CosmicClash/server/observability/log_test.go

package observability

import (
	"encoding/json"
	"strings"
	"testing"
	"time"
)

func TestEncodeCorrelatesStagesAndRedactsNestedCredentials(t *testing.T) {
	payload, err := Encode(Event{Event: "assignment_ready", QueueID: "queue-1", ProposalID: "proposal-1", MatchID: "match-1", ServerID: "server-1", Stage: "assignment-ready", OccurredAt: time.Unix(1000, 0), Fields: map[string]any{"auth_ticket": "do-not-log", "nested": map[string]any{"relay_ticket": "also-secret", "attempt": 2}}})
	if err != nil {
		t.Fatal(err)
	}
	var decoded map[string]any
	if err := json.Unmarshal(payload, &decoded); err != nil {
		t.Fatal(err)
	}
	for _, key := range []string{"queue_id", "proposal_id", "match_id", "server_id", "stage"} {
		if decoded[key] == nil {
			t.Fatalf("missing correlation field %q: %s", key, payload)
		}
	}
	if decoded["auth_ticket"] != "[REDACTED]" || decoded["nested"].(map[string]any)["relay_ticket"] != "[REDACTED]" {
		t.Fatalf("credential not redacted: %s", payload)
	}
}

func TestEncodeRejectsUnnamedEvents(t *testing.T) {
	if _, err := Encode(Event{}); err == nil {
		t.Fatal("unnamed event accepted")
	}
}

func TestEncodeRedactsCredentialLookingValuesUnderUnknownKeys(t *testing.T) {
	payload, err := Encode(Event{Event: "test", Fields: map[string]any{
		"unexpected": "workload-secret-value-12345678901234567890",
		"nested":     map[string]string{"opaque": "Bearer should-not-appear"},
		"items":      []string{"eyJhbGciOiJIUzI1NiJ9.payload-value.signature-value"},
	}})
	if err != nil {
		t.Fatal(err)
	}
	text := string(payload)
	for _, secret := range []string{"workload-secret-value", "Bearer should-not-appear", "eyJhbGciOiJIUzI1NiJ9"} {
		if strings.Contains(text, secret) {
			t.Fatalf("credential leaked under unknown key: %s", payload)
		}
	}
}