Spaces:
Running
Running
File size: 3,183 Bytes
63e8227 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 | """
Tests for run-payload logging.
Covers sanitize_payload() in session_logger.py — the guard that lets the full
run payload go into the Supabase session_logs meta column on every run without
ever leaking secrets (trusted-auth keys, API keys, passwords).
"""
import json
from session_logger import sanitize_payload
def test_secret_keys_are_redacted():
payload = {
'thoughtspot_trusted_auth_key': 'super-secret-value-123',
'openai_api_key': 'sk-abc',
'password': 'hunter2',
'some_token': 'tok_xyz',
'thoughtspot_url': 'https://demo.thoughtspot.cloud',
'company': 'Acme',
}
out = sanitize_payload(payload)
dumped = json.dumps(out)
assert 'super-secret-value-123' not in dumped
assert 'sk-abc' not in dumped
assert 'hunter2' not in dumped
assert 'tok_xyz' not in dumped
# Non-secret values pass through untouched
assert out['thoughtspot_url'] == 'https://demo.thoughtspot.cloud'
assert out['company'] == 'Acme'
# Redacted values carry a length marker, not the secret
assert out['thoughtspot_trusted_auth_key'].startswith('<redacted')
def test_nested_secrets_are_redacted():
payload = {'settings': {'inner': {'auth_key': 'deep-secret'}}}
out = sanitize_payload(payload)
assert 'deep-secret' not in json.dumps(out)
def test_long_strings_are_truncated():
out = sanitize_payload({'ddl': 'x' * 5000})
assert len(out['ddl']) < 2100
assert 'truncated' in out['ddl']
def test_json_safe_output():
class Weird:
def __repr__(self):
return 'WeirdObject'
payload = {
'obj': Weird(),
'tuple': (1, 2),
'none': None,
'flag': True,
'num': 3.5,
'list': [{'k': 'v'}, 'plain'],
}
out = sanitize_payload(payload)
# Must round-trip through JSON without default= hacks (Supabase insert path)
json.dumps(out)
assert out['obj'] == 'WeirdObject'
assert out['tuple'] == [1, 2]
assert out['none'] is None
def test_typical_run_payload_shape():
"""A realistic snapshot like _snapshot_run_payload() produces."""
snapshot = {
'interface': 'app_defined',
'company': 'https://nike.com',
'use_case': 'Retail Sales Performance',
'vertical': 'Retail',
'line': 'Retail',
'function': 'Sales',
'is_custom': False,
'additional_context': '',
'form': {
'vertical': 'Retail', 'line': 'Retail', 'function': 'Sales',
'url': 'https://nike.com', 'use_url': True, 'additional_info': '',
'model': 'GPT-5', 'ts_environment': 'SE Demo', 'liveboard_name': None,
'data_size': 'Medium', 'geo_scope': 'USA Only', 'tag_name': '',
'column_naming': 'snake_case', 'object_prefix': '', 'share_with': '',
},
'settings': {
'model': 'GPT-5',
'thoughtspot_trusted_auth_key': 'SECRET',
'fact_table_size': '10000',
},
}
out = sanitize_payload(snapshot)
assert 'SECRET' not in json.dumps(out)
assert out['form']['data_size'] == 'Medium'
assert out['settings']['fact_table_size'] == '10000'
|