ssh_cli/
masking.rs

1// SPDX-License-Identifier: MIT OR Apache-2.0
2//! Masking of sensitive values (passwords, tokens) — agent-safe.
3//!
4//! Rule (GAP-SSH-SEC-002): **always** returns `"***"`, without exposing prefix/suffix.
5
6/// Fixed placeholder for any sensitive value.
7pub const FIXED_MASK: &str = "***";
8
9/// Masks a sensitive value without leaking useful characters.
10///
11/// # Examples
12///
13/// ```
14/// use ssh_cli::masking::mask;
15///
16/// assert_eq!(mask("curto"), "***");
17/// assert_eq!(mask("password-secreta-muito-longa-aqui-123456"), "***");
18/// ```
19#[must_use]
20pub fn mask(_valor: &str) -> String {
21    FIXED_MASK.to_string()
22}
23
24#[cfg(test)]
25mod tests {
26    use super::*;
27
28    #[test]
29    fn empty_value_returns_triple_asterisk() {
30        assert_eq!(mask(""), "***");
31    }
32
33    #[test]
34    fn short_value_returns_triple_asterisk() {
35        assert_eq!(mask("abc"), "***");
36    }
37
38    #[test]
39    fn long_value_never_exposes_prefix_or_suffix() {
40        let password = "senha-secreta-muito-longa-aqui-123456";
41        assert_eq!(mask(password), "***");
42        assert!(!mask(password).contains("senha"));
43        assert!(!mask(password).contains("1234"));
44    }
45
46    #[test]
47    fn unicode_value_does_not_crash() {
48        let emojis = "🔒🔑🛡🔐✨🎉💎⚡🌟🔥🎨🚀🌈🍀🎯🎪🎭🎬🎮🎲";
49        assert_eq!(mask(emojis), "***");
50    }
51}
ssh_cli/masking.rs

ssh_cli/
masking.rs
