apunkt/nyx
1
0
Fork 0
mirror of https://github.com/elicpeter/nyx.git synced 2026-06-09 19:45:13 +02:00
Code Issues Projects Releases Packages Wiki Activity

[pitboss/grind] deferred session-0002 (20260516T052512Z-20f8)

Browse source
This commit is contained in:
pitboss 2026-05-16 01:46:35 -05:00
parent 7a2f82c2ab
commit 282acddbbf
11 changed files with 214 additions and 45 deletions
Download patch file Download diff file Expand all files Collapse all files

20
tests/policy_deny.rs
View file

@ -82,8 +82,16 @@ fn credentials_rule_fires_on_aws_key_in_flow_step_snippet() {
)];
diag.evidence = Some(ev);
match policy::evaluate(&diag) {
PolicyDecision::Deny { rule, excerpt } => {
PolicyDecision::Deny {
rule,
field,
excerpt,
} => {
assert_eq!(rule, DenyRule::CREDENTIALS);
assert!(
field.starts_with("flow_steps[") && field.ends_with(".snippet"),
"deny must record the source field, got {field:?}"
);
assert!(
!excerpt.contains("AKIAFAKETEST00000000"),
"excerpt must scrub the raw token, got {excerpt:?}"
@ -209,8 +217,16 @@ fn verify_finding_short_circuits_without_sandbox() {
.inconclusive_reason
.expect("PolicyDeniedDynamic must populate inconclusive_reason");
match reason {
InconclusiveReason::PolicyDeniedDynamic { rule, excerpt } => {
InconclusiveReason::PolicyDeniedDynamic {
rule,
field,
excerpt,
} => {
assert_eq!(rule, DenyRule::CREDENTIALS);
assert!(
field.starts_with("evidence.notes["),
"deny must record the source field, got {field:?}"
);
assert!(
!excerpt.contains("hunter2-supersecret-test"),
"excerpt must scrub the raw secret, got {excerpt:?}"