khyari hamza
d815339c52
Implement centralized redaction utility that masks API keys, tokens, and credentials across CLI output, structlog logs, and error messages. - Add shared/redaction.py with pattern-based secret detection (sk-*, sk-ant-*, tok_*, Bearer tokens), sensitive key name detection, database URL masking, custom pattern registration, and thread-safe global show_secrets flag - Add config/logging.py with structlog configuration integrating the secrets_masking_processor into the processor chain - Add --show-secrets global CLI option to reveal secrets when needed - Redact error details in main.py, project.py, and auto_debug.py error handlers before printing - Wrap format_output() in formatting.py with automatic dict redaction - Add show_secrets field and safe __repr__ to Settings model - Add 43-scenario Behave feature (features/security_secrets.feature) - Add 10 Robot Framework smoke tests (robot/security_secrets.robot) - Add ASV benchmarks (benchmarks/security_secrets_bench.py) - Add reference docs (docs/reference/secrets_handling.md)
75 lines
3.1 KiB
Plaintext
75 lines
3.1 KiB
Plaintext
*** Settings ***
|
|
Documentation SEC5 - Secrets masking integration smoke tests
|
|
Library OperatingSystem
|
|
Library Collections
|
|
Library String
|
|
Library Process
|
|
Resource ${CURDIR}/common.resource
|
|
|
|
*** Variables ***
|
|
${SRC_DIR} ${CURDIR}/../src/cleveragents
|
|
|
|
*** Test Cases ***
|
|
Redaction Module Exists
|
|
[Documentation] Verify the redaction module is present
|
|
File Should Exist ${SRC_DIR}/shared/redaction.py
|
|
|
|
Logging Config Module Exists
|
|
[Documentation] Verify the structlog config module is present
|
|
File Should Exist ${SRC_DIR}/config/logging.py
|
|
|
|
Redaction Module Exports Expected Symbols
|
|
[Documentation] Verify redaction.py exports the public API
|
|
${content}= Get File ${SRC_DIR}/shared/redaction.py
|
|
Should Contain ${content} def redact_value
|
|
Should Contain ${content} def redact_dict
|
|
Should Contain ${content} def is_sensitive_key
|
|
Should Contain ${content} def mask_database_url
|
|
Should Contain ${content} def register_pattern
|
|
Should Contain ${content} def secrets_masking_processor
|
|
Should Contain ${content} def get_show_secrets
|
|
Should Contain ${content} def set_show_secrets
|
|
Should Contain ${content} REDACTED
|
|
|
|
Main CLI Declares Show Secrets Option
|
|
[Documentation] Verify --show-secrets global option is wired in
|
|
${content}= Get File ${SRC_DIR}/cli/main.py
|
|
Should Contain ${content} --show-secrets
|
|
Should Contain ${content} show_secrets_callback
|
|
|
|
CLI Error Handlers Use Redaction
|
|
[Documentation] Verify error handlers in main.py redact details
|
|
${content}= Get File ${SRC_DIR}/cli/main.py
|
|
Should Contain ${content} redact_value(e.message)
|
|
Should Contain ${content} redact_dict(e.details)
|
|
|
|
Formatting Module Applies Redaction
|
|
[Documentation] Verify format_output applies dict redaction
|
|
${content}= Get File ${SRC_DIR}/cli/formatting.py
|
|
Should Contain ${content} _redact_data
|
|
Should Contain ${content} safe_data
|
|
|
|
Settings Has Show Secrets Field
|
|
[Documentation] Verify Settings model includes show_secrets field
|
|
${content}= Get File ${SRC_DIR}/config/settings.py
|
|
Should Contain ${content} show_secrets: bool
|
|
Should Contain ${content} CLEVERAGENTS_SHOW_SECRETS
|
|
|
|
Settings Has Safe Repr
|
|
[Documentation] Verify Settings.__repr__ masks sensitive values
|
|
${content}= Get File ${SRC_DIR}/config/settings.py
|
|
Should Contain ${content} def __repr__
|
|
Should Contain ${content} is_sensitive_key
|
|
|
|
Redaction Module Does Not Use Eval Or Exec
|
|
[Documentation] Security check: no eval/exec in redaction module
|
|
${content}= Get File ${SRC_DIR}/shared/redaction.py
|
|
Should Not Contain ${content} eval(
|
|
Should Not Contain ${content} exec(
|
|
|
|
Logging Config Integrates Masking Processor
|
|
[Documentation] Verify structlog config uses secrets_masking_processor
|
|
${content}= Get File ${SRC_DIR}/config/logging.py
|
|
Should Contain ${content} secrets_masking_processor
|
|
Should Contain ${content} configure_structlog
|