|
|
assert.equal(isSecretKey('brave_search'), true);
|
|
assert.equal(isSecretKey('firecrawl'), true);
|
|
assert.equal(isSecretKey('exa_search'), true);
|
|
});
|
|
|
|
test('isSecretKeyRejectsUnknownKey', () => {
|
|
assert.equal(isSecretKey('not_a_secret'), false);
|
|
});
|
|
|
|
test('isSecretKeyRejectsPrefixSuffixMatch', () => {
|
|
// Exact Set membership, not substring/prefix/suffix matching.
|
|
assert.equal(isSecretKey('brave_search_extra'), false);
|
|
assert.equal(isSecretKey('my_firecrawl'), false);
|
|
});
|
|
});
|
|
|
|
describe('maskIfSecret — wiring', () => {
|
|
test('maskIfSecretMasksWhenKeyIsSecret', () => {
|
|
assert.equal(maskIfSecret('firecrawl', 'abcdefgh'), '****efgh');
|
|
});
|
|
|
|
test('maskIfSecretPassesThroughNonSecretString', () => {
|
|
assert.equal(maskIfSecret('not_a_secret', 'abcdefgh'), 'abcdefgh');
|
|
});
|
|
|
|
test('maskIfSecretPassesThroughNonSecretNonString', () => {
|
|
// Passthrough must preserve type — not coerce to string.
|
|
assert.equal(maskIfSecret('not_a_secret', 42), 42);
|
|
});
|
|
});
|