fix: close Pi management final review findings

2026-08-14 20:15:21 +02:00
parent 225d13cd75
commit 900faad983
13 changed files with 621 additions and 71 deletions
@@ -3,6 +3,7 @@ package output
 import (
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 )

@@ -34,6 +35,113 @@ func TestSanitizeRedactsSecretFileContents(t *testing.T) {
 	}
 }

+func TestSecretValuesFromFilesRedactsNestedJSONScalars(t *testing.T) {
+	t.Parallel()
+
+	secretFile := filepath.Join(physicalTempDir(t), "pi-auth.json")
+	contents := `{
+  "providers": {
+    "dummy-provider": {
+      "auth": {
+        "key": "dummy-canary-json-key",
+        "tokens": {
+          "access": "dummy-canary-json-access",
+          "refresh": "dummy-canary-json-refresh"
+        }
+      }
+    }
+  }
+}`
+	if err := os.WriteFile(secretFile, []byte(contents), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	secrets, err := SecretValuesFromFiles([]string{secretFile})
+	if err != nil {
+		t.Fatalf("SecretValuesFromFiles() error = %v", err)
+	}
+	got := Sanitize(
+		"unlabelled dummy-canary-json-key dummy-canary-json-access dummy-canary-json-refresh",
+		secrets,
+	)
+	for _, canary := range []string{
+		"dummy-canary-json-key",
+		"dummy-canary-json-access",
+		"dummy-canary-json-refresh",
+	} {
+		if strings.Contains(got, canary) {
+			t.Fatalf("Sanitize() exposed nested JSON scalar %q: %q", canary, got)
+		}
+	}
+}
+
+func TestSecretValuesFromFilesRedactsEveryDotenvBundleValue(t *testing.T) {
+	t.Parallel()
+
+	secretFile := filepath.Join(physicalTempDir(t), "thothii.secrets")
+	contents := "MODEL_API_KEY=dummy-canary-bundle-model\n" +
+		"DWH_PASSWORD='dummy-canary-bundle-dwh'\n" +
+		"SESSION_TOKEN=\"dummy-canary-bundle-session\"\n"
+	if err := os.WriteFile(secretFile, []byte(contents), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	secrets, err := SecretValuesFromFiles([]string{secretFile})
+	if err != nil {
+		t.Fatalf("SecretValuesFromFiles() error = %v", err)
+	}
+	got := Sanitize(
+		"unlabelled dummy-canary-bundle-model dummy-canary-bundle-dwh dummy-canary-bundle-session",
+		secrets,
+	)
+	for _, canary := range []string{
+		"dummy-canary-bundle-model",
+		"dummy-canary-bundle-dwh",
+		"dummy-canary-bundle-session",
+	} {
+		if strings.Contains(got, canary) {
+			t.Fatalf("Sanitize() exposed dotenv bundle scalar %q: %q", canary, got)
+		}
+	}
+}
+
+func TestSanitizeRecognizesQuotedCredentialKeys(t *testing.T) {
+	t.Parallel()
+
+	got := Sanitize(`{"key":"dummy-canary-quoted-key","safe":"visible"}`, nil)
+	if strings.Contains(got, "dummy-canary-quoted-key") || !strings.Contains(got, `"safe":"visible"`) {
+		t.Fatalf("Sanitize() = %q, want only the quoted credential field redacted", got)
+	}
+}
+
+func TestSecretValuesFromFilesRejectsMalformedJSONAndExcessiveScalars(t *testing.T) {
+	t.Parallel()
+
+	t.Run("malformed", func(t *testing.T) {
+		secretFile := filepath.Join(physicalTempDir(t), "malformed-auth.json")
+		if err := os.WriteFile(secretFile, []byte(`{"auth":{"key":"dummy-canary-malformed"}`), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := SecretValuesFromFiles([]string{secretFile}); err == nil {
+			t.Fatal("SecretValuesFromFiles() error = nil, want malformed-JSON failure")
+		}
+	})
+
+	t.Run("scalar bound", func(t *testing.T) {
+		secretFile := filepath.Join(physicalTempDir(t), "many-auth-values.json")
+		values := make([]string, 1025)
+		for index := range values {
+			values[index] = `"dummy-canary-value"`
+		}
+		if err := os.WriteFile(secretFile, []byte("["+strings.Join(values, ",")+"]"), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := SecretValuesFromFiles([]string{secretFile}); err == nil {
+			t.Fatal("SecretValuesFromFiles() error = nil, want scalar-count failure")
+		}
+	})
+}
+
 func TestSecretValuesFromFilesRejectsOversizedFiles(t *testing.T) {
 	t.Parallel()