archetech / archon / 30766329840

94%

push

github

test(mcp-server): cover the secret redactor (#828)

redact.ts had no dedicated test file — it was exercised only incidentally,
through the plain-string path, leaving 65.2% branch coverage on the code
that decides whether a secret reaches a log. 24 tests take it to 95.7%
branches, 96.4% lines.

Two choices specific to testing a redactor:

- Every assertion checks the secret is ABSENT from the output, not merely
  that "<redacted>" appears. A redactor that emits the placeholder while
  still leaking the value elsewhere in the string would pass a naive
  toContain check.
- The provider-host matching is tested for bypass, not just for function:
  TOKEN_PATH_HOSTS anchors on `(^|\.)alchemy\.com$`, so
  https://alchemy.com.evil.test/v2/KEY must NOT be treated as a provider
  host. It isn't — the anchoring is correct — but nothing asserted it.

Covered: basic-auth credentials with username-only, password-only and
both; all seven secret query parameters, case-insensitively; provider API
keys carried in the URL path (alchemy/infura/quicknode, bare and
subdomain); quoted, unquoted and multi-word passphrases including where
the unquoted match terminates; Error, plain object, null, undefined,
number, boolean and empty-string inputs; and errorMessage's three shapes,
including a non-string `error` property falling through to `message`.

The one remaining branch is the `?? ['/']` fallback at redact.ts:30,
which the outer regex makes unreachable — the replace callback only fires
on a match of /\/v\d+\/[^/?#]+/, so the inner /\/v\d+\//  match cannot
fail.

Repo branch coverage 84.44% -> 84.66%.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

3528 of 4060 branches covered (86.9%)

Branch coverage included in aggregate %.

8165 of 8511 relevant lines covered (95.93%)

673.88 hits per line