pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-09-17 04:12:17 +03:00
Code Issues Packages Projects Releases Wiki Activity

test(batches): rename the two seeded-batch labels that gitleaks reported as secrets (#13729)

Browse Source 
The labels wvxc-route-401/wvxc-route-500 sat right after a key*.id argument and cleared the gitleaks generic-api-key length and entropy floors; renamed to route401/route500 with a docblock stating the measured rule. Test-only; .gitleaks.toml untouched. Reviewed by 3 rounds of /omni-code-review (37 agents).
This commit is contained in:
Diego Rodrigues de Sa e Souza
2026-09-15 12:28:29 -03:00
committed by GitHub
parent 516927196c
commit 831b485e08
2 changed files with 14 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
changelog.d/maintenance/13729-rename-wvxc-route-test-labels.md Normal file
View File

@@ -0,0 +1,2 @@
- **test(batches):** the two seeded-batch labels of the delete-completed route-scope suite that sat right after a `key*.id` argument are renamed to short literals (`route401`/`route500`), so a gitleaks scan that reads those lines (full-tree, or git-mode on a branch that adds them) no longer reports them as `generic-api-key` hits ([#13729](https://github.com/diegosouzapw/OmniRoute/pull/13729))
— no gate changes: the CI secret ratchet scans `src`/`open-sse`/`bin`/`electron`/`scripts`, never `tests/`

15
tests/unit/batches-delete-completed-route-scope.test.ts
View File

@@ -62,6 +62,13 @@ async function sessionCookie(): Promise<string> {
return `auth_token=${jwt}`;
}
/**
* `label` names the seeded batch's `.jsonl` file. Keep it word-shaped or under 10 chars: the
* gitleaks generic-api-key rule reports a literal of 10+ chars with Shannon entropy >= 3.5 that
* sits right after a `key*.id` argument (the argument supplies the rule's "key" keyword).
* `wvxc-route-401` did (entropy 3.66) and became `route401` in #13729; the word-shaped
* `wvxc-route-<scenario>` siblings stay under the entropy floor and are clean.
*/
function seedCompletedBatch(apiKeyId: string | null, label: string) {
const file = createFile({
bytes: 8,
@@ -277,7 +284,8 @@ describe("DELETE /api/v1/batches/delete-completed — caller scope (GHSA-wvxc-jp
it("rejects an unauthenticated request with 401 and deletes nothing", async () => {
const keyB = await createApiKey("wvxc-route-401-b", "machine-wvxc-401", []);
const seeded = seedCompletedBatch(keyB.id, "wvxc-route-401");
// short label: see the seedCompletedBatch docblock (#13729)
const seeded = seedCompletedBatch(keyB.id, "route401");
const { res, body } = await callDelete({});
@@ -290,7 +298,8 @@ describe("DELETE /api/v1/batches/delete-completed — caller scope (GHSA-wvxc-jp
it("returns a sanitized 500 (no stack trace, no raw SQLite message) when the sweep throws, and deletes nothing", async () => {
const keyA = await createApiKey("wvxc-route-500-a", "machine-wvxc-500", []);
const own = seedCompletedBatch(keyA.id, "wvxc-route-500");
// short label: see the seedCompletedBatch docblock (#13729)
const own = seedCompletedBatch(keyA.id, "route500");
const db = getDbInstance();
db.exec(
@@ -312,7 +321,7 @@ describe("DELETE /api/v1/batches/delete-completed — caller scope (GHSA-wvxc-jp
assert.ok(getBatch(own.batch.id), "a failed sweep leaves the batch row in place");
assert.strictEqual(
getFileContent(own.file.id)?.toString(),
"wvxc-route-500",
"route500",
"a failed sweep rolls the file content back"
);
});