TestAuditRedactsCredentials covers the request/response redactors that strip secrets before the audit pipeline serializes payloads. Specifically guards against regressions like the Signup password leak and the ExchangeToken OIDC/access-token leak that Codex flagged on #20024 — both only surfaced onc
(t *testing.T)
| 108 | // only surfaced once the corresponding audit path was re-enabled by the |
| 109 | // SetAuditWorkspaceID callback. |
| 110 | func TestAuditRedactsCredentials(t *testing.T) { |
| 111 | a := require.New(t) |
| 112 | |
| 113 | t.Run("LoginRequest redacts password and MFA secrets", func(_ *testing.T) { |
| 114 | otp := "123456" |
| 115 | mfa := "mfa-temp-jwt" |
| 116 | reqStr, err := getRequestString(&v1pb.LoginRequest{ |
| 117 | Email: "alice@example.com", |
| 118 | Password: "hunter2", |
| 119 | OtpCode: &otp, |
| 120 | MfaTempToken: &mfa, |
| 121 | }) |
| 122 | a.NoError(err) |
| 123 | a.Contains(reqStr, "alice@example.com", "non-sensitive email stays") |
| 124 | a.NotContains(reqStr, "hunter2", "plaintext password must not appear") |
| 125 | a.NotContains(reqStr, "123456", "OTP must not appear") |
| 126 | a.NotContains(reqStr, "mfa-temp-jwt", "MFA temp token must not appear") |
| 127 | }) |
| 128 | |
| 129 | t.Run("LoginResponse drops token", func(_ *testing.T) { |
| 130 | respStr, err := getResponseString(&v1pb.LoginResponse{ |
| 131 | Token: "secret-access-token", |
| 132 | User: &v1pb.User{Name: "users/alice@example.com"}, |
| 133 | }) |
| 134 | a.NoError(err) |
| 135 | a.Contains(respStr, "users/alice@example.com", "user info is retained") |
| 136 | a.NotContains(respStr, "secret-access-token", "access token must not appear") |
| 137 | }) |
| 138 | |
| 139 | t.Run("SignupRequest redacts password", func(_ *testing.T) { |
| 140 | reqStr, err := getRequestString(&v1pb.SignupRequest{ |
| 141 | Email: "bob@example.com", |
| 142 | Password: "signup-password", |
| 143 | Title: "bob", |
| 144 | }) |
| 145 | a.NoError(err) |
| 146 | a.Contains(reqStr, "bob@example.com") |
| 147 | a.NotContains(reqStr, "signup-password", |
| 148 | "plaintext password must not appear in Signup audit") |
| 149 | }) |
| 150 | |
| 151 | t.Run("ExchangeTokenRequest redacts OIDC token", func(_ *testing.T) { |
| 152 | reqStr, err := getRequestString(&v1pb.ExchangeTokenRequest{ |
| 153 | Token: "oidc.jwt.payload", |
| 154 | Email: "ci-bot@workload.bytebase.com", |
| 155 | }) |
| 156 | a.NoError(err) |
| 157 | a.Contains(reqStr, "ci-bot@workload.bytebase.com", |
| 158 | "workload email retained for audit correlation") |
| 159 | a.NotContains(reqStr, "oidc.jwt.payload", |
| 160 | "external OIDC token must not appear in audit — it can be replayed "+ |
| 161 | "against the original IdP or reveal workload claims") |
| 162 | }) |
| 163 | |
| 164 | t.Run("ExchangeTokenResponse drops issued access token", func(_ *testing.T) { |
| 165 | respStr, err := getResponseString(&v1pb.ExchangeTokenResponse{ |
| 166 | AccessToken: "issued-bytebase-api-token", |
| 167 | }) |
nothing calls this directly
no test coverage detected