Import AITURK IDE 1.0.0-beta.1 from Hermes 63279301; preserve MIT license

tests/monitoring/test_export_redaction.py

@@ -0,0 +1,47 @@
+"""Export redaction tests — the security-critical layer.
+
+Invariants:
+  * One unconditional scrub: secrets AND PII, no modes, no knobs.
+  * Fails CLOSED: if the redactor can't run, the raw string is never emitted.
+  * Structure (subsystem names, error codes) survives; free-text PII does not.
+"""
+
+from __future__ import annotations
+
+from unittest import mock
+
+import agent.monitoring.redaction as R
+
+
+def test_secret_key_always_stripped():
+    fake_key = "sk-ant-api03-" + "A" * 24  # constructed to dodge literal-scrubbers
+    out = R.redact_for_export(f"calling with key {fake_key} and moving on")
+    assert out is not None
+    assert fake_key not in out
+
+
+
+
+def test_bearer_header_stripped():
+    out = R.redact_for_export("Authorization: Bearer abc.def-ghi_jkl")
+    assert out is not None
+    assert "abc.def-ghi_jkl" not in out
+
+
+
+
+
+
+
+
+def test_structure_preserved():
+    out = R.redact_for_export("platform.slack entered fatal after auth_failed")
+    assert out is not None
+    assert "platform.slack" in out
+    assert "auth_failed" in out
+
+
+def test_fails_closed_when_redactor_unavailable():
+    with mock.patch("agent.redact.redact_sensitive_text", side_effect=RuntimeError):
+        out = R.redact_for_export("secret sauce sk-live-key")
+    assert out == "[redaction-unavailable]"