tinycortex 0.1.1

Rust core for the TinyCortex memory system
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96

use super::*;

#[test]
fn passthrough_for_safe_string() {
    let input = "rate_limited: provider returned 429, retry in 30s";
    assert_eq!(scrub_for_log(input), input);
}

#[test]
fn masks_bearer_token() {
    let s = scrub_for_log("Authorization: Bearer abc123.def-456_xyz");
    assert!(s.contains("Bearer ***"), "got {s:?}");
    assert!(!s.contains("abc123"));
}

#[test]
fn masks_openai_key() {
    let s = scrub_for_log("upstream returned 401: invalid sk-abcDEF1234567890ZZZZ key");
    assert!(s.contains("sk-***"));
    assert!(!s.contains("sk-abcDEF1234567890ZZZZ"));
}

#[test]
fn masks_github_token_variants() {
    for raw in [
        "ghp_abcdefghij1234567890ABCD",
        "ghs_abcdefghij1234567890ABCD",
        "gho_abcdefghij1234567890ABCD",
    ] {
        let s = scrub_for_log(&format!("error: token {raw} rejected"));
        assert!(s.contains("***"), "input={raw} out={s}");
        assert!(!s.contains(raw), "input={raw} out={s}");
    }
}

#[test]
fn masks_slack_token() {
    let s = scrub_for_log("posting to slack failed: xoxb-1234567890-abcdEFG");
    assert!(s.contains("xox-***"));
    assert!(!s.contains("xoxb-1234567890"));
}

#[test]
fn masks_generic_secret_assignments() {
    let inputs = [
        ("api_key=hunter2 trailing", "api_key=***"),
        ("password: hunter2", "password=***"),
        ("Token = hunter2,more", "Token=***"),
        ("apiKey=\"hunter2\"", "apiKey=***"),
    ];
    for (raw, expect) in inputs {
        let s = scrub_for_log(raw);
        assert!(s.contains(expect), "input={raw:?} out={s:?}");
        assert!(!s.contains("hunter2"), "input={raw:?} out={s:?}");
    }
}

#[test]
fn strips_url_userinfo() {
    let s = scrub_for_log("connect failed https://alice:s3cret@db.internal/x");
    assert!(s.contains("https://***@db.internal/x"), "got {s:?}");
    assert!(!s.contains("alice"));
    assert!(!s.contains("s3cret"));
}

#[test]
fn masks_email() {
    let s = scrub_for_log("user alice@example.com triggered job");
    assert!(s.contains("***@***"), "got {s:?}");
    assert!(!s.contains("alice"));
    assert!(!s.contains("example.com"));
}

#[test]
fn truncates_oversized_input() {
    let big = "x".repeat(MAX_LEN * 2);
    let s = scrub_for_log(&big);
    assert!(s.len() < big.len());
    assert!(s.contains("(truncated,"));
}

#[test]
fn truncate_handles_multibyte_boundary() {
    let mut big = "a".repeat(MAX_LEN - 1);
    big.push('é');
    big.push_str(&"b".repeat(64));
    let s = scrub_for_log(&big);
    assert!(s.contains("(truncated,"));
}

#[test]
fn idempotent_on_already_scrubbed_string() {
    let once = scrub_for_log("Bearer abcdef api_key=hunter2");
    let twice = scrub_for_log(&once);
    assert_eq!(once, twice);
}