test_review_no_secret_leak.py
file-level
1
files
1
commits
0
hotspots
0
🧊 dead
0
💥 blast risk
| 1 | """Security tests — no secret/path leak in review output (§K5.12).""" |
| 2 | |
| 3 | from __future__ import annotations |
| 4 | |
| 5 | import io |
| 6 | import json |
| 7 | import os |
| 8 | import sys |
| 9 | from contextlib import redirect_stdout |
| 10 | from pathlib import Path |
| 11 | |
| 12 | from cli.context import CliContext |
| 13 | from cli.kit_root import kit_root |
| 14 | from cli.main import main |
| 15 | from cli.output import OutputContext |
| 16 | from tests.support import git_status_runner, pass_provider_factory, seed_freeze_repo |
| 17 | |
| 18 | |
| 19 | def test_api_key_not_in_output(tmp_path: Path, monkeypatch) -> None: |
| 20 | monkeypatch.setenv("OVERSEER_REVIEW_API_KEY", "super-secret-key-value") |
| 21 | artifact = seed_freeze_repo(tmp_path) |
| 22 | rel = artifact.relative_to(tmp_path).as_posix() |
| 23 | buffer = io.StringIO() |
| 24 | ctx = CliContext.create( |
| 25 | runner=git_status_runner(), |
| 26 | cwd=tmp_path, |
| 27 | kit=kit_root(), |
| 28 | output=OutputContext(json_mode=True), |
| 29 | review_provider_factory=pass_provider_factory(), |
| 30 | ) |
| 31 | with redirect_stdout(buffer): |
| 32 | code = main(["review", "--freeze", rel, "--json"], ctx=ctx) |
| 33 | out = buffer.getvalue() |
| 34 | assert code == 0 |
| 35 | assert "super-secret-key-value" not in out |
| 36 | payload = json.loads(out) |
| 37 | assert "/" + tmp_path.name not in json.dumps(payload) |