mirror of
https://github.com/dograh-hq/dograh.git
synced 2026-07-25 12:01:04 +02:00
126 lines
4.6 KiB
Python
126 lines
4.6 KiB
Python
"""Unit tests for ``resolve_masked_api_keys``.
|
|
|
|
The resolver restores real API keys when the client echoes back the masked
|
|
placeholder, while leaving genuinely new keys untouched. It must handle adds,
|
|
removes, reorders, and partial replacements across both scalar and list values.
|
|
"""
|
|
|
|
from api.services.configuration.masking import (
|
|
_secret_values_differ,
|
|
mask_key,
|
|
resolve_masked_api_keys,
|
|
)
|
|
|
|
REAL_A = "sk-real-key-aaaaaaaaaaaa1111"
|
|
REAL_B = "sk-real-key-bbbbbbbbbbbb2222"
|
|
REAL_C = "sk-real-key-cccccccccccc3333"
|
|
REAL_D_SMALL = "ABCDE"
|
|
|
|
MASK_A = mask_key(REAL_A)
|
|
MASK_B = mask_key(REAL_B)
|
|
MASK_C = mask_key(REAL_C)
|
|
MASK_D_SMALL = mask_key(REAL_D_SMALL)
|
|
|
|
|
|
class TestScalar:
|
|
def test_masked_scalar_restores_existing(self):
|
|
assert resolve_masked_api_keys(MASK_A, REAL_A) == REAL_A
|
|
|
|
def test_unmasked_scalar_is_kept(self):
|
|
new_key = "sk-brand-new-real-key-9999"
|
|
assert resolve_masked_api_keys(new_key, REAL_A) == new_key
|
|
|
|
def test_mask_of_different_key_is_kept_verbatim(self):
|
|
# Incoming is a mask, but not the mask of the existing key -> kept as-is.
|
|
assert resolve_masked_api_keys(MASK_B, REAL_A) == MASK_B
|
|
|
|
def test_small_mask_is_resolved(self):
|
|
assert resolve_masked_api_keys(MASK_D_SMALL, REAL_D_SMALL) == REAL_D_SMALL
|
|
|
|
|
|
class TestList:
|
|
def test_all_masked_restores_all_reals(self):
|
|
result = resolve_masked_api_keys([MASK_A, MASK_B], [REAL_A, REAL_B])
|
|
assert result == [REAL_A, REAL_B]
|
|
|
|
def test_reorder_is_preserved(self):
|
|
# Client sent the keys back in a different order than stored.
|
|
result = resolve_masked_api_keys([MASK_B, MASK_A], [REAL_A, REAL_B])
|
|
assert result == [REAL_B, REAL_A]
|
|
|
|
def test_new_key_added_alongside_masked(self):
|
|
new_key = "sk-brand-new-real-key-9999"
|
|
result = resolve_masked_api_keys([MASK_A, new_key], [REAL_A])
|
|
assert result == [REAL_A, new_key]
|
|
|
|
def test_key_removed(self):
|
|
# Only one of two stored keys is echoed back.
|
|
result = resolve_masked_api_keys([MASK_B], [REAL_A, REAL_B])
|
|
assert result == [REAL_B]
|
|
|
|
def test_partial_replacement(self):
|
|
new_key = "sk-brand-new-real-key-9999"
|
|
result = resolve_masked_api_keys(
|
|
[MASK_A, new_key, MASK_C], [REAL_A, REAL_B, REAL_C]
|
|
)
|
|
assert result == [REAL_A, new_key, REAL_C]
|
|
|
|
def test_unmasked_keys_kept_verbatim(self):
|
|
result = resolve_masked_api_keys([REAL_A, REAL_B], [REAL_C])
|
|
assert result == [REAL_A, REAL_B]
|
|
|
|
|
|
class TestUsedDeduplication:
|
|
def test_each_existing_key_consumed_at_most_once(self):
|
|
# Two identical masked placeholders, but only one matching real key
|
|
# exists. The first consumes REAL_A; the second has no unused match and
|
|
# is therefore kept verbatim rather than duplicating the real key.
|
|
result = resolve_masked_api_keys([MASK_A, MASK_A], [REAL_A])
|
|
assert result == [REAL_A, MASK_A]
|
|
|
|
def test_two_identical_masks_two_identical_reals(self):
|
|
result = resolve_masked_api_keys([MASK_A, MASK_A], [REAL_A, REAL_A])
|
|
assert result == [REAL_A, REAL_A]
|
|
|
|
|
|
class TestMixedTypes:
|
|
def test_scalar_incoming_list_existing(self):
|
|
# A masked scalar resolved against a list of stored keys.
|
|
result = resolve_masked_api_keys(MASK_B, [REAL_A, REAL_B])
|
|
assert result == [REAL_B]
|
|
|
|
def test_list_incoming_scalar_existing(self):
|
|
result = resolve_masked_api_keys([MASK_A], REAL_A)
|
|
assert result == [REAL_A]
|
|
|
|
|
|
class TestEmpty:
|
|
def test_empty_incoming_list(self):
|
|
assert resolve_masked_api_keys([], [REAL_A]) == []
|
|
|
|
def test_empty_value(self):
|
|
assert resolve_masked_api_keys("", REAL_A) == ""
|
|
|
|
def test_no_existing_keys_keeps_incoming(self):
|
|
result = resolve_masked_api_keys([MASK_A, MASK_B], [])
|
|
assert result == [MASK_A, MASK_B]
|
|
|
|
|
|
class TestSecretValuesDiffer:
|
|
def test_same_scalar_values_do_not_differ(self):
|
|
assert _secret_values_differ(REAL_A, REAL_A) is False
|
|
|
|
def test_different_scalar_values_differ(self):
|
|
assert _secret_values_differ(REAL_A, REAL_B) is True
|
|
|
|
def test_same_list_values_do_not_differ(self):
|
|
assert _secret_values_differ([REAL_A, REAL_B], [REAL_A, REAL_B]) is False
|
|
|
|
def test_same_list_values_in_different_order_differ(self):
|
|
assert _secret_values_differ([REAL_A, REAL_B], [REAL_B, REAL_A]) is True
|
|
|
|
def test_scalar_and_single_item_list_do_not_differ(self):
|
|
assert _secret_values_differ(REAL_A, [REAL_A]) is False
|
|
|
|
def test_scalar_and_multi_item_list_differ(self):
|
|
assert _secret_values_differ(REAL_A, [REAL_A, REAL_B]) is True
|