1
9import { describe, expect, it } from "vitest";
10import { scrubSecrets, REDACTED } from "./log-scrubber.js";
11
12describe("log-scrubber (F-121)", () => {
13 it("redacts a Bearer access token", () => {
14 expect(scrubSecrets("unhandled error on POST /api/v1/pages Authorization=Bearer fk_live_abcdef1234567890abcdef")).toBe(
15 "unhandled error on POST /api/v1/pages Authorization=Bearer [REDACTED]"
16 );
17 });
18
19 it("redacts a raw JWT-shaped token", () => {
20 const jwt = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0In0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U";
21 expect(scrubSecrets(`token: ${jwt}`)).toBe(`token: ${REDACTED}`);
22 });
23
24 it("redacts factory + common third-party token prefixes", () => {
25 expect(scrubSecrets("key fk_live_abcdef1234567890abcdef")).toContain(REDACTED);
26 expect(scrubSecrets("whsec_live_abcdef1234567890abcdef1234567890abcdef")).toContain(REDACTED);
27 expect(scrubSecrets("xoxb-1234567890-abcdef")).toContain(REDACTED);
28 expect(scrubSecrets("AKIAIOSFODNN7EXAMPLE")).toContain(REDACTED);
29
30 expect(scrubSecrets("fk_test_abcdef1234567890abcdef")).toContain(REDACTED);
31 });
32
33 it("redacts credential query parameters but not innocent ones", () => {
34 expect(scrubSecrets("failed on /api/v1/auth/reset?token=abc123def456&next=/in")).toBe(
35 `failed on /api/v1/auth/reset?token=${REDACTED}&next=/in`
36 );
37 expect(scrubSecrets("GET /api/v1/pages?api_key=sk_test_123&sort=created")).toBe(
38 `GET /api/v1/pages?api_key=${REDACTED}&sort=created`
39 );
40
41 expect(scrubSecrets("GET /api/v1/pages?limit=20&sort=name")).toBe("GET /api/v1/pages?limit=20&sort=name");
42 });
43
44 it("redacts Cookie / Set-Cookie values", () => {
45 expect(scrubSecrets("cookie: factory_refresh=abc123; Path=/; HttpOnly")).toBe("cookie: [REDACTED]");
46 expect(scrubSecrets("set-cookie: factory_refresh=xyz; Secure; SameSite=Lax")).toBe("set-cookie: [REDACTED]");
47 });
48
49 it("passes non-strings and clean strings through unchanged", () => {
50 expect(scrubSecrets(42)).toBe(42);
51 expect(scrubSecrets(undefined)).toBe(undefined);
52 expect(scrubSecrets("plain log line about pagination")).toBe("plain log line about pagination");
53 });
54});
55
