tryaudex_core/

leakdetect.rs

use regex::Regex;
use std::sync::LazyLock;

/// Result of scanning a line for credential leaks.
#[derive(Debug, Clone)]
pub struct LeakDetection {
    pub pattern_name: String,
    pub matched_text: String,
}

static PATTERNS: LazyLock<Vec<(&str, Regex)>> = LazyLock::new(|| {
    vec![
        // AWS Access Key ID (starts with AKIA, ASIA, AIDA, AROA)
        (
            "AWS Access Key ID",
            Regex::new(r"(?:^|[^A-Z0-9])(A[KS]IA[0-9A-Z]{16})(?:[^A-Z0-9]|$)").unwrap(),
        ),
        // AWS Secret Access Key (40 chars, base64-ish)
        (
            "AWS Secret Access Key",
            Regex::new(r"(?:^|[^A-Za-z0-9/+=])([A-Za-z0-9/+=]{40})(?:[^A-Za-z0-9/+=]|$)").unwrap(),
        ),
        // AWS Session Token (starts with FwoGZX or IQoJb3)
        (
            "AWS Session Token",
            Regex::new(r"(?:FwoGZX|IQoJb3)[A-Za-z0-9/+=]{50,}").unwrap(),
        ),
        // GCP OAuth2 access token (ya29.)
        (
            "GCP Access Token",
            Regex::new(r"ya29\.[A-Za-z0-9_-]{50,}").unwrap(),
        ),
        // Azure Bearer Token (eyJ prefix, JWT format)
        (
            "Azure Bearer Token",
            Regex::new(r"eyJ[A-Za-z0-9_-]{20,}\.eyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}")
                .unwrap(),
        ),
        // Generic long base64 secrets (likely tokens, >100 chars)
        (
            "Long Base64 Token",
            Regex::new(r"(?:^|[=:]\s*)[A-Za-z0-9+/]{100,}={0,2}(?:\s|$)").unwrap(),
        ),
    ]
});

/// Scan a single line for credential leaks.
/// Returns a list of detected leaks, or empty if clean.
pub fn scan_line(line: &str) -> Vec<LeakDetection> {
    // Skip lines that are clearly not leaks (common false positive patterns)
    if line.trim().is_empty() || line.starts_with('#') || line.starts_with("//") {
        return Vec::new();
    }

    let mut detections = Vec::new();

    for (name, pattern) in PATTERNS.iter() {
        if let Some(m) = pattern.find(line) {
            let matched = m.as_str();
            // Skip very short matches that are likely false positives
            if matched.len() < 16 {
                continue;
            }
            detections.push(LeakDetection {
                pattern_name: name.to_string(),
                matched_text: redact(matched),
            });
        }
    }

    detections
}

/// Scan multiple lines of output for credential leaks.
pub fn scan_output(output: &str) -> Vec<LeakDetection> {
    output.lines().flat_map(scan_line).collect()
}

/// Redact all detected credential patterns in a string, replacing them
/// with safe placeholders. Use this before writing to audit logs.
pub fn redact_secrets(input: &str) -> String {
    let mut result = input.to_string();
    for (name, pattern) in PATTERNS.iter() {
        // Replace all matches with redacted form
        let mut offset: i64 = 0;
        let matches: Vec<_> = pattern.find_iter(input).collect();
        for m in matches {
            let matched = m.as_str();
            if matched.len() < 16 {
                continue;
            }
            let replacement = format!("[REDACTED:{}:{}]", name, redact(matched));
            let start = (m.start() as i64 + offset) as usize;
            let end = (m.end() as i64 + offset) as usize;
            result.replace_range(start..end, &replacement);
            offset += replacement.len() as i64 - matched.len() as i64;
        }
    }
    result
}

/// Redact a matched credential, showing only first 8 and last 4 chars.
fn redact(s: &str) -> String {
    if s.len() <= 16 {
        format!("{}...", &s[..4])
    } else {
        format!("{}...{}", &s[..8], &s[s.len() - 4..])
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_detect_aws_access_key() {
        let line = "export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE";
        let leaks = scan_line(line);
        assert!(!leaks.is_empty(), "Should detect AWS access key");
        assert!(leaks
            .iter()
            .any(|l| l.pattern_name.contains("AWS Access Key ID")));
    }

    #[test]
    fn test_detect_aws_session_token() {
        let line = "AWS_SESSION_TOKEN=FwoGZXIvYXdzEBYaDHxkJ3lNJAHvLj4mZiLOAd3FuKnNv0lRZx5example";
        let leaks = scan_line(line);
        assert!(!leaks.is_empty(), "Should detect AWS session token");
    }

    #[test]
    fn test_detect_gcp_token() {
        let line =
            "Authorization: Bearer ya29.a0AfH6SMBx1234567890abcdefghijklmnopqrstuvwxyz1234567890";
        let leaks = scan_line(line);
        assert!(!leaks.is_empty(), "Should detect GCP access token");
        assert!(leaks.iter().any(|l| l.pattern_name.contains("GCP")));
    }

    #[test]
    fn test_detect_azure_jwt() {
        let line = "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIn0.Signature1234567890abcdef";
        let leaks = scan_line(line);
        assert!(!leaks.is_empty(), "Should detect Azure/JWT token");
    }

    #[test]
    fn test_clean_output() {
        let line = "Successfully listed 42 objects in s3://my-bucket";
        let leaks = scan_line(line);
        assert!(
            leaks.is_empty(),
            "Normal output should not trigger detection"
        );
    }

    #[test]
    fn test_skip_comments() {
        let line = "# AKIAIOSFODNN7EXAMPLE";
        let leaks = scan_line(line);
        assert!(leaks.is_empty(), "Comments should be skipped");
    }

    #[test]
    fn test_redact() {
        assert_eq!(redact("AKIAIOSFODNN7EXAMPLE"), "AKIAIOSF...MPLE");
        assert_eq!(redact("short"), "shor...");
    }

    #[test]
    fn test_scan_multiline() {
        let output = "line1 ok\nAKIAIOSFODNN7EXAMPLE leaked\nline3 ok";
        let leaks = scan_output(output);
        assert!(!leaks.is_empty());
    }

    #[test]
    fn test_redact_secrets_aws_key() {
        let input = "key=AKIAIOSFODNN7EXAMPLE in output";
        let redacted = redact_secrets(input);
        assert!(!redacted.contains("AKIAIOSFODNN7EXAMPLE"));
        assert!(redacted.contains("[REDACTED:AWS Access Key ID:"));
    }

    #[test]
    fn test_redact_secrets_gcp_token() {
        let input = "token=ya29.a0AfH6SMBx1234567890abcdefghijklmnopqrstuvwxyz1234567890";
        let redacted = redact_secrets(input);
        assert!(!redacted.contains("ya29.a0AfH6SMBx1234567890abcdefghijklmnopqrstuvwxyz1234567890"));
        assert!(redacted.contains("[REDACTED:GCP Access Token:"));
    }

    #[test]
    fn test_redact_secrets_clean_input() {
        let input = "normal log entry with no secrets";
        let redacted = redact_secrets(input);
        assert_eq!(redacted, input);
    }

    #[test]
    fn test_redact_secrets_preserves_structure() {
        let input = r#"{"command":["aws","s3","ls"],"key":"safe-value"}"#;
        let redacted = redact_secrets(input);
        assert_eq!(redacted, input); // No secrets, unchanged
    }
}