fix: use one content classifier across all log redaction paths

2026-10-10 02:07:13 +08:00
parent 6c4ca28a24
commit 2683d985d2
3 changed files with 54 additions and 14 deletions
@@ -29,6 +29,38 @@ func TestAssociatedSensitiveControlsHideContentWithoutSwallowingBusiness(t *test
 	}
 }

+func TestContentFieldClassificationAndEveryLoggingPathAgree(t *testing.T) {
+	fields := []string{"conversation", "history", "messages", "system_message", "final_transcript", "message_content", "utterance", "sentence", "sentences", "words", "opening_remark", "opening_remarks", "greeting", "chat_history", "conversation_history", "dialogue"}
+	for _, field := range fields {
+		t.Run(field, func(t *testing.T) {
+			if !sensitive(field) || !conversationField(field) {
+				t.Fatalf("content field classifications disagree: %s sensitive=%v continuation=%v", field, sensitive(field), conversationField(field))
+			}
+			textValue := "upstream failed\n" + field + ":\n\nuser: private-user-turn\n\nassistant: private-assistant-turn\n\nstatus=retry_pending\nattempts=2"
+			jsonValue := `{"` + field + `":[{"role":"user","message":"private-user-turn"},{"role":"assistant","message":"private-assistant-turn"}],"task_id":4,"status":"retry_pending"}`
+			for _, debug := range []bool{false, true} {
+				out := installTestLogger(t, debug)
+				slog.Error("failed", "error", errors.New(textValue), "detail", textValue)
+				slog.Info(textValue, "stage", "failure_observed")
+				slog.Error("failed", "error", errors.New("upstream: "+jsonValue), "detail", jsonValue)
+				TextBody(t.Context(), "HTTP text observed", []byte(textValue), "transport", "http")
+				Body(t.Context(), "HTTP JSON observed", []byte(jsonValue), "transport", "http")
+				text := out.String()
+				for _, secret := range []string{"private-user-turn", "private-assistant-turn"} {
+					if strings.Contains(text, secret) {
+						t.Fatalf("%s debug %v leak: %s", field, debug, text)
+					}
+				}
+				for _, keep := range []string{"upstream failed", "retry_pending", "task_id", "attempts=2"} {
+					if !strings.Contains(text, keep) {
+						t.Fatal("business diagnostics lost", text)
+					}
+				}
+			}
+		})
+	}
+}
+
 func TestConversationOwnershipPersistsAcrossBlankLines(t *testing.T) {
 	for _, gap := range []string{"\n", "\n\n", "\n \n\t\n", "\r\n\r\n"} {
 		for _, label := range []string{"messages", "prompt", "transcript", "content"} {