fix: redact bot secrets in startup logs

2026-04-23 20:28:52 +03:00
parent 1c4cfb71c0
commit 9e7a202f42
3 changed files with 86 additions and 2 deletions
@@ -0,0 +1,31 @@
+using GmRelay.Bot.Infrastructure.Logging;
+
+namespace GmRelay.Bot.Tests.Infrastructure.Logging;
+
+public sealed class SecretRedactorTests
+{
+    [Fact]
+    public void RedactConnectionString_ShouldMaskDatabasePassword()
+    {
+        var result = SecretRedactor.RedactConnectionString(
+            "Host=localhost;Port=5432;Database=gmrelay;Username=gmrelay;Password=super-secret");
+
+        Assert.Contains("Password=***", result);
+        Assert.DoesNotContain("super-secret", result);
+        Assert.Contains("Host=localhost", result);
+    }
+
+    [Fact]
+    public void RedactText_ShouldMaskKnownSecretKeys()
+    {
+        var result = SecretRedactor.RedactText(
+            "Password=super-secret Token=telegram-token apiKey=service-key");
+
+        Assert.DoesNotContain("super-secret", result);
+        Assert.DoesNotContain("telegram-token", result);
+        Assert.DoesNotContain("service-key", result);
+        Assert.Contains("Password=***", result);
+        Assert.Contains("Token=***", result);
+        Assert.Contains("apiKey=***", result);
+    }
+}