Add missing BDD tests for the shared module (redaction.py) #2076

Open
opened 2026-04-03 03:50:29 +00:00 by freemo · 2 comments
Owner

Metadata

  • Branch: test/shared-module-redaction-coverage
  • Commit Message: test(shared): add BDD scenarios for redaction module to reach ≥97% coverage
  • Milestone: v3.5.0
  • Parent Epic: #1678

Background

The src/cleveragents/shared/ module contains redaction.py, a centralized
secrets-redaction utility that is integrated into CLI output, structlog
processors, and error detail formatting. It exposes the following public API:

  • is_sensitive_key(key) — detects sensitive field names
  • redact_value(value) — pattern-matches and masks secret strings
  • redact_dict(data, *, show_secrets) — recursively redacts dicts
  • mask_database_url(url) — masks credentials in DB connection strings
  • register_pattern(pattern) — registers custom regex patterns at runtime
  • secrets_masking_processor(logger, method_name, event_dict) — structlog processor
  • get_show_secrets() / set_show_secrets(value) — global flag accessors

No Behave feature file currently exists for this module. The absence of
dedicated BDD scenarios leaves the module under-tested and risks dropping
overall coverage below the mandatory 97% threshold.

Subtasks

  • Create features/shared_redaction.feature with Gherkin scenarios covering all public functions
  • Implement step definitions in features/steps/shared_redaction_steps.py
  • Cover is_sensitive_key — true positives, false positives (e.g. token_count), empty string
  • Cover redact_value — each compiled pattern (OpenAI, Anthropic, Google, tok_, Bearer, generic key), empty string, no-match passthrough
  • Cover redact_dict — nested dicts, lists containing dicts/strings, show_secrets=True bypass, global flag interaction
  • Cover mask_database_url — SQLite passthrough, user:password@host masking, empty string
  • Cover register_pattern — valid pattern registration, empty pattern raises ValueError, invalid regex raises re.error
  • Cover secrets_masking_processor — sensitive key masking, value pattern masking, nested dict masking, show_secrets bypass
  • Cover set_show_secretsTypeError on non-bool input
  • Cover thread-safety paths (concurrent register_pattern and redact_value calls)
  • Run nox -e unit_tests and nox -e coverage_report to confirm ≥97% coverage

Definition of Done

  • features/shared_redaction.feature exists and all scenarios pass under nox -e unit_tests
  • All public functions in redaction.py are exercised by at least one scenario
  • False-positive key allowlist (_FALSE_POSITIVE_KEYS) is explicitly tested
  • All secret-pattern regexes have at least one matching and one non-matching scenario
  • register_pattern error paths (ValueError, re.error) are covered
  • set_show_secrets TypeError path is covered
  • No # type: ignore suppressions introduced
  • All nox stages pass
  • Coverage >= 97%

Automated by CleverAgents Bot
Supervisor: Unknown | Agent: ca-new-issue-creator

## Metadata - **Branch**: `test/shared-module-redaction-coverage` - **Commit Message**: `test(shared): add BDD scenarios for redaction module to reach ≥97% coverage` - **Milestone**: v3.5.0 - **Parent Epic**: #1678 ## Background The `src/cleveragents/shared/` module contains `redaction.py`, a centralized secrets-redaction utility that is integrated into CLI output, structlog processors, and error detail formatting. It exposes the following public API: - `is_sensitive_key(key)` — detects sensitive field names - `redact_value(value)` — pattern-matches and masks secret strings - `redact_dict(data, *, show_secrets)` — recursively redacts dicts - `mask_database_url(url)` — masks credentials in DB connection strings - `register_pattern(pattern)` — registers custom regex patterns at runtime - `secrets_masking_processor(logger, method_name, event_dict)` — structlog processor - `get_show_secrets()` / `set_show_secrets(value)` — global flag accessors No Behave feature file currently exists for this module. The absence of dedicated BDD scenarios leaves the module under-tested and risks dropping overall coverage below the mandatory 97% threshold. ## Subtasks - [ ] Create `features/shared_redaction.feature` with Gherkin scenarios covering all public functions - [ ] Implement step definitions in `features/steps/shared_redaction_steps.py` - [ ] Cover `is_sensitive_key` — true positives, false positives (e.g. `token_count`), empty string - [ ] Cover `redact_value` — each compiled pattern (OpenAI, Anthropic, Google, `tok_`, Bearer, generic key), empty string, no-match passthrough - [ ] Cover `redact_dict` — nested dicts, lists containing dicts/strings, `show_secrets=True` bypass, global flag interaction - [ ] Cover `mask_database_url` — SQLite passthrough, `user:password@host` masking, empty string - [ ] Cover `register_pattern` — valid pattern registration, empty pattern raises `ValueError`, invalid regex raises `re.error` - [ ] Cover `secrets_masking_processor` — sensitive key masking, value pattern masking, nested dict masking, `show_secrets` bypass - [ ] Cover `set_show_secrets` — `TypeError` on non-bool input - [ ] Cover thread-safety paths (concurrent `register_pattern` and `redact_value` calls) - [ ] Run `nox -e unit_tests` and `nox -e coverage_report` to confirm ≥97% coverage ## Definition of Done - [ ] `features/shared_redaction.feature` exists and all scenarios pass under `nox -e unit_tests` - [ ] All public functions in `redaction.py` are exercised by at least one scenario - [ ] False-positive key allowlist (`_FALSE_POSITIVE_KEYS`) is explicitly tested - [ ] All secret-pattern regexes have at least one matching and one non-matching scenario - [ ] `register_pattern` error paths (`ValueError`, `re.error`) are covered - [ ] `set_show_secrets` `TypeError` path is covered - [ ] No `# type: ignore` suppressions introduced - [ ] All nox stages pass - [ ] Coverage >= 97% --- **Automated by CleverAgents Bot** Supervisor: Unknown | Agent: ca-new-issue-creator
freemo added this to the v3.5.0 milestone 2026-04-03 03:50:44 +00:00
Author
Owner

Issue triaged by project owner:

  • State: Verified
  • Priority: Medium (confirmed)
  • Milestone: v3.5.0 (confirmed — the redaction module is a security-critical shared utility)
  • MoSCoW: Should Have — The redaction module handles secrets masking across CLI output, structlog, and error formatting. Missing BDD tests for this security-critical module is a significant coverage gap. The 97% coverage gate is at risk.
  • Parent Epic: #1678 (confirmed correct)

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Issue triaged by project owner: - **State**: Verified - **Priority**: Medium (confirmed) - **Milestone**: v3.5.0 (confirmed — the redaction module is a security-critical shared utility) - **MoSCoW**: Should Have — The redaction module handles secrets masking across CLI output, structlog, and error formatting. Missing BDD tests for this security-critical module is a significant coverage gap. The 97% coverage gate is at risk. - **Parent Epic**: #1678 (confirmed correct) --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner
Author
Owner

Issue triaged by project owner:

  • State: Verified
  • Priority: Medium — test coverage for the shared/redaction module
  • Milestone: v3.5.0
  • MoSCoW: Should Have — already correctly labeled; redaction is a security-adjacent feature that benefits from thorough test coverage

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Issue triaged by project owner: - **State**: Verified - **Priority**: Medium — test coverage for the shared/redaction module - **Milestone**: v3.5.0 - **MoSCoW**: Should Have — already correctly labeled; redaction is a security-adjacent feature that benefits from thorough test coverage --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Reference
cleveragents/cleveragents-core#2076
No description provided.