Publish curated ForgeFlow source from 2ed1787c0b52

tests/log-redaction.test.mjs

@@ -0,0 +1,54 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import redaction from '../src/main/log-redaction.cjs';
+
+const { redactSecrets, sanitizeForDiagnostics, pathAlias, stableAlias, redactPrivateInfrastructure } = redaction;
+
+test('redacts runtime credentials, structured secrets, private keys and URL credentials', () => {
+  const token = ['gitea', 'TEST', 'ONLY', 'SecretToken123456'].join('_');
+  const input = [
+    `Authorization: Bearer ${token}`,
+    `https://${['jens', 'p4ssw0rd'].join(':')}@gitea.example.test/api?access_token=${token}`,
+    'client_secret=another-secret-value',
+    ['-----BEGIN', 'PRIVATE KEY-----\nsecret-key-material\n-----END PRIVATE KEY-----'].join(' ')
+  ].join('\n');
+  const output = redactSecrets(input, [token]);
+  assert.doesNotMatch(output, /ThisIsARealisticSecret|p4ssw0rd|another-secret-value|secret-key-material/);
+  assert.match(output, /REDACTED/);
+});
+
+test('sanitizes nested sensitive keys and aliases user paths', () => {
+  const value = {
+    accessToken: 'do-not-keep',
+    nested: { password: 'do-not-keep-either', path: 'C:\\Users\\example-user\\Projects\\ForgeFlow' },
+    home: '/home/jens/projects/forgeflow'
+  };
+  const sanitized = sanitizeForDiagnostics(value, { homeDir: '/home/jens', cwd: '/work/ForgeFlow' });
+  assert.equal(sanitized.accessToken, '[REDACTED]');
+  assert.equal(sanitized.nested.password, '[REDACTED]');
+  assert.doesNotMatch(JSON.stringify(sanitized), /do-not-keep|Users\\Jens|\/home\/jens/);
+  assert.match(JSON.stringify(sanitized), /<HOME>/);
+});
+
+test('strict privacy mode replaces stable identifiers deterministically', () => {
+  const first = sanitizeForDiagnostics({ fullName: 'jens/private-project', login: 'jens', host: '192.168.10.20', basePath: '/mnt/user/appdata' }, { strictIdentifiers: true });
+  const second = sanitizeForDiagnostics({ fullName: 'jens/private-project', login: 'jens', host: '192.168.10.20', basePath: '/mnt/user/appdata' }, { strictIdentifiers: true });
+  assert.equal(first.fullName, second.fullName);
+  assert.equal(first.login, second.login);
+  assert.notEqual(first.fullName, 'jens/private-project');
+  assert.match(first.fullName, /^fullname-[a-f0-9]{12}$/);
+  assert.notEqual(first.host, '192.168.10.20');
+  assert.notEqual(first.basePath, '/mnt/user/appdata');
+  assert.equal(stableAlias('same', 'repo'), stableAlias('same', 'repo'));
+});
+
+test('strict privacy redacts private addresses, infrastructure URLs and server paths in log text', () => {
+  const result = redactPrivateInfrastructure('host 192.168.10.20 url https://internal.example.test/status path /mnt/user/appdata/example');
+  assert.doesNotMatch(result, /192\.168\.10\.20|internal\.example\.test|\/mnt\/user\/appdata/);
+});
+
+test('path aliasing handles slash variants', () => {
+  const result = pathAlias('C:\\Users\\example-user\\src and C:/Users/example-user/src', { homeDir: 'C:\\Users\\example-user', cwd: 'D:\\ForgeFlow' });
+  assert.doesNotMatch(result, /Users[\\/]Jens/);
+  assert.match(result, /<HOME>/);
+});