test(fixtures): capture redacted SimAdmin responses

2026-07-16 06:35:28 +08:00
parent 9dffadbec2
commit c7da857aff
87 changed files with 9673 additions and 0 deletions
@@ -0,0 +1,82 @@
+const SECRET_KEY = /(?:password|passwd|credential|api[_-]?key|access[_-]?(?:key|token|secret|id)|device[_-]?key|private[_-]?key|pin|puk|username|(?:^|[_-])user(?:$|[_-])|account|serial|revision|(?:^|[_-])path(?:$|[_-])|template|token|secret|cookie|authorization|content|body|confirmation[_-]?code)/i;
+const STRUCTURED_KEY = /^(?:config)$/i;
+const LOCATION_KEY = /^(?:lat(?:itude)?|lon(?:gitude)?|cell_?id|cid|lac|tac|pci|e?nb|gnb)$/i;
+const FINGERPRINT_KEY = /^(?:uptime|traffic|temperature|.*(?:rx|tx)[_-]?(?:bytes|packets)|.*percent|(?:created|updated|captured)?_?at|timestamp|time)$/i;
+const SAFE_BOOLEAN_KEY = /(?:phone_number|sms_center)_is_manual$/i;
+const PHONE_KEY = /(?:phone|msisdn|recipient|number|smsc|sms_center)/i;
+const IDENTIFIER_KEY = /(?:iccid|imsi|imei|eid|matching_id)/i;
+const ADDRESS_KEY = /(?:ssid|bssid|mac|(?:^|_)(?:ip|address)(?:_|$)|hostname|host|url|webhook)/i;
+
+export function typedRedact(value:any):any {
+ if(Array.isArray(value)) return value.map(typedRedact);
+ if(value && typeof value==='object') return Object.fromEntries(Object.entries(value).map(([k,v])=>[k,typedRedact(v)]));
+ if(typeof value==='string') return '[REDACTED]';
+ if(typeof value==='number') return 0;
+ if(typeof value==='boolean') return false;
+ return value;
+}
+
+function looksHighEntropy(s:string){
+ if(s.length<16 || /\s/.test(s)) return false;
+ const classes=[/[a-z]/,/[A-Z]/,/\d/,/[^A-Za-z0-9]/].filter(r=>r.test(s)).length;
+ return classes>=3 || (classes>=2 && new Set(s).size>=12);
+}
+function unsafeString(s:string){
+ return /https?:\/\//i.test(s) || /(?:^|\s|["'=])(?:[a-z0-9-]+\.)+[a-z]{2,}(?::\d+)?(?:\/\S*)?/i.test(s) ||
+  /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i.test(s) || /(?:[0-9a-f]{2}:){5}[0-9a-f]{2}/i.test(s) ||
+  /(?:^|[^\w])(?:[0-9a-f]{0,4}:){2,}[0-9a-f:%]+(?:$|[^\w])/i.test(s) || /\b(?:\d{1,3}\.){3}\d{1,3}\b/.test(s) ||
+  /(?:^|\D)\+?\d(?:[ ()-]*\d){7,}(?:$|\D)/.test(s) || /(?:\d[ -]){6,}\d/.test(s) ||
+  /(?:^|\s)(?:\/Users\/|\/home\/|\/var\/|\/etc\/|[A-Za-z]:\\)\S+/i.test(s) ||
+  /\b(?:token|user(?:name)?|account|path|url|host)\s*[=:]\s*\S+/i.test(s) || /\b(?:AKIA|ASIA)[A-Z0-9]{12,}\b/.test(s) || looksHighEntropy(s);
+}
+
+class Context {
+ value(value:any,key='',force=false):any {
+  if(SAFE_BOOLEAN_KEY.test(key) && typeof value==='boolean') return value;
+  if(SECRET_KEY.test(key) || LOCATION_KEY.test(key) || FINGERPRINT_KEY.test(key)) return typedRedact(value);
+  if(STRUCTURED_KEY.test(key)) force=true;
+  if(PHONE_KEY.test(key)||IDENTIFIER_KEY.test(key)||ADDRESS_KEY.test(key)) return typedRedact(value);
+  if(Array.isArray(value)) return value.map(v=>this.value(v,'',force));
+  if(value && typeof value==='object') return Object.fromEntries(Object.entries(value).map(([k,v])=>[k,this.value(v,k,force)]));
+  if(force) return typedRedact(value);
+  if(typeof value==='string'){
+   const t=value.trim();
+   if((t.startsWith('{')&&t.endsWith('}'))||(t.startsWith('[')&&t.endsWith(']'))){try{return JSON.stringify(this.value(JSON.parse(value)));}catch{}}
+   return unsafeString(value)?'[REDACTED]':value;
+  }
+  if(typeof value==='number' && Number.isInteger(value) && Math.abs(value)>=100_000_000) return 0;
+  return value;
+ }
+}
+
+export function parseResponseSensitivePath(path:string):string[] {
+ if(typeof path!=='string'||!path.startsWith('$.response')) throw new Error('unsupported response sensitive path');
+ const rest=path.slice('$.response'.length);
+ if(!rest) return [];
+ if(!/^(?:\.[A-Za-z0-9_-]+|\[\*\])+$/.test(rest)) throw new Error('unsupported response sensitive path');
+ return [...rest.matchAll(/\.([A-Za-z0-9_-]+)|\[\*\]/g)].map(m=>m[1]||'*');
+}
+export function applySensitivePath(node:any,parts:string[],index=0):number {
+ if(index===parts.length) return 0;
+ const part=parts[index];
+ if(part==='*'){
+  if(!Array.isArray(node)) return 0;
+  if(index===parts.length-1){for(let i=0;i<node.length;i++)node[i]=typedRedact(node[i]);return node.length;}
+  return node.reduce((n,item)=>n+applySensitivePath(item,parts,index+1),0);
+ }
+ if(!node||typeof node!=='object'||!(part in node)) return 0;
+ if(index===parts.length-1){node[part]=typedRedact(node[part]);return 1;}
+ return applySensitivePath(node[part],parts,index+1);
+}
+export function redactOperationPayload<T>(value:T,operation:any):T {
+ const clone=structuredClone(value);
+ for(const field of operation?.sensitiveFields||[]){
+  if(field?.direction!=='response') continue;
+  const parts=parseResponseSensitivePath(field.path);
+  // The decoded HTTP body corresponds to $.response; parts are body-relative
+  // (normally beginning with `data`), so do not add another response wrapper.
+  applySensitivePath(clone,parts);
+ }
+ return new Context().value(clone) as T;
+}
+export function redact<T>(value:T):T { return new Context().value(value) as T; }