psSCA

0.1.0

Tests/Unit/Private/Protect-SCASecret.Tests.ps1

Import-Module (Join-Path $PSScriptRoot '../../../psSCA.psd1') -Force

Describe 'Protect-SCASecret' {
    InModuleScope psSCA {
        It 'redacts hashtable keys matching sensitive patterns' {
            $headers = @{
                Authorization = 'Bearer eyJhbGciOiJIUzI1NiJ9.abc.def'
                Accept        = 'application/json'
            }

            $result = Protect-SCASecret -InputObject $headers

            $result.Authorization | Should -Be '***REDACTED***'
            $result.Accept | Should -Be 'application/json'
        }

        It 'is case-insensitive and matches key substrings' {
            $headers = @{ 'X-Client-Secret' = 'super-secret-value'; 'X-Request-Id' = 'abc123' }

            $result = Protect-SCASecret -InputObject $headers

            $result.'X-Client-Secret' | Should -Be '***REDACTED***'
            $result.'X-Request-Id' | Should -Be 'abc123'
        }

        It 'does not mutate the original hashtable' {
            $headers = @{ Authorization = 'Bearer secret-token' }

            Protect-SCASecret -InputObject $headers | Out-Null

            $headers.Authorization | Should -Be 'Bearer secret-token'
        }

        It 'redacts a Bearer token embedded in a string' {
            $text = 'Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.abc.def'

            $result = Protect-SCASecret -InputObject $text

            $result | Should -Not -Match 'eyJhbGciOiJIUzI1NiJ9'
            $result | Should -Match '\*\*\*REDACTED\*\*\*'
        }

        It 'redacts a JSON access_token field embedded in a string' {
            $json = '{"access_token":"super-secret-value","token_type":"Bearer"}'

            $result = Protect-SCASecret -InputObject $json

            $result | Should -Not -Match 'super-secret-value'
            $result | Should -Match 'token_type'
        }

        It 'passes through a non-string, non-hashtable value unchanged' {
            Protect-SCASecret -InputObject 42 | Should -Be 42
        }

        It 'passes through $null unchanged' {
            Protect-SCASecret -InputObject $null | Should -BeNullOrEmpty
        }
    }
}