feat(harness): add server-authoritative approvals

2026-09-07 15:47:12 +08:00
parent ec0686cd56
commit 85739f58ed
6 changed files with 393 additions and 0 deletions
@@ -0,0 +1,37 @@
+import { describe, expect, it } from "vitest";
+import * as harness from "../src/index.js";
+
+describe("redactAndLimit", () => {
+  it("recursively redacts sensitive keys without mutating the source", () => {
+    const redactAndLimit = Reflect.get(harness, "redactAndLimit") as
+      | ((value: unknown, maxBytes: number) => unknown)
+      | undefined;
+    expect(redactAndLimit, "redactAndLimit must be exported").toBeDefined();
+    const source = {
+      apiKey: "sk-secret",
+      nested: [{ Authorization: "Bearer secret" }, { refresh_token: "refresh" }],
+      safe: "visible",
+    };
+
+    expect(redactAndLimit!(source, 10_000)).toEqual({
+      apiKey: "[REDACTED]",
+      nested: [{ Authorization: "[REDACTED]" }, { refresh_token: "[REDACTED]" }],
+      safe: "visible",
+    });
+    expect(source.apiKey).toBe("sk-secret");
+  });
+
+  it("replaces oversized serialized values with a typed byte summary", () => {
+    const redactAndLimit = Reflect.get(harness, "redactAndLimit") as
+      | ((value: unknown, maxBytes: number) => unknown)
+      | undefined;
+    const result = redactAndLimit?.({ text: "中".repeat(100) }, 32);
+
+    expect(result).toMatchObject({
+      type: "truncated",
+      maxBytes: 32,
+    });
+    expect(Reflect.get(result as object, "byteLength")).toBeGreaterThan(32);
+    expect(JSON.stringify(result)).not.toContain("中");
+  });
+});