import { describe, expect, it } from "@effect/vitest"; import {  redactOtlpTraceExport,  redactSpanUrlAttributes,  redactUrlForTelemetry,  redactUrlsInText,} from "./telemetry-url-redaction"; // Synthetic placeholders only — never a real authorization code or state.const CODE = "synthetic-authorization-code";const STATE = "synthetic-csrf-state"; const callbackUrl = `https://app.test/api/oauth/callback?code=${CODE}&state=${STATE}&domain=example.test`; describe("redactSpanUrlAttributes", () => {  it("strips every query value from url.full and url.query", () => {    const attributes: Record<string, unknown> = {      "url.full": callbackUrl,      "url.query": `code=${CODE}&state=${STATE}&domain=example.test`,      "url.path": "/api/oauth/callback",      "http.request.method": "GET",    };     const stripped = redactSpanUrlAttributes(attributes);     expect(stripped).toEqual(["code", "domain", "state"]);    expect(JSON.stringify(attributes)).not.toContain(CODE);    expect(JSON.stringify(attributes)).not.toContain(STATE);    // Route-level visibility is preserved; no query value is.    expect(attributes["url.path"]).toBe("/api/oauth/callback");    expect(attributes["url.full"]).toBe("https://app.test/api/oauth/callback");    expect(attributes["url.query"]).toBe("");  });   it("drops a secret riding under any parameter name — names are never trusted", () => {    // Query-auth placement names are arbitrary strings: a key configured as    // `?owner=…` or `?error=…` is exactly as much a credential as `?key=…`.    // That is why no allowlist of "safe" names can exist.    const attributes: Record<string, unknown> = {      "url.full":        "https://api.test/graphql?owner=synthetic-owner-secret&error=synthetic-error-secret",      "url.query": "owner=synthetic-owner-secret&error=synthetic-error-secret",    };     const stripped = redactSpanUrlAttributes(attributes);     expect(stripped).toEqual(["error", "owner"]);    expect(JSON.stringify(attributes)).not.toContain("synthetic-owner-secret");    expect(JSON.stringify(attributes)).not.toContain("synthetic-error-secret");    expect(attributes["url.full"]).toBe("https://api.test/graphql");  });   it("drops a nested returnTo value wholesale — code, state, and userinfo included", () => {    // The login redirect round-trips the whole OAuth callback URL through    // `returnTo`, so credentials ride inside another parameter's value. The    // value is dropped with every other query value; nothing nested survives.    const returnTo = encodeURIComponent(      `https://canary:synthetic-nested-userinfo-secret@app.test/api/oauth/callback?code=${CODE}&state=${STATE}`,    );    const attributes: Record<string, unknown> = {      "url.full": `https://app.test/login?returnTo=${returnTo}`,      "url.query": `returnTo=${returnTo}`,    };     const stripped = redactSpanUrlAttributes(attributes);     expect(stripped).toEqual(["returnTo"]);    expect(JSON.stringify(attributes)).not.toContain(CODE);    expect(JSON.stringify(attributes)).not.toContain(STATE);    expect(JSON.stringify(attributes)).not.toContain("synthetic-nested-userinfo-secret");    expect(attributes["url.full"]).toBe("https://app.test/login");  });   it("reports a nameless query segment as *, never by its text", () => {    // `?<token>` parses as a parameter NAME — echoing it would leak the token    // through the stripped-keys list.    const attributes: Record<string, unknown> = {      "url.full": "https://api.test/hook?synthetic-bare-token-secret",    };     const stripped = redactSpanUrlAttributes(attributes);     expect(stripped).toEqual(["*"]);    expect(JSON.stringify(attributes)).not.toContain("synthetic-bare-token-secret");    expect(attributes["url.full"]).toBe("https://api.test/hook");  });   it("clears a fragment-borne token from a parseable URL", () => {    const attributes: Record<string, unknown> = {      "url.full": "https://app.test/callback#access_token=synthetic-fragment-token",    };     const stripped = redactSpanUrlAttributes(attributes);     expect(stripped).toEqual(["fragment"]);    expect(JSON.stringify(attributes)).not.toContain("synthetic-fragment-token");    expect(attributes["url.full"]).toBe("https://app.test/callback");  });   it("clears a fragment-borne token from a malformed URL", () => {    const attributes: