test_secret_match_word.py

Go to the documentation of this file.

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# tests/tests_linter/test_secret_match_word.py
 
"""
Purpose
-------
OI-529 regression coverage — :func:`_name_matches_secret` and the
``--secret-match {substring,word}`` CLI flag.
 
The legacy ``substring`` matcher flagged any name that happened to
contain a secret-shaped substring, so ordinary identifiers like
``tokenizer`` (contains ``token``) or ``pwdistance`` (contains ``pwd``)
tripped the scanner. The ``word`` mode splits on ``_``/``-``/camelCase
boundaries and only flags whole-segment hits, so ``user_password``
still flags but ``tokenizer`` does not.
 
Responsibilities
----------------
- ``substring`` mode flags ``compass``.
- ``word`` mode does not flag ``compass``.
- ``word`` mode still flags ``compass_password`` and ``apiKey``.
- ``check_no_hardcoded_secrets`` threads the mode through unchanged.
 
Diagnostics
-----------
Domain: LINT-TESTS
Levels:
    L2 — test lifecycle
    L3 — assertion details
    L4 — deep tracing
 
Contracts
---------
- Tests operate on in-memory strings and AST snippets; no files are
  written.
"""
 
from __future__ import annotations
 
from oct.tools.secret_scanner import (
    _name_matches_secret,
    check_no_hardcoded_secrets,
)
 
 
# ---------------------------------------------------------------------
# _name_matches_secret
# ---------------------------------------------------------------------
 
 
def test_substring_mode_flags_tokenizer_as_false_positive():
    # Legacy behaviour: ``tokenizer`` contains ``token`` → flags.
    assert _name_matches_secret("tokenizer", mode="substring") is True
 
 
def test_word_mode_does_not_flag_tokenizer():
    # OI-529 fix: ``tokenizer`` is a single segment, not in the pattern
    # set, so ``word`` mode returns False.
    assert _name_matches_secret("tokenizer", mode="word") is False
 
 
def test_word_mode_flags_snake_case_secret_segment():
    assert _name_matches_secret("user_password", mode="word") is True
    assert _name_matches_secret("db_connection_string", mode="word") is True
 
 
def test_word_mode_flags_camel_case_secret_segment():
    assert _name_matches_secret("apiKey", mode="word") is True
    assert _name_matches_secret("userToken", mode="word") is True
 
 
def test_word_mode_does_not_flag_pwdistance():
    # ``pwdistance`` contains ``pwd`` under substring matching.
    assert _name_matches_secret("pwdistance", mode="substring") is True
    assert _name_matches_secret("pwdistance", mode="word") is False
 
 
# ---------------------------------------------------------------------
# check_no_hardcoded_secrets threading
# ---------------------------------------------------------------------
 
 
def test_check_threads_mode_and_ignores_tokenizer_in_word_mode():
    source = 'tokenizer = "not-a-secret"\n'
    # substring: flags.
    ok_sub, msg_sub = check_no_hardcoded_secrets(source, mode="substring")
    assert ok_sub is False, msg_sub
    # word: clean.
    ok_word, msg_word = check_no_hardcoded_secrets(source, mode="word")
    assert ok_word is True, msg_word
 
 
def test_check_still_flags_real_secret_in_word_mode():
    source = 'api_key = "AKIA1234567890"\n'
    ok, msg = check_no_hardcoded_secrets(source, mode="word")
    assert ok is False, "word mode must still flag real secrets"
    assert "api_key" in msg