OmniRoute/tests/unit/mitm-masksecrets.test.ts

import test from "node:test";
import assert from "node:assert/strict";
import { maskSecret } from "../../src/mitm/maskSecrets.ts";

test("maskSecret — Bearer token is masked", () => {
  const input = "authorization: Bearer sk-proj-abcdefghijklmnop";
  const result = maskSecret(input);
  assert.ok(result.includes("Bearer ***"), `Expected Bearer ***, got: ${result}`);
  assert.ok(!result.includes("sk-proj-abcdefghijklmnop"), "Should not contain original token");
});

test("maskSecret — sk- key is masked with prefix and suffix", () => {
  const input = "sk-abcdefghijklmnopqrstuvwxyz123456";
  const result = maskSecret(input);
  assert.ok(result.startsWith("sk-abc"), `Expected prefix sk-abc, got: ${result}`);
  assert.ok(result.endsWith("…56"), `Expected suffix …56, got: ${result}`);
  assert.ok(!result.includes("ghijklmnopqrstuvwxyz1234"), "Middle chars should be redacted");
});

test("maskSecret — ak- key is masked", () => {
  const input = "ak-1234567890abcdefghijklmnop";
  const result = maskSecret(input);
  assert.ok(result.startsWith("ak-123"));
  assert.ok(result.endsWith("…op"));
});

test("maskSecret — pk- key is masked", () => {
  const input = "pk-supersecretkeywithmorethan16chars";
  const result = maskSecret(input);
  assert.ok(result.startsWith("pk-sup"));
  assert.ok(result.endsWith("…rs"));
});

test("maskSecret — long opaque token (≥40 chars) is masked", () => {
  const longToken = "A".repeat(40);
  const result = maskSecret(longToken);
  assert.ok(result.startsWith("AAAA"));
  assert.ok(result.endsWith("…AA"));
  assert.ok(result.length < longToken.length);
});

test("maskSecret — string without secrets is unchanged", () => {
  const safe = "Content-Type: application/json";
  assert.equal(maskSecret(safe), safe);
});

test("maskSecret — multiple secrets in same string", () => {
  const input = "sk-abcdefghijklmnopqrstuvwxyz12345678 and pk-qwertyuiopasdfghjklzxcvbnm12345";
  const result = maskSecret(input);
  assert.ok(!result.includes("abcdefghijklmno"));
  assert.ok(!result.includes("qwertyuiopasdfg"));
});

test("maskSecret — secrets embedded in quoted strings", () => {
  const input = `"api_key": "sk-abcdefghijklmnopqrstuvwxyz12345678"`;
  const result = maskSecret(input);
  assert.ok(!result.includes("abcdefghijklmno"));
});

test("maskSecret — short sk- key below 16 chars is NOT masked", () => {
  const shortKey = "sk-shortkey";
  assert.equal(maskSecret(shortKey), shortKey);
});