Record<string, unknown> = {      "url.full": "http://exa mple.test/callback#access_token=synthetic-fragment-token",    };     redactSpanUrlAttributes(attributes);     expect(JSON.stringify(attributes)).not.toContain("synthetic-fragment-token");    expect(attributes["url.full"]).toBe("http://exa mple.test/callback");  });   it("does not treat an @ inside the fragment as userinfo", () => {    const attributes: Record<string, unknown> = {      "url.full": "http://exa mple.test/docs#note@anchor",    };     redactSpanUrlAttributes(attributes);     expect(attributes["url.full"]).toBe("http://exa mple.test/docs");  });   it("strips userinfo from a URL attribute", () => {    const attributes: Record<string, unknown> = {      "url.full": "https://svc:synthetic-basic-password@api.test/graphql",    };     expect(redactSpanUrlAttributes(attributes)).toEqual(["userinfo"]);    expect(attributes["url.full"]).toBe("https://api.test/graphql");    expect(JSON.stringify(attributes)).not.toContain("synthetic-basic-password");  });   it("scrubs a URL embedded in a free-text attribute", () => {    const attributes: Record<string, unknown> = {      "error.message": "request to https://api.test/graphql?key=synthetic-key failed",    };     redactSpanUrlAttributes(attributes);     expect(attributes["error.message"]).toBe("request to https://api.test/graphql failed");  });   it("degrades an unparseable URL attribute instead of passing it through", () => {    const attributes: Record<string, unknown> = {      "url.full": "http://exa mple.test/graphql?key=synthetic-key",    };     expect(redactSpanUrlAttributes(attributes)).toEqual(["key"]);    expect(attributes["url.full"]).toBe("http://exa mple.test/graphql");  });   it("redacts the string elements of an array attribute value in place", () => {    // OTel attributes permit string[] values — an array element carries a    // credential-bearing URL exactly as a scalar does. Non-string elements    // pass through untouched and the array keeps its identity.    const SECRET = "synthetic-array-element-secret";    const urlArray = [`https://canary:${SECRET}@host.test/graphql?key=${SECRET}`, 42];    const attributes: Record<string, unknown> = {      "url.full": urlArray,      "url.query": [`key=${SECRET}`, 7],      "error.notes": [`request to https://api.test/graphql?key=${SECRET} failed`, true],    };     const stripped = redactSpanUrlAttributes(attributes);     expect(stripped).toEqual(["key", "userinfo"]);    expect(JSON.stringify(attributes)).not.toContain(SECRET);    expect(attributes["url.full"]).toBe(urlArray);    expect(attributes["url.full"]).toEqual(["https://host.test/graphql", 42]);    expect(attributes["url.query"]).toEqual(["", 7]);    expect(attributes["error.notes"]).toEqual(["request to https://api.test/graphql failed", true]);  });   it("leaves a query-, fragment-, and userinfo-free URL untouched", () => {    const attributes: Record<string, unknown> = {      "url.full": "https://app.test/api/integrations",      "url.path": "/api/integrations",    };     expect(redactSpanUrlAttributes(attributes)).toEqual([]);    expect(attributes["url.full"]).toBe("https://app.test/api/integrations");  });}); describe("redactUrlForTelemetry", () => {  it("strips query, fragment, and userinfo together", () => {    const result = redactUrlForTelemetry(      "https://svc:synthetic-pass@api.test/x?owner=synthetic-q#access_token=synthetic-f",    );    expect(result.url).toBe("https://api.test/x");    expect(result.stripped).toEqual(["fragment", "owner", "userinfo"]);  });   it("returns a clean URL unchanged", () => {    expect(redactUrlForTelemetry("https://api.test/x")).toEqual({      url: "https://api.test/x",      stripped: [],    });  });}); describe("redactUrlsInText", () => {  it("scrubs userinfo, query values, and fragments from embedded URLs", () => {    const text = `Transport: fetch failed (GET https://u:synthetic-pass@api.test/x?key=synthetic-key#t=synthetic-frag)`;    expect(redactUrlsInText(text)).toBe("Transport: fetch failed (GET https://api.test/x)");  });}); describe("redactOtlpTraceExport", () => {  it("scrubs every channel of a serialized OTLP batch", () => {    const SECRET = "synthetic-otlp-secret";    const payload = {      resourceSpans: [        {          resource: { attributes: [] },          scopeSpans: [            {              scope: { name: "executor-web" },              spans: [                {                  traceId: "0af7651916cd43dd8448eb211c80319c",                  spanId: "b7ad6b7169203331",                  name: "http.client GET",                  attributes: [                    {                      key: "url.full",                      value: {                        stringValue: `https://u:${SECRET}-userinfo@api.test/x?owner=${SECRET}-query#t=${SECRET}-fragment`,                      },                    },                    { key: "url.query", value: { stringValue: `owner=${SECRET}-query` } },                    {                      key: "http.url",                      // Malformed on purpose: the free-text regex alone would                      // not match it, so the key-aware path must.                      value: { stringValue: `http://exa mple.test/x?key=${SECRET}-malformed` },                    },                  ],                  events: [                    {                      name: "exception",                      attributes: [                        {                          key: "exception.message",                          value: {                            stringValue: `GET https://api.test/x?key=${SECRET}-event failed`,                          },                        },                      ],                    },                  ],                  status: {                    code: 2,                    message: `GET https://api.test/x?key=${SECRET}-status failed`,                  },                  links: [                    {                      traceId: "0af7651916cd43dd8448eb211c80319c",                      spanId: "00f067aa0ba902b7",                      attributes: [                        {                          key: "peer.url",                          value: { stringValue: `https://api.test/x?key=${SECRET}-link` },                        },                      ],                    },                  ],                },              ],            },          ],        },      ],    };     const serialized = JSON.stringify(redactOtlpTraceExport(payload));     expect(serialized).not.toContain(SECRET);    // Non-vacuous: identity, route, and structure survive the scrub.    expect(serialized).toContain("0af7651916cd43dd8448eb211c80319c");    expect(serialized).toContain("https://api.test/x");    expect(serialized).toContain("exception");    expect(serialized).toContain("http://exa mple.test/x");  });   it("scrubs the sibling fields of a URL-keyed KeyValue instead of passing them through", () => {    // The URL-aware KeyValue special case must not exempt the REST of that    // object from the walk: a crafted KeyValue can carry URL-bearing text in a    // sibling of `key`/`value.stringValue`, and the browser-traces forwarder    // feeds attacker-shaped JSON straight through this function.    const SECRET = "synthetic-keyvalue-sibling-secret";    const payload = {      resourceSpans: [        {          scopeSpans: [            {              spans: [                {                  attributes: [                    {                      key: "url.full",                      value: {                        stringValue: "https://api.test/x?owner=synthetic-keyvalue-main-secret",                        extraValue: `see https://api.test/x?owner=${SECRET}-inner`,                      },                      note: `retry of https://api.test/x?owner=${SECRET}-sibling`,                    },                  ],                },              ],            },          ],        },      ],    };     const serialized = JSON.stringify(redactOtlpTraceExport(payload));     expect(serialized).not.toContain(SECRET);    expect(serialized).not.toContain("synthetic-keyvalue-main-secret");    // Non-vacuous: the redacted URL survives in every field.    expect(serialized).toContain("https://api.test/x");  });   it("drops content past the nesting bound rather than forwarding it unexamined", () => {    let deep: unknown = "https://api.test/x?key=synthetic-deep-secret";    for (let index = 0; index < 200; index += 1) deep = [deep];    const serialized = JSON.stringify(redactOtlpTraceExport({ resourceSpans: deep }));    expect(serialized).not.toContain("synthetic-deep-secret");  });});