package engine import ( "testing" "gitea.maximumdirect.net/eric/ConfigKit/internal/document" ) func TestPreparePairedDiffSnapshotRedactsAlignedMappingFromEitherSide(t *testing.T) { left := parseCompositionDocument(t, "left", "credential: alpha\npublic: before\n") right := parseCompositionDocument(t, "right", "credential: bravo\npublic: after\n") sensitivity := newDiffSensitivity(map[string]bool{"/credential": true}, nil) paired, supported := preparePairedDiffSnapshot(left, right, Path{}, sensitivity) if !supported { t.Fatal("compatible mappings were not supported") } if !paired.leftRedacted || !paired.rightRedacted { t.Fatalf("redacted flags = %v, %v; want true on both sides", paired.leftRedacted, paired.rightRedacted) } assertDiffStringNode(t, mappingValue(t, paired.left, "credential"), "[REDACTED]") assertDiffStringNode(t, mappingValue(t, paired.right, "credential"), "[REDACTED]") assertDiffStringNode(t, mappingValue(t, paired.left, "public"), "before") assertDiffStringNode(t, mappingValue(t, paired.right, "public"), "after") assertDiffStringNode(t, mappingValue(t, left, "credential"), "alpha") assertDiffStringNode(t, mappingValue(t, right, "credential"), "bravo") if paired.left == left || paired.right == right || &paired.left.Mapping[0] == &left.Mapping[0] { t.Fatal("safe mapping containers or entries share mutable storage with retained trees") } } func TestPreparePairedDiffSnapshotPreservesSequencePositionsAndLengths(t *testing.T) { left := parseCompositionDocument(t, "left", "items: [left-public, hidden, old-tail]\n") right := parseCompositionDocument(t, "right", "items: [right-public, hidden, old-tail, extra]\n") sensitivity := newDiffSensitivity(nil, map[string]bool{"/items/1": true}) paired, supported := preparePairedDiffSnapshot( mappingValue(t, left, "items"), mappingValue(t, right, "items"), Keys("items"), sensitivity, ) if !supported { t.Fatal("compatible sequences were not supported") } if !paired.leftRedacted || !paired.rightRedacted { t.Fatalf("redacted flags = %v, %v; want true on both sides", paired.leftRedacted, paired.rightRedacted) } if len(paired.left.Sequence) != 3 || len(paired.right.Sequence) != 4 { t.Fatalf("sequence lengths = %d, %d; want 3, 4", len(paired.left.Sequence), len(paired.right.Sequence)) } assertDiffStringNode(t, paired.left.Sequence[0], "left-public") assertDiffStringNode(t, paired.right.Sequence[0], "right-public") assertDiffStringNode(t, paired.left.Sequence[1], "[REDACTED]") assertDiffStringNode(t, paired.right.Sequence[1], "[REDACTED]") assertDiffStringNode(t, paired.right.Sequence[3], "extra") assertDiffStringNode(t, mappingValue(t, left, "items").Sequence[1], "hidden") if &paired.left.Sequence[0] == &mappingValue(t, left, "items").Sequence[0] { t.Fatal("safe sequence shares mutable storage with retained tree") } } func TestPreparePairedDiffSnapshotMasksSensitiveDescendantsOfAbsentSubtrees(t *testing.T) { tests := []struct { name string left, right string absentSide string }{ { name: "removed subtree", left: "removed: {token: old-secret, public: retained}\n", right: "other: value\n", absentSide: "right", }, { name: "added subtree", left: "other: value\n", right: "added: {token: new-secret, public: retained}\n", absentSide: "left", }, } for _, test := range tests { t.Run(test.name, func(t *testing.T) { left := parseCompositionDocument(t, "left", test.left) right := parseCompositionDocument(t, "right", test.right) paired, supported := preparePairedDiffSnapshot( mappingValueIfPresent(left, "removed", "added"), mappingValueIfPresent(right, "removed", "added"), Keys("subtree"), newDiffSensitivity(map[string]bool{"/subtree/token": true}, nil), ) if !supported { t.Fatal("compatible subtree and absence were not supported") } if test.absentSide == "left" { if paired.left != nil || paired.leftRedacted || !paired.rightRedacted { t.Fatalf("paired absence/redaction = %#v", paired) } assertDiffStringNode(t, mappingValue(t, paired.right, "token"), "[REDACTED]") assertDiffStringNode(t, mappingValue(t, paired.right, "public"), "retained") } else { if paired.right != nil || paired.rightRedacted || !paired.leftRedacted { t.Fatalf("paired absence/redaction = %#v", paired) } assertDiffStringNode(t, mappingValue(t, paired.left, "token"), "[REDACTED]") assertDiffStringNode(t, mappingValue(t, paired.left, "public"), "retained") } }) } } func TestPreparePairedDiffSnapshotMasksSelectedRootAndContainer(t *testing.T) { tests := []struct { name string left, right *document.Node path Path selector string }{ { name: "root", left: parseCompositionDocument(t, "left", "token: old\n"), right: parseCompositionDocument(t, "right", "token: new\n"), path: Path{}, selector: "", }, { name: "container", left: parseCompositionDocument(t, "left", "group: {public: old}\n"), right: parseCompositionDocument(t, "right", "group: {public: new}\n"), path: Keys("group"), selector: "/group", }, } for _, test := range tests { t.Run(test.name, func(t *testing.T) { paired, supported := preparePairedDiffSnapshot( test.left, test.right, test.path, newDiffSensitivity(map[string]bool{test.selector: true}, nil), ) if !supported { t.Fatal("selected nodes were not supported") } if !paired.leftRedacted || !paired.rightRedacted { t.Fatalf("redacted flags = %v, %v; want true on both sides", paired.leftRedacted, paired.rightRedacted) } assertDiffStringNode(t, paired.left, "[REDACTED]") assertDiffStringNode(t, paired.right, "[REDACTED]") }) } } func TestPreparePairedDiffSnapshotDoesNotInterpretMarkerLookingInput(t *testing.T) { left := parseCompositionDocument(t, "left", "label: '[REDACTED]'\n") right := parseCompositionDocument(t, "right", "label: '[REDACTED]'\n") paired, supported := preparePairedDiffSnapshot( mappingValue(t, left, "label"), mappingValue(t, right, "label"), Keys("label"), newDiffSensitivity(nil, nil), ) if !supported { t.Fatal("ordinary scalar values were not supported") } if paired.leftRedacted || paired.rightRedacted { t.Fatalf("redacted flags = %v, %v; want false", paired.leftRedacted, paired.rightRedacted) } if paired.left != mappingValue(t, left, "label") || paired.right != mappingValue(t, right, "label") { t.Fatal("unselected scalar nodes should remain borrowed immutable nodes") } assertDiffStringNode(t, paired.left, "[REDACTED]") assertDiffStringNode(t, paired.right, "[REDACTED]") } func TestPreparePairedDiffSnapshotWithholdsUnsupportedIntermediateShape(t *testing.T) { left := parseCompositionDocument(t, "left", "token: undisclosed-canary\npublic: safe\n") right := &document.Node{Kind: document.String, Text: "replacement"} paired, supported := preparePairedDiffSnapshot( left, right, Path{}, newDiffSensitivity(nil, map[string]bool{"/token": true}), ) if supported || paired.left != nil || paired.right != nil { t.Fatalf("unsupported shape returned potentially unsafe nodes: %#v, supported=%v", paired, supported) } } func mappingValueIfPresent(node *document.Node, keys ...string) *document.Node { if node == nil { return nil } for _, key := range keys { for _, entry := range node.Mapping { if entry.Key == key { return entry.Value } } } return nil } func assertDiffStringNode(t *testing.T, node *document.Node, want string) { t.Helper() if node == nil || node.Kind != document.String || node.Text != want { t.Fatalf("node = %#v, want string %q", node, want) } }