test_source_exporter.py

Go to the documentation of this file.

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# oct/tests/tests_tools/test_source_exporter.py
 
"""
Purpose
-------
Tests for content-level secret scanning (OI-416) in ``oct.tools.source_exporter``.
 
Responsibilities
----------------
- Verify ``_scan_content_for_secrets`` flags likely secret assignments.
- Verify non-secret assignments are not flagged.
- Verify ``run_exporter`` emits warnings when ``--warn-secrets`` is on.
- Verify ``--block-secrets`` excludes files with potential secrets from
  the exported content.
 
Diagnostics
-----------
Domain: OCT-TEST
L2: test lifecycle
L3: assertion details
L4: deep tracing
 
Contracts
---------
Inputs:  tmp_path fixtures
Outputs: pass/fail assertions
"""
 
import json
from pathlib import Path
 
import pytest
 
from oct.tools import source_exporter
 
 
# ============================================================
# _scan_content_for_secrets
# ============================================================
 
def test_scan_flags_password_literal():
    content = 'password = "hunter2_is_bad"\n'
    warnings = source_exporter._scan_content_for_secrets(content, "foo.py")
    assert len(warnings) == 1
    assert "password" in warnings[0]
    assert "foo.py:1" in warnings[0]
 
 
def test_scan_flags_api_key():
    content = 'api_key = "sk-abc123xyz"\n'
    warnings = source_exporter._scan_content_for_secrets(content, "bar.py")
    assert len(warnings) == 1
    assert "api_key" in warnings[0]
 
 
def test_scan_ignores_non_secret_names():
    content = 'name = "Alice"\nage = "30"\n'
    warnings = source_exporter._scan_content_for_secrets(content, "baz.py")
    assert warnings == []
 
 
def test_scan_ignores_short_values():
    """Very short values (< 4 chars) don't look like real secrets."""
    content = 'password = "a"\n'
    warnings = source_exporter._scan_content_for_secrets(content, "qux.py")
    assert warnings == []
 
 
def test_scan_line_numbers_correct():
    content = (
        "# comment\n"
        "import os\n"
        "\n"
        'secret_token = "abc1234xyz"\n'
    )
    warnings = source_exporter._scan_content_for_secrets(content, "m.py")
    assert len(warnings) == 1
    assert ":4:" in warnings[0]
 
 
# ============================================================
# run_exporter integration
# ============================================================
 
def _make_minimal_project(tmp_path: Path, file_name: str, content: str) -> Path:
    """Create a minimal Option C project layout with one python file."""
    proj = tmp_path / "proj"
    (proj / "docs").mkdir(parents=True)
    (proj / "tests").mkdir()
    (proj / "oc_diagnostics").mkdir()
    (proj / file_name).write_text(content, encoding="utf-8")
    return proj
 
 
def test_run_exporter_warns_on_hardcoded_secret(tmp_path, capsys):
    proj = _make_minimal_project(
        tmp_path, "app.py",
        '#!/usr/bin/env python3\n'
        '# -*- coding: utf-8 -*-\n'
        '# proj/app.py\n'
        '"""Doc."""\n'
        'password = "hunter2_literal"\n'
    )
    source_exporter.run_exporter(proj, ["--warn-secrets"])
    captured = capsys.readouterr()
    assert "potential secret 'password'" in captured.err
 
 
def test_run_exporter_no_warn_by_default_without_flag(tmp_path, capsys):
    proj = _make_minimal_project(
        tmp_path, "app.py",
        'password = "hunter2_literal"\n'
    )
    source_exporter.run_exporter(proj, [])
    captured = capsys.readouterr()
    assert "potential secret" not in captured.err
 
 
def test_run_exporter_block_secrets_skips_file(tmp_path, capsys):
    proj = _make_minimal_project(
        tmp_path, "leaky.py",
        '#!/usr/bin/env python3\n'
        '# -*- coding: utf-8 -*-\n'
        '# proj/leaky.py\n'
        '"""Leaky."""\n'
        'api_key = "sk-SECRET_VALUE_1234"\n'
    )
    source_exporter.run_exporter(proj, ["--block-secrets"])
    captured = capsys.readouterr()
    assert "potential secret 'api_key'" in captured.err
    assert "Skipping" in captured.err
 
    # Confirm the full-source export file does NOT contain the secret value
    output_dirs = list(proj.glob("_source_code-*"))
    assert output_dirs, "exporter should have produced at least one output dir"
    found_secret = False
    for p in output_dirs[0].rglob("*.txt"):
        text = p.read_text(encoding="utf-8", errors="replace")
        if "sk-SECRET_VALUE_1234" in text:
            found_secret = True
            break
    assert not found_secret, "blocked file should not appear in exported content"