feat(management): ConfigSecretScrubber for connection-config secret elision

Claude-Session: https://claude.ai/code/session_01MtdgwpEeCUn6cUA5f1LMPj
2026-07-10 05:01:59 -04:00
parent efa6ac223c
commit 5cfa85ea91
3 changed files with 270 additions and 0 deletions
@@ -0,0 +1,45 @@
+namespace ZB.MOM.WW.ScadaBridge.ManagementService.Tests;
+
+public class ConfigSecretScrubberTests
+{
+    [Fact]
+    public void Scrub_RedactsPasswordFields_AtAnyDepth()
+    {
+        var json = """{"Endpoint":"opc.tcp://x","UserIdentity":{"Username":"u","Password":"p"},"CertificatePassword":"cp"}""";
+        var (scrubbed, had) = ConfigSecretScrubber.Scrub(json);
+        Assert.True(had);
+        Assert.DoesNotContain("\"p\"", scrubbed);
+        Assert.DoesNotContain("\"cp\"", scrubbed);
+        Assert.Contains(ConfigSecretScrubber.Sentinel, scrubbed);
+        Assert.Contains("opc.tcp://x", scrubbed); // non-secrets untouched
+    }
+
+    [Fact]
+    public void Scrub_NoSecrets_ReturnsFalseFlag()
+    {
+        var (_, had) = ConfigSecretScrubber.Scrub("""{"Endpoint":"opc.tcp://x"}""");
+        Assert.False(had);
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("not-json{")]
+    public void Scrub_NullEmptyOrMalformed_PassesThrough(string? input)
+    {
+        var (scrubbed, had) = ConfigSecretScrubber.Scrub(input);
+        Assert.Equal(input, scrubbed);
+        Assert.False(had);
+    }
+
+    [Fact]
+    public void MergeSentinels_RestoresStoredSecrets_KeepsEdits()
+    {
+        var stored = """{"Endpoint":"old","UserIdentity":{"Password":"real"}}""";
+        var incoming = $$$"""{"Endpoint":"new","UserIdentity":{"Password":"{{{ConfigSecretScrubber.Sentinel}}}"}}""";
+        var merged = ConfigSecretScrubber.MergeSentinels(incoming, stored)!;
+        Assert.Contains("\"new\"", merged);
+        Assert.Contains("\"real\"", merged);
+        Assert.DoesNotContain(ConfigSecretScrubber.Sentinel, merged);
+    }
+}