feat(secrets): add secret obfuscation with regex flags support

2026-02-15 17:02:33 +00:00
parent e7d90ff703
commit 2924495bfd
12 changed files with 524 additions and 3 deletions
@@ -0,0 +1,67 @@
+/**
+ * Tests for secrets regex parsing, compilation, and obfuscation.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { SecretObfuscator } from "../src/secrets/obfuscator";
+import { compileSecretRegex } from "../src/secrets/regex";
+
+describe("compileSecretRegex", () => {
+	it("compiles pattern with explicit flags and enforces global scanning", () => {
+		const regex = compileSecretRegex("api[_-]?key\\s*=\\s*\\w+", "gi");
+		expect(regex.source).toBe("api[_-]?key\\s*=\\s*\\w+");
+		expect(regex.flags).toBe("gi");
+	});
+
+	it("adds global flag when not provided", () => {
+		const regex = compileSecretRegex("api[_-]?key\\s*=\\s*\\w+", "i");
+		expect(regex.source).toBe("api[_-]?key\\s*=\\s*\\w+");
+		expect(regex.flags).toBe("gi");
+	});
+
+	it("defaults to global flag when no flags provided", () => {
+		const regex = compileSecretRegex("api[_-]?key\\s*=\\s*\\w+");
+		expect(regex.source).toBe("api[_-]?key\\s*=\\s*\\w+");
+		expect(regex.flags).toBe("g");
+	});
+
+	it("rejects invalid regex pattern", () => {
+		expect(() => compileSecretRegex("(")).toThrow();
+	});
+	it("rejects invalid regex flags", () => {
+		expect(() => compileSecretRegex("x", "zz")).toThrow();
+	});
+});
+
+describe("SecretObfuscator regex behavior", () => {
+	it("obfuscates and deobfuscates regex matches with flags", () => {
+		const obfuscator = new SecretObfuscator([{ type: "regex", content: "api[_-]?key\\s*=\\s*\\w+", flags: "i" }]);
+		const original = "API_KEY=abc and api-key=def";
+		const obfuscated = obfuscator.obfuscate(original);
+		expect(obfuscated).not.toEqual(original);
+		expect(obfuscator.deobfuscate(obfuscated)).toEqual(original);
+	});
+
+	it("supports bare regex patterns without explicit flags", () => {
+		const obfuscator = new SecretObfuscator([{ type: "regex", content: "api[_-]?key\\s*=\\s*\\w+" }]);
+		const text = "api_key=abc and API_KEY=def";
+		const obfuscated = obfuscator.obfuscate(text);
+		expect(obfuscated).not.toEqual(text);
+		expect(obfuscator.deobfuscate(obfuscated)).toEqual(text);
+	});
+	it("deobfuscates placeholders through object payloads", () => {
+		const obfuscator = new SecretObfuscator([{ type: "regex", content: "api[_-]?key\\s*=\\s*\\w+", flags: "i" }]);
+		const original = {
+			cmd: "API_KEY=abc and api-key=def",
+			status: "ok",
+		};
+		const obfuscated = {
+			cmd: obfuscator.obfuscate(original.cmd),
+			status: original.status,
+		};
+		expect(obfuscator.deobfuscateObject(obfuscated)).toEqual({
+			cmd: original.cmd,
+			status: original.status,
+		});
+	});
+});