keyhog 0.5.73

GPU-accelerated secret scanner for code, Git history, cloud, containers, browser assets, and live credential verification
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

#[allow(dead_code)]
#[path = "../../src/matcher_cache_path.rs"]
mod matcher_cache_path;

use matcher_cache_path::resolve_matcher_cache_path_with_default;

#[test]
fn matcher_cache_path_config_overrides_and_disable() {
    let actual_home = dirs::home_dir().expect("home");
    let cache_home = tempfile::Builder::new()
        .prefix(".keyhog-matcher-cache-test-")
        .tempdir_in(actual_home)
        .expect("secure cache home");
    let home = cache_home.path().to_path_buf();
    let default = resolve_matcher_cache_path_with_default(None, Some(home.clone()))
        .expect("default matcher cache");
    assert_eq!(default, Some(home.join("keyhog-matcher-artifacts")));

    // Unusable automatic defaults soft-fail to disabled.
    assert_eq!(
        resolve_matcher_cache_path_with_default(
            None,
            Some(std::path::PathBuf::from("/var/cache/shared"))
        )
        .expect("unusable default"),
        None
    );

    for off in ["off", "OFF", "0", ""] {
        assert_eq!(
            resolve_matcher_cache_path_with_default(Some(off), None).expect("disable"),
            None
        );
    }

    let explicit = home.join(".cache/keyhog/matcher-artifacts");
    assert_eq!(
        resolve_matcher_cache_path_with_default(Some(explicit.to_str().unwrap()), None)
            .expect("explicit"),
        Some(explicit)
    );
}

#[test]
fn matcher_cache_path_rejects_relative_paths() {
    let relative = resolve_matcher_cache_path_with_default(Some("relative/matcher"), None)
        .expect_err("relative path");
    assert!(
        relative.contains("absolute") && relative.contains("--matcher-cache"),
        "relative rejection must name the flag; got {relative}"
    );
}