d27dd0ffbb
Close 12 audit-driven platform-compliance gaps on a single branch. - D4 dispatch: app/integrations/dispatch_client.py participant `legacyhub`, emits LegacyhubDocumentIndexed + AssetDerivativeReady after the indexing commit (idempotent uuid5), http_inbox route (reindex/tombstone) with audit-based dedupe; docs/dispatch-contract.md. Celery+Redis stays intra-module. - D2 SSO: app/integrations/identity.py validates X-TeamHub-* + role/scope mapper; security.py adds trusted-header enforcement (AUTH_REQUIRE_IDENTITY) and a scope check on /search; docker-compose.teamhub.yml (external teamhub_net + internal db net, api not host-published); RUNBOOK network/firewall section. - Asset standard: SearchHit/Citation carry asset_id/owner_module; buckets renamed teamhub-legacyhub-* (+quarantine/tmp/exports); purge-by-asset_id with legal-hold guard (app/indexing/projection.py); OCR-markdown derivative event. - audit_log model + Alembic 0003 + record_audit on writes (same transaction). - Secret masking: app/common/json_logger.py recursive mask wired into structlog (+ensure_ascii=False); event payloads redacted before persistence. - Service X-API-Key mandatory on ingest endpoints (defence-in-depth). - Port: host API 8000->8050 (collision with SalesHUB/MailHUB resolved), container still listens on 8000. - Config: no plaintext secret defaults; fail-loud in non-dev (no value leak). - Docs drift: README PG 5440, layered-auth note, 5173 removed from CORS; ingest/folder gated by ENABLE_FOLDER_INGEST (410 by default). - ADRs: layers mapping, shared-core extraction, UI locale (RU-first). Tests: 78 passing (ruff, compileall, pytest, tsc, vite build, compose config). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
74 lines
2.2 KiB
Python
74 lines
2.2 KiB
Python
"""Tests for the secret-masking JSON logger (obs-core)."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from app.common.json_logger import (
|
|
MASK,
|
|
build_event,
|
|
is_sensitive_key,
|
|
mask_sensitive,
|
|
redact_secrets,
|
|
)
|
|
|
|
|
|
def test_flat_secret_keys_are_masked():
|
|
out = redact_secrets(
|
|
{
|
|
"api_key": "super-secret",
|
|
"authorization": "Bearer abc",
|
|
"password": "hunter2",
|
|
"x_api_key": "k",
|
|
}
|
|
)
|
|
assert out == {
|
|
"api_key": MASK,
|
|
"authorization": MASK,
|
|
"password": MASK,
|
|
"x_api_key": MASK,
|
|
}
|
|
|
|
|
|
def test_nested_storage_kms_key_is_masked():
|
|
out = redact_secrets(
|
|
{
|
|
"asset_id": "asset_123",
|
|
"storage": {"bucket": "b", "object_key": "k", "kms_key_id": "arn:aws:kms:secret"},
|
|
}
|
|
)
|
|
assert out["asset_id"] == "asset_123"
|
|
assert out["storage"]["bucket"] == "b"
|
|
assert out["storage"]["object_key"] == "k" # neutral key NOT masked
|
|
assert out["storage"]["kms_key_id"] == MASK
|
|
|
|
|
|
def test_neutral_keys_are_not_masked():
|
|
for key in ("object_key", "idempotency_key", "storage_key", "asset_id", "owner_module"):
|
|
assert is_sensitive_key(key) is False
|
|
assert redact_secrets({"object_key": "x"}) == {"object_key": "x"}
|
|
|
|
|
|
def test_secret_keys_are_detected():
|
|
for key in ("api_key", "x-api-key", "qdrant_api_key", "kms_key_id", "password", "authorization"):
|
|
assert is_sensitive_key(key) is True
|
|
|
|
|
|
def test_list_values_are_recursed():
|
|
out = redact_secrets({"items": [{"token": "t"}, {"name": "ok"}]})
|
|
assert out["items"][0]["token"] == MASK
|
|
assert out["items"][1]["name"] == "ok"
|
|
|
|
|
|
def test_mask_sensitive_processor_signature():
|
|
event = {"event": "x.y", "api_key": "leak", "user": "u"}
|
|
masked = mask_sensitive(None, "info", event)
|
|
assert masked["api_key"] == MASK
|
|
assert masked["event"] == "x.y"
|
|
assert masked["user"] == "u"
|
|
|
|
|
|
def test_build_event_returns_masked_payload():
|
|
payload = build_event("ingest", "doc.indexed", level="info", api_key="leak", asset_id="a1")
|
|
assert payload["api_key"] == MASK
|
|
assert payload["asset_id"] == "a1"
|
|
assert payload["event"] == "doc.indexed"
|