keyhog 0.5.40

keyhog: detects leaked credentials in source trees, git history, and cloud storage
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112

//! e2e test for `keyhog hook install` and `keyhog hook list`.
//!
//! The hook subcommand manages git pre-commit integrations. This test
//! verifies that `hook install` writes a valid pre-commit hook and
//! `hook list` shows installed hooks.

use std::path::PathBuf;
use std::process::Command;
use tempfile::TempDir;

fn binary() -> PathBuf {
    PathBuf::from(env!("CARGO_BIN_EXE_keyhog"))
}

/// `keyhog hook list` returns exit 0 with a list of available/installed hooks.
/// The list is human-readable text, not JSON, and should mention at least
/// one standard hook (e.g., `pre-commit`).
#[test]
fn hook_list_returns_exit_zero_and_mentions_precommit() {
    let output = Command::new(binary())
        .arg("hook")
        .arg("list")
        .output()
        .expect("spawn keyhog hook list");

    assert_eq!(
        output.status.code(),
        Some(0),
        "keyhog hook list should exit 0; stderr={}",
        String::from_utf8_lossy(&output.stderr)
    );

    let stdout = String::from_utf8_lossy(&output.stdout);
    assert!(
        stdout.to_lowercase().contains("pre-commit") || stdout.contains("hooks"),
        "hook list should mention available hooks; got: {stdout}"
    );
}

/// `keyhog hook install` in a git repo creates a pre-commit hook file.
/// The hook script must be executable and contain a reference to keyhog.
#[test]
fn hook_install_creates_executable_pre_commit_hook() {
    let dir = TempDir::new().expect("create tempdir");
    let git_dir = dir.path().join(".git");
    std::fs::create_dir_all(&git_dir).expect("create .git");
    let hooks_dir = git_dir.join("hooks");
    std::fs::create_dir_all(&hooks_dir).expect("create hooks dir");

    let output = Command::new(binary())
        .arg("hook")
        .arg("install")
        .arg("--path")
        .arg(dir.path())
        .output()
        .expect("spawn keyhog hook install");

    let exit_code = output.status.code();
    let stderr = String::from_utf8_lossy(&output.stderr);

    assert!(
        exit_code == Some(0) || exit_code == Some(1),
        "hook install should exit 0 (success) or 1 (already installed); \
         got {exit_code:?}, stderr: {stderr}"
    );

    let hook_path = hooks_dir.join("pre-commit");
    let hook_exists = hook_path.exists();
    assert!(
        hook_exists,
        "hook install must create .git/hooks/pre-commit; path: {hook_path:?}"
    );

    let hook_content = std::fs::read_to_string(&hook_path).expect("read hook file");
    assert!(
        hook_content.contains("keyhog") || hook_content.contains("scan"),
        "pre-commit hook must reference keyhog; got: {hook_content}"
    );
}

/// `keyhog hook install --hook=pre-push` installs a pre-push hook instead.
/// This test verifies that the --hook flag routes to the correct hook file.
#[test]
fn hook_install_with_hook_flag_respects_hook_type() {
    let dir = TempDir::new().expect("create tempdir");
    let git_dir = dir.path().join(".git");
    std::fs::create_dir_all(&git_dir).expect("create .git");
    let hooks_dir = git_dir.join("hooks");
    std::fs::create_dir_all(&hooks_dir).expect("create hooks dir");

    let output = Command::new(binary())
        .arg("hook")
        .arg("install")
        .arg("--hook=pre-push")
        .arg("--path")
        .arg(dir.path())
        .output()
        .expect("spawn keyhog hook install --hook=pre-push");

    let exit_code = output.status.code();
    assert!(
        exit_code == Some(0) || exit_code == Some(1),
        "hook install --hook=pre-push should succeed; got {exit_code:?}"
    );

    let pre_push_path = hooks_dir.join("pre-push");
    let pre_push_exists = pre_push_path.exists();
    assert!(
        pre_push_exists,
        "hook install --hook=pre-push must create .git/hooks/pre-push; path: {pre_push_path:?}"
    );
}