UHD_Media_Tool/apps/server/test/logger.test.ts

import { describe, expect, it } from "vitest";
import { redact, redactString } from "../src/logger.ts";
import { memoryLogger } from "./helpers.ts";

describe("日志脱敏", () => {
  it("URL query 中的 passkey/token 被替换", () => {
    expect(redactString("https://pt.example/rss?passkey=abc123&x=1")).toBe(
      "https://pt.example/rss?passkey=[REDACTED]&x=1",
    );
    expect(redactString("/dl?id=1&token=zzz")).toBe("/dl?id=1&token=[REDACTED]");
  });

  it("敏感字段整体替换,数值计数保留", () => {
    expect(redact({ cookie: "a=b", nested: { Authorization: "Bearer x", password: "p" }, inputTokens: 12 })).toEqual({
      cookie: "[REDACTED]",
      nested: { Authorization: "[REDACTED]", password: "[REDACTED]" },
      inputTokens: 12,
    });
  });

  it("logger 输出不含明文", () => {
    const { logger, lines } = memoryLogger();
    logger.info({ url: "https://x/rss?passkey=SECRET1", token: "SECRET2" }, "fetch https://y/?token=SECRET3");
    logger.error({ err: new Error("GET https://x/dl?passkey=SECRET4 failed") }, "boom");
    const out = lines.join("");
    for (const s of ["SECRET1", "SECRET2", "SECRET3", "SECRET4"]) expect(out).not.toContain(s);
  });
});

describe("日志脱敏:child 绑定与 Error 序列化", () => {
  it("child() 绑定的敏感字段被脱敏", () => {
    const { logger, lines } = memoryLogger();
    logger.child({ component: "worker", password: "SECRET5", url: "https://x/?passkey=SECRET6" }).warn("child");
    const out = lines.join("");
    expect(out).not.toContain("SECRET5");
    expect(out).not.toContain("SECRET6");
    const line = JSON.parse(lines.at(-1)!);
    expect(line.component).toBe("worker");
    expect(line.password).toBe("[REDACTED]");
  });

  it("err 按 message/stack 序列化而不是 {},且内容脱敏", () => {
    const { logger, lines } = memoryLogger();
    const err = Object.assign(new Error("GET https://x/dl?passkey=SECRET7 failed", { cause: new Error("inner") }), {
      code: "E_FETCH",
      token: "SECRET8",
    });
    logger.error({ err }, "boom");
    const line = JSON.parse(lines.at(-1)!);
    expect(line.err.type).toBe("Error");
    expect(line.err.message).toBe("GET https://x/dl?passkey=[REDACTED] failed");
    expect(line.err.stack).toContain("Error: GET https://x/dl?passkey=[REDACTED] failed");
    expect(line.err.code).toBe("E_FETCH");
    expect(line.err.token).toBe("[REDACTED]");
    expect(line.err.cause.message).toBe("inner");
    expect(lines.join("")).not.toMatch(/SECRET7|SECRET8/);
  });

  it("redact() 直接处理 Error", () => {
    expect(redact(new Error("x?token=abc"))).toMatchObject({ type: "Error", message: "x?token=[REDACTED]" });
  });
});

// 验收 S2:站点常见凭证参数/键名全部覆盖,键表与 Agent redactForModel 同源(@umt/contracts)
describe("日志脱敏:站点凭证键全集", () => {
  const PARAMS = [
    "passkey",
    "PassKey",
    "pass_key",
    "pass-key",
    "rsskey",
    "torrent_pass",
    "authkey",
    "downhash",
    "c_secure_pass",
    "api_key",
    "apikey",
    "token",
  ];

  it.each(PARAMS)("URL query 参数 %s 被遮住", (name) => {
    const out = redactString(`GET https://pt.example/rss.php?id=7&${name}=SECRETVALUE9&x=1`);
    expect(out).not.toContain("SECRETVALUE9");
    expect(out).toContain(`${name}=[REDACTED]`);
    expect(out).toContain("id=7");
    expect(out).toContain("x=1");
  });

  it("验收报告里的实测串一次性全部遮住", () => {
    const out = redactString("/rss?rsskey=abc1&torrent_pass=dead2&authkey=zz3&downhash=q14&c_secure_pass=cc5");
    for (const s of ["abc1", "dead2", "zz3", "q14", "cc5"]) expect(out).not.toContain(s);
  });

  const KEYS = [
    "passkey",
    "PassKey",
    "pass-key",
    "pass_key",
    "PASSKEY",
    "rsskey",
    "rssKey",
    "torrent_pass",
    "torrentPass",
    "authkey",
    "authKey",
    "downhash",
    "c_secure_pass",
    "x-api-key",
    "X-Api-Key",
    "apiKey",
    "cookie",
    "Cookie",
    "set-cookie",
    "authorization",
    "accessToken",
  ];

  it.each(KEYS)("对象键 %s 在嵌套对象与数组里都整体替换", (key) => {
    const input = { top: { [key]: "SECRETV" }, list: [{ deep: { [key]: "SECRETW" } }], [key]: ["SECRETX"] };
    const out = redact(input) as Record<string, unknown>;
    expect(JSON.stringify(out)).not.toMatch(/SECRET[VWX]/);
    expect((out.top as Record<string, unknown>)[key]).toBe("[REDACTED]");
    expect(out[key]).toBe("[REDACTED]");
  });

  it("cookie / x-api-key 请求头行(字符串里)被遮住", () => {
    const out = redactString("request headers:\ncookie: c_secure_pass=abc; uid=1\nx-api-key: KKKKKKKK\nAccept: */*");
    expect(out).not.toMatch(/abc|KKKKKKKK/);
    expect(out).toContain("Accept: */*");
  });

  it("日志输出里 headers / 数组中的凭证不出现", () => {
    const { logger, lines } = memoryLogger();
    logger.warn(
      {
        req: { headers: { Cookie: "SECRET_A", "X-Api-Key": "SECRET_B", accept: "json" } },
        urls: ["https://x/rss?rsskey=SECRET_C", "https://x/dl?torrent_pass=SECRET_D&downhash=SECRET_E"],
        site: { authKey: "SECRET_F", c_secure_pass: "SECRET_G" },
        usage: { inputTokens: 42 },
      },
      "fetch https://x/?authkey=SECRET_H&c_secure_pass=SECRET_I",
    );
    const out = lines.join("");
    expect(out).not.toMatch(/SECRET_[A-I]/);
    const line = JSON.parse(lines.at(-1)!);
    expect(line.req.headers.accept).toBe("json");
    expect(line.usage.inputTokens).toBe(42);
  });

  it("与 Agent 的 redactForModel 同源:同一输入得到同样的遮挡结果", async () => {
    const { redactString: agentRedact } = await import("@umt/agent");
    const s = "https://x/rss?rsskey=a1&torrent_pass=b2&authkey=c3&downhash=d4&c_secure_pass=e5&passkey=f6";
    expect(redactString(s)).toBe(agentRedact(s));
  });
});