SnowLuma/packages/common/tests/log-summary.test.ts

import { describe, expect, it } from 'vitest';
import {
  redactLogMessage,
  renderParamsVerbose,
  summarizeParams,
} from '../src/log-summary';

describe('summarizeParams', () => {
  it('renders null/undefined as {}', () => {
    expect(summarizeParams(null)).toBe('{}');
    expect(summarizeParams(undefined)).toBe('{}');
  });

  it('renders a top-level non-object via String() WITHOUT quotes', () => {
    // The reported change-request: a top-level primitive is NOT JSON-quoted.
    expect(summarizeParams('hello')).toBe('hello');
    expect(summarizeParams(123)).toBe('123');
  });

  it('collapses a top-level array to [len=N]', () => {
    expect(summarizeParams([1, 2, 3])).toBe('[len=3]');
  });

  it('quotes string fields, collapses nested values, truncates long strings', () => {
    expect(summarizeParams({ a: 1, b: 'x', c: { d: 1 }, e: [1, 2] }))
      .toBe('a=1 b="x" c={...} e=[len=2]');
    expect(summarizeParams({ s: 'x'.repeat(50) }))
      .toBe(`s="${'x'.repeat(40)}..."`);
  });

  it('redacts authentication fields without exposing their values', () => {
    const out = summarizeParams({
      token: 'token-value',
      Cookie: 'cookie-value',
      Authorization: 'Bearer authorization-value',
      user_password: 'password-value',
      apiKey: 'key-value',
      group_id: 12345,
    });

    expect(out).toContain('token="***"');
    expect(out).toContain('Cookie="***"');
    expect(out).toContain('Authorization="***"');
    expect(out).toContain('user_password="***"');
    expect(out).toContain('apiKey="***"');
    expect(out).toContain('group_id=12345');
    expect(out).not.toMatch(
      /token-value|cookie-value|authorization-value|password-value|key-value/,
    );
  });

  it('does not treat sensitive substrings inside ordinary keys as credentials', () => {
    expect(summarizeParams({
      retoken: 'visible',
      cookietown: 'visible',
      myauthorization: 'visible',
    })).toBe(
      'retoken="visible" cookietown="visible" myauthorization="visible"',
    );
  });

  it('caps total output and appends "..." on overflow', () => {
    const big: Record<string, number> = {};
    for (let i = 0; i < 60; i++) big['key' + i] = i;
    const out = summarizeParams(big);
    expect(out.startsWith('key0=0')).toBe(true);
    expect(out.endsWith('...')).toBe(true);
    expect(out.length).toBeLessThanOrEqual(200);
  });

  it('caps a single oversized first key and top-level primitive', () => {
    const oversizedKey = 'k'.repeat(300);

    const objectOut = summarizeParams({ [oversizedKey]: 'value' });
    const primitiveOut = summarizeParams('x'.repeat(300));

    expect(objectOut).toHaveLength(200);
    expect(objectOut.endsWith('...')).toBe(true);
    expect(primitiveOut).toHaveLength(200);
    expect(primitiveOut.endsWith('...')).toBe(true);
  });
});

describe('redactLogMessage', () => {
  it('redacts explicit authentication assignments without changing prose', () => {
    const out = redactLogMessage(
      'password=secret Authorization: Bearer bearer-secret cookie="cookie secret" password change required',
    );

    expect(out).toBe(
      'password=*** Authorization: *** cookie=*** password change required',
    );
  });

  it('redacts quoted object keys, Basic auth, and complete Cookie values', () => {
    const out = redactLogMessage(
      `json={"authorization":"Basic json-auth"} object={ 'api-key': 'api-secret' } Authorization: Basic header-auth Cookie=session=cookie-secret; Path=/; HttpOnly`,
    );
    const expires = redactLogMessage(
      'Cookie=session=expires-secret; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Path=/; HttpOnly safe=visible',
    );

    expect(out).toContain('json={"authorization":***}');
    expect(out).toContain("object={ 'api-key': *** }");
    expect(out).toContain('Authorization: *** Cookie=***');
    expect(expires).toBe('Cookie=*** safe=visible');
    expect(out).not.toMatch(/json-auth|api-secret|header-auth|cookie-secret|Path=|HttpOnly/);
    expect(expires).not.toMatch(/expires-secret|Expires|21 Oct|Path=|HttpOnly/);
  });

  it('redacts complete multi-parameter Authorization values', () => {
    const out = redactLogMessage(
      'Authorization: Digest username="alice", realm="qq", response="digest-secret"\n'
        + 'authorization=AWS4-HMAC-SHA256 Credential=AKID/20260730/cn/service/aws4_request, '
        + 'SignedHeaders=host;x-date, Signature=aws-secret\n'
        + 'Authorization: Bearer bearer-secret Cookie=session=cookie-secret; Path=/',
    );

