post inicial

internal/audit/audit_test.go

@@ -0,0 +1,43 @@
+package audit
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestLoggerRedactsSecrets(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "agent.log")
+	var console bytes.Buffer
+	l, err := New(&console, path, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	l.AddSecret("sk-supersecretvalue123", "sk-sup...123")
+	l.Infof("connecting with key sk-supersecretvalue123")
+	l.Warnf("warn sk-supersecretvalue123")
+	l.Action("task", "cli", "command", "curl -H 'Bearer sk-supersecretvalue123'")
+	l.Debugf("hidden debug")
+	l.Close()
+
+	data, _ := os.ReadFile(path)
+	all := string(data) + console.String()
+	if strings.Contains(all, "sk-supersecretvalue123") {
+		t.Fatalf("secret leaked:\n%s", all)
+	}
+	if !strings.Contains(string(data), "sk-sup...123") || !strings.Contains(string(data), "ACTION task=\"cli\"") {
+		t.Errorf("log content:\n%s", data)
+	}
+	if strings.Contains(all, "hidden debug") {
+		t.Error("DEBUG must be hidden without --verbose")
+	}
+	if strings.Contains(console.String(), "connecting") {
+		t.Error("INFO must not reach console without --verbose")
+	}
+	st, _ := os.Stat(path)
+	if st.Mode().Perm() != 0o600 {
+		t.Errorf("perm = %o", st.Mode().Perm())
+	}
+}