803b389f6b
## 事件 aider-watch v1 session 把真 production TG bot token（NEMOTRON_BOT_TOKEN） 當成 test fixture 寫入下列 tracked 檔（均已 push Gitea）: - apps/api/tests/test_secret_redactor.py - docs/superpowers/plans/2026-04-19-aider-watch.md (3 處) - docs/superpowers/plans/2026-04-20-aider-watch-v2.md 違反 feedback_secrets_leak_incidents_2026-04-18.md L2 零信任（source control 無 secrets）。 ## 處置 - 統帥決議：不撤銷 token（接受風險） - 替換為假值 111222333:A*35（明顯 placeholder，仍符合 redactor 判別格式） - 減少未來 search engine / fork 的暴露面（但 git history 仍存） ## 驗證 secret_redactor.py 8 個 test 全過，telegram regex 仍能辨識新假值格式。 ## P1 backlog - git history 清理（git filter-repo）需統帥批准 force push - pre-commit hook 防未來再洩（grep TG token 格式 / detect-secrets） Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
39 lines
1.2 KiB
Python
39 lines
1.2 KiB
Python
# 2026-04-20 @ Asia/Taipei
|
||
# Import root 由 pytest rootdir=apps/api 提供（見 pyproject.toml），因此不得用 `apps.api.src.*` 絕對路徑
|
||
from src.utils.secret_redactor import redact
|
||
|
||
|
||
def test_openrouter_key_redacted():
|
||
assert "<redacted:openrouter>" in redact("sk-or-v1-abcdef0123456789ABCDEFghijklmnopqrstuv")
|
||
|
||
|
||
def test_anthropic_key_redacted():
|
||
assert "<redacted:anthropic>" in redact("sk-ant-api03-abcDEF_123-xyz")
|
||
|
||
|
||
def test_github_token_redacted():
|
||
assert "<redacted:github>" in redact("ghp_abcdef0123456789ABCDEFghijklmnopqrst")
|
||
|
||
|
||
def test_google_key_redacted():
|
||
assert "<redacted:google>" in redact("AIzaSyABCDEFGHIJKLMNOPQRSTUVWXYZ1234567")
|
||
|
||
|
||
def test_telegram_bot_token_redacted():
|
||
assert "<redacted:telegram>" in redact("111222333:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA")
|
||
|
||
|
||
def test_aws_key_redacted():
|
||
assert "<redacted:aws>" in redact("key=AKIAIOSFODNN7EXAMPLE")
|
||
|
||
|
||
def test_clean_passthrough():
|
||
assert redact("normal text here") == "normal text here"
|
||
|
||
|
||
def test_nested_dict():
|
||
d = {"a": "ghp_abcdef0123456789ABCDEFghijklmnopqrst", "b": {"c": "AIzaSyABCDEFGHIJKLMNOPQRSTUVWXYZ1234567"}}
|
||
out = redact(d)
|
||
assert "ghp_abc" not in str(out)
|
||
assert "AIzaSy" not in str(out)
|