    expect(out).toBe(
      'Authorization: ***\nauthorization=***\nAuthorization: *** Cookie=***',
    );
    expect(out).not.toMatch(
      /alice|realm|digest-secret|AKID|SignedHeaders|aws-secret|bearer-secret|cookie-secret|Path=/,
    );
  });

  it('redacts camelCase authentication keys without matching larger words', () => {
    const out = redactLogMessage(
      `authToken=auth-secret idToken=id-secret clientSecret=client-secret {"userPassword":"password-secret"}`,
    );

    expect(out).toBe(
      `authToken=*** idToken=*** clientSecret=*** {"userPassword":***}`,
    );
    expect(out).not.toMatch(
      /auth-secret|id-secret|client-secret|password-secret/,
    );
    expect(redactLogMessage(
      'retoken=value cookietown=value myauthorization=value',
    )).toBe('retoken=value cookietown=value myauthorization=value');
  });

  it('redacts leading separator and numeric authentication keys without matching larger words', () => {
    expect(redactLogMessage(
      '_token=underscore-secret --password=cli-secret 2faToken=two-factor-secret retoken=visible',
    )).toBe('_token=*** --password=*** 2faToken=*** retoken=visible');
  });

  it('redacts nested assignments inside non-sensitive wrapper values', () => {
    expect(redactLogMessage(
      'params=authToken=auth-secret params=cookie="cookie-secret"',
    )).toBe('params=authToken=*** params=cookie=***');
  });

  it('redacts the entire Authorization value when it starts with a marker', () => {
    expect(redactLogMessage('Authorization: *** secret-value'))
      .toBe('Authorization: ***');
  });

  it('redacts property paths and URL query authentication values', () => {
    const out = redactLogMessage(
      'headers.authorization=Basic dXNlcjpwYXNz '
        + 'request.token=plain-token '
        + 'GET /callback?access_token=query-secret&x=1 '
        + 'url=https://host/?api_key=url-secret',
    );

    expect(out).toContain('headers.authorization=***');
    expect(out).toContain('request.token=***');
    expect(out).toContain('/callback?access_token=***&x=1');
    expect(out).toContain('https://host/?api_key=***');
    expect(out).not.toMatch(/dXNlcjpwYXNz|plain-token|query-secret|url-secret/);
  });

  it('redacts prefixed authentication keys without matching larger words', () => {
    const redacted = redactLogMessage(
      'x-api-key=api-secret user_password=password-secret '
        + 'headers.authorization=Basic auth-secret '
        + 'x-cookie="session=cookie-secret"; Path=/; HttpOnly',
    );

    expect(redacted).toContain('x-api-key=***');
    expect(redacted).toContain('user_password=***');
    expect(redacted).toContain('headers.authorization=***');
    expect(redacted).toContain('x-cookie=***');
    expect(redacted).not.toMatch(/api-secret|password-secret|auth-secret|cookie-secret|Path=|HttpOnly/);
    expect(redactLogMessage(
      'retoken=value cookietown=value myauthorization=value',
    )).toBe('retoken=value cookietown=value myauthorization=value');
  });
});

describe('renderParamsVerbose', () => {
  it('keeps authentication fields unredacted for complete TRACE diagnostics', () => {
    const out = renderParamsVerbose({
      token: 'token-value',
      Cookie: 'cookie-value',
      password: 'password-value',
      apiKey: 'key-value',
    });

    expect(out).toContain('token:"token-value"');
    expect(out).toContain('Cookie:"cookie-value"');
    expect(out).toContain('password:"password-value"');
    expect(out).toContain('apiKey:"key-value"');
    expect(out).not.toContain('"***"');
  });

  it('does not truncate TRACE values or their enclosing object', () => {
    const unicodeValue = '雪'.repeat(800);
    const out = renderParamsVerbose({ blob: unicodeValue, tail: 'complete' });

    expect(out).toContain(`blob:${JSON.stringify(unicodeValue)}`);
    expect(out).toContain('tail:"complete"');
    expect(out).not.toMatch(/…<\d+B>|\.\.\./);
  });

  it('guards against circular references', () => {
    const o: Record<string, unknown> = { a: 1 };
    o.self = o;
    expect(renderParamsVerbose(o)).toContain('"[circular]"');
  });

  it('renders shared non-cyclic references in every branch', () => {
    const shared = { value: 1 };

    expect(renderParamsVerbose({ left: shared, right: shared }))
      .toBe('{left:{value:1},right:{value:1}}');
  });

  it('renders nested structure with primitives intact', () => {
    expect(renderParamsVerbose({ a: 1, b: [true, 'x'] })).toBe('{a:1,b:[true,"x"]}');
  });
});