Function TestSecurityUnauthorizedAccess

pkg/workflow/security_regression_test.go:399–419

============================================================================= Authorization Tests ============================================================================= TestSecurityUnauthorizedAccess validates that unauthorized expression contexts are properly rejected.

(t *testing.T)

// TestSecurityUnauthorizedAccess validates that unauthorized expression
// contexts are properly rejected.
func TestSecurityUnauthorizedAccess(t *testing.T) {
	unauthorizedPatterns := []struct {
		pattern     string
		description string
	}{
		{"${{ secrets.GITHUB_TOKEN }}", "GITHUB_TOKEN secret access"},
		{"${{ secrets.API_KEY }}", "Custom secret access"},
		{"${{ secrets.MY_SECRET_VALUE }}", "Underscore secret access"},
		{"${{ github.token }}", "github.token access"},
		{"${{ github.event.token }}", "event token access"},
	}

	for _, tt := range unauthorizedPatterns {
		t.Run(tt.description, func(t *testing.T) {
			err := validateExpressionSafety(tt.pattern)
			if err == nil {
				t.Errorf("Security violation: %s should be blocked", tt.pattern)
			}
		})
	}
}

// TestSecurityTokenLeakage validates that tokens cannot be leaked through
// various expression paths.