mirror of
https://github.com/open-jarvis/OpenJarvis.git
synced 2026-07-28 05:12:26 +00:00
Jon Saad-FalconandClaude Opus 4.6
f122f5a699
- BoundaryGuard degrades gracefully when Rust scanners unavailable - BoundaryGuard tests use lightweight mock scanners (no Rust needed) - Server-dependent tests use pytest.importorskip for starlette/fastapi - Fix import ordering in test files Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
115 lines
3.6 KiB
Python
115 lines
3.6 KiB
Python
"""Tests for log sanitization (Section 5)."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import logging
|
|
import os
|
|
import tempfile
|
|
from pathlib import Path
|
|
|
|
|
|
class TestSanitizingFormatter:
|
|
"""SanitizingFormatter should redact secrets in log messages."""
|
|
|
|
def test_redacts_openai_key(self) -> None:
|
|
from openjarvis.cli.log_config import SanitizingFormatter
|
|
|
|
fmt = SanitizingFormatter("%(message)s")
|
|
record = logging.LogRecord(
|
|
name="test",
|
|
level=logging.INFO,
|
|
pathname="",
|
|
lineno=0,
|
|
msg="Key is sk-proj-abc123def456ghi789jkl012mno345pqr678stu",
|
|
args=(),
|
|
exc_info=None,
|
|
)
|
|
result = fmt.format(record)
|
|
assert "sk-proj-" not in result
|
|
assert "[REDACTED" in result
|
|
|
|
def test_redacts_aws_key(self) -> None:
|
|
from openjarvis.cli.log_config import SanitizingFormatter
|
|
|
|
fmt = SanitizingFormatter("%(message)s")
|
|
record = logging.LogRecord(
|
|
name="test",
|
|
level=logging.INFO,
|
|
pathname="",
|
|
lineno=0,
|
|
msg="AWS: AKIAIOSFODNN7EXAMPLE",
|
|
args=(),
|
|
exc_info=None,
|
|
)
|
|
result = fmt.format(record)
|
|
assert "AKIAIOSFODNN7EXAMPLE" not in result
|
|
|
|
def test_clean_message_unchanged(self) -> None:
|
|
from openjarvis.cli.log_config import SanitizingFormatter
|
|
|
|
fmt = SanitizingFormatter("%(message)s")
|
|
record = logging.LogRecord(
|
|
name="test",
|
|
level=logging.INFO,
|
|
pathname="",
|
|
lineno=0,
|
|
msg="Server started on port 8000",
|
|
args=(),
|
|
exc_info=None,
|
|
)
|
|
result = fmt.format(record)
|
|
assert result == "Server started on port 8000"
|
|
|
|
def test_redacts_slack_token(self) -> None:
|
|
from openjarvis.cli.log_config import SanitizingFormatter
|
|
|
|
fmt = SanitizingFormatter("%(message)s")
|
|
record = logging.LogRecord(
|
|
name="test",
|
|
level=logging.INFO,
|
|
pathname="",
|
|
lineno=0,
|
|
msg="Token: xoxb-1234-5678-abcdefghij",
|
|
args=(),
|
|
exc_info=None,
|
|
)
|
|
result = fmt.format(record)
|
|
assert "xoxb-" not in result
|
|
|
|
|
|
class TestScopedCredentialAccess:
|
|
"""get_tool_credential should return values without polluting os.environ."""
|
|
|
|
def test_returns_credential_value(self) -> None:
|
|
from openjarvis.core.credentials import get_tool_credential
|
|
|
|
with tempfile.NamedTemporaryFile(mode="w", suffix=".toml", delete=False) as f:
|
|
f.write('[slack]\nSLACK_BOT_TOKEN = "xoxb-test-token"\n')
|
|
f.flush()
|
|
result = get_tool_credential(
|
|
"slack", "SLACK_BOT_TOKEN", path=Path(f.name)
|
|
)
|
|
assert result == "xoxb-test-token"
|
|
assert os.environ.get("SLACK_BOT_TOKEN") != "xoxb-test-token"
|
|
os.unlink(f.name)
|
|
|
|
def test_returns_none_for_missing(self) -> None:
|
|
from openjarvis.core.credentials import get_tool_credential
|
|
|
|
with tempfile.NamedTemporaryFile(mode="w", suffix=".toml", delete=False) as f:
|
|
f.write("[slack]\n")
|
|
f.flush()
|
|
result = get_tool_credential(
|
|
"slack", "SLACK_BOT_TOKEN", path=Path(f.name)
|
|
)
|
|
assert result is None
|
|
os.unlink(f.name)
|
|
|
|
def test_returns_none_for_missing_file(self) -> None:
|
|
from openjarvis.core.credentials import get_tool_credential
|
|
|
|
result = get_tool_credential(
|
|
"slack", "SLACK_BOT_TOKEN", path=Path("/nonexistent/file.toml")
|
|
)
|
|
assert result is None
|