Rogeeandrogee
f719529d66
* fix(security): harden auth and credential handling (HH-444) * fix(security): address HH-444 review blockers * fix(security): close remaining HH-444 review blockers --------- Co-authored-by: Rogee <rogee@ipao.vip>
32 lines
1.2 KiB
Go
32 lines
1.2 KiB
Go
package v1
|
|
|
|
import (
|
|
"encoding/json"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
"gorm.io/datatypes"
|
|
|
|
"github.com/gochat/gochat/internal/model"
|
|
)
|
|
|
|
func TestSensitiveSerializersMaskStoredCredentials(t *testing.T) {
|
|
accountID := uint(3)
|
|
bot := &model.AgentBot{AccountID: &accountID, AccessToken: "bot-token", Secret: "bot-secret"}
|
|
maskedBot := serializeAccountAgentBot(bot, accountID)
|
|
require.NotContains(t, maskedBot, "access_token")
|
|
require.NotContains(t, maskedBot, "secret")
|
|
require.Equal(t, "bot-token", serializeAccountAgentBot(bot, accountID, true)["access_token"])
|
|
|
|
webhook := model.WebhookSubscription{Secret: "webhook-secret", Events: json.RawMessage(`[]`)}
|
|
require.Equal(t, "***", serializeWebhookSubscription(webhook)["secret"])
|
|
require.Equal(t, "webhook-secret", serializeWebhookSubscription(webhook, true)["secret"])
|
|
|
|
hook := model.IntegrationHook{Settings: datatypes.JSON(`{"shop_domain":"shop.test","access_token":"hook-secret","nested":{"api_key":"nested-secret"}}`)}
|
|
encoded, err := json.Marshal(serializeIntegrationHook(hook))
|
|
require.NoError(t, err)
|
|
require.NotContains(t, string(encoded), "hook-secret")
|
|
require.NotContains(t, string(encoded), "nested-secret")
|
|
require.Contains(t, string(encoded), `"access_token":"***"`)
|
|
}
|