Files
clawhub/scripts/lib/workerLogger.test.ts
Jesse Merhi 2deb1b75e9 Harden worker secret logging (#2784)
* fix: redact scan worker artifact errors

* fix: harden worker secret logging

* fix: keep worker claim failures failing

* fix: scan diagnostics as files

* fix: pin diagnostics scanner image

* fix: narrow worker redaction boundary

* fix: avoid custom worker secret patterns

* fix: centralize worker transport redaction

* fix: redact persisted worker failure secrets

* fix: fail security worker on claim outages

* fix: redact structured diagnostic secret fields

* fix: harden worker failure redaction boundaries

* fix: cover bracketed worker secret values

* test: enforce worker workflow secret references

* fix: redact quoted worker secret values

* fix: redact diagnostic artifact path labels

* test: cover claim failure redaction

* fix: simplify worker redaction boundary

* test: prove worker logger emits structured events
2026-06-25 11:47:39 +10:00

79 lines
2.7 KiB
TypeScript

/* @vitest-environment node */
import { describe, expect, it } from "vitest";
import { createWorkerLogger } from "./workerLogger";
describe("worker logger", () => {
it("emits structured info and error log events", () => {
const lines: string[] = [];
const logger = createWorkerLogger({
name: "worker-logger-test",
destination: { write: (line) => lines.push(line) },
});
logger.info({ event: "worker_test_started", jobId: "job1" }, "started");
logger.error({ event: "worker_test_failed", jobId: "job1" }, "failed");
expect(lines).toHaveLength(2);
const [info, error] = lines.map((line) => JSON.parse(line) as Record<string, unknown>);
expect(info).toMatchObject({
event: "worker_test_started",
jobId: "job1",
level: 30,
msg: "started",
service: "worker-logger-test",
});
expect(error).toMatchObject({
event: "worker_test_failed",
jobId: "job1",
level: 50,
msg: "failed",
service: "worker-logger-test",
});
});
it("redacts configured structured fields in emitted JSON", () => {
const lines: string[] = [];
const logger = createWorkerLogger({
name: "worker-logger-test",
destination: { write: (line) => lines.push(line) },
});
logger.info(
{
artifact: {
downloadUrl: "https://signed.example.invalid/file?token=secret",
path: "SKILL.md",
},
headers: { authorization: "Bearer worker-token-secret" },
rawResult: "raw scanner output with url=https://signed.example.invalid/raw",
publicReason: "Download failed 403 for artifact file SKILL.md",
reason: "raw reason with https://signed.example.invalid/reason",
stderr: "Authorization: Basic abc123",
stdout: "raw stdout transcript",
target: {
files: [
{
path: "package.json",
url: "https://signed.example.invalid/package?X-Amz-Signature=abc",
},
],
},
token: "worker-token-secret",
},
"structured worker event",
);
expect(lines).toHaveLength(1);
const parsed = JSON.parse(lines[0] ?? "") as Record<string, unknown>;
const text = JSON.stringify(parsed);
expect(parsed.msg).toBe("structured worker event");
expect(text).not.toContain("signed.example.invalid");
expect(text).not.toContain("worker-token-secret");
expect(text).not.toContain("raw reason");
expect(text).not.toContain("raw stdout transcript");
expect(text).toContain("Download failed 403 for artifact file SKILL.md");
expect(text).toContain("[redacted-secret]");
expect(parsed.artifact).toMatchObject({ path: "SKILL.md" });
});
});