Import AITURK IDE 1.0.0-beta.1 from Hermes 63279301; preserve MIT license

tests/monitoring/test_gateway_health_export.py

@@ -0,0 +1,120 @@
+from __future__ import annotations
+
+import logging
+
+import pytest
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+def test_otlp_attrs_redact_strings_and_never_export_profile():
+    from agent.monitoring.otlp_exporter import _span_attrs
+
+    attrs = _span_attrs({
+        "event": "gateway_health",
+        "name": "gateway.lifecycle",
+        "profile": "user@example.com",
+        "exit_reason": "Bearer top-secret-token for user@example.com",
+    })
+
+    assert "hermes.profile" not in attrs
+    assert "top-secret-token" not in str(attrs)
+    assert "user@example.com" not in str(attrs)
+
+
+def test_resource_attributes_are_allowlisted_and_sanitized():
+    from agent.monitoring.gateway_health_export import _safe_resource_attributes
+
+    attrs = _safe_resource_attributes({
+        "service.name": "hermes-gateway",
+        "service.instance.id": "install-1",
+        "deployment.environment.name": "staging",
+        "user.email": "user@example.com",
+        "authorization": "Bearer top-secret-token",
+        "custom.request.id": "unbounded",
+    })
+
+    assert attrs == {
+        "service.name": "hermes-gateway",
+        "service.instance.id": attrs["service.instance.id"],
+        "deployment.environment.name": "staging",
+    }
+    assert attrs["service.instance.id"].startswith("sha256:")
+    assert "install-1" not in attrs["service.instance.id"]
+
+
+
+
+
+
+def test_diagnostic_log_attributes_are_allowlisted_redacted_and_profile_free():
+    from agent.monitoring.gateway_health_export import _diagnostic_log_attributes
+
+    attrs = _diagnostic_log_attributes({
+        "event": "gateway_diagnostic",
+        "name": "platform.fatal",
+        "subsystem": "platform.slack",
+        "profile": "user@example.com",
+        "error_code": "Bearer top-secret-token",
+        "custom": "must-not-egress",
+    })
+
+    assert "hermes.profile" not in attrs
+    assert "hermes.custom" not in attrs
+    assert "top-secret-token" not in str(attrs)
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+def test_install_id_persists_across_calls(tmp_path, monkeypatch):
+    """A minted install id must survive restarts (service.instance.id continuity)."""
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+    (tmp_path / "config.yaml").write_text("{}\n")
+
+    import hermes_cli.config as cfg_mod
+    from agent.monitoring.policy import ensure_install_id
+
+    first = ensure_install_id(cfg_mod.load_config())
+    assert first and first != "unknown"
+    # Persisted: a fresh load (simulating a new gateway process) returns the same id.
+    second = ensure_install_id(cfg_mod.load_config())
+    assert second == first
+    assert first in (tmp_path / "config.yaml").read_text()
+
+