mask_test.go

package dyfields

import (
	"encoding/json"
	"testing"
)

// A mask exists for one job: keeping a value that must be stored out of the
// logs. So the tests that matter are the ones proving it fires where it should,
// fires nowhere else, never publishes the value it was asked to hide, and
// cannot be declared where it would silently do nothing.

func maskSchema(t *testing.T) *Compiled {
	t.Helper()
	c, err := Load([]byte(`{
	  "schema_version": 1,
	  "groups": [{
	    "key": "customer",
	    "label": "Customer",
	    "fields": [
	      {"name": "name", "type": "string", "label": "Name"},
	      {"name": "email", "type": "string", "format": "email", "label": "Email", "mask": {"keep_tail": 12}},
	      {"name": "national_id", "type": "string", "label": "ID", "mask": {"keep_tail": 4}},
	      {"name": "note", "type": "string", "label": "Note", "mask": "all"},
	      {"name": "balance", "type": "decimal", "label": "Balance", "mask": {"keep_tail": 4}},
	      {"name": "contacts", "type": "object_list", "label": "Contacts", "fields": [
	        {"name": "label", "type": "string", "label": "Label"},
	        {"name": "phone", "type": "string", "label": "Phone", "mask": {"keep_tail": 4}}
	      ]}
	    ]
	  }]
	}`))
	if err != nil {
		t.Fatalf("schema does not compile: %v", err)
	}
	return c
}

func maskDoc() ValueDocument {
	return ValueDocument{
		Values: map[string]any{
			"name":        "Wu Mei-ling",
			"email":       "mei.ling@example.com",
			"national_id": "A123456789",
			"note":        "vip",
			"balance":     "1234.50",
			"contacts": []any{
				map[string]any{"$id": "c1", "label": "mobile", "phone": "0912345678"},
				map[string]any{"$id": "c2", "label": "home", "phone": "0223"},
			},
		},
		Secrets: map[string]string{},
	}
}

func TestMaskAppliesOnlyToRedact(t *testing.T) {
	c := maskSchema(t)
	doc := maskDoc()

	// What gets persisted must keep the real values; a mask that reached
	// Validate would quietly destroy the user's data on every round trip.
	out, errs := c.Validate(doc)
	if errs.Len() != 0 {
		t.Fatalf("unexpected errors: %v", errs)
	}
	if got := out.Values["national_id"]; got != "A123456789" {
		t.Errorf("Validate masked a value it must not touch: %v", got)
	}

	applied, errs := c.Apply(doc, Patch{Values: map[string]any{"note": "still vip"}})
	if errs.Len() != 0 {
		t.Fatalf("unexpected errors: %v", errs)
	}
	if got := applied.Values["email"]; got != "mei.ling@example.com" {
		t.Errorf("Apply masked a value it must not touch: %v", got)
	}
}

func TestRedactMasksDeclaredFields(t *testing.T) {
	c := maskSchema(t)
	pub := c.Redact(maskDoc())

	for _, tc := range []struct{ field, want string }{
		{"name", "Wu Mei-ling"}, // no mask declared, untouched
		{"email", "********@example.com"},
		{"national_id", "******6789"},
		{"note", "***"},
		{"balance", "***4.50"},
	} {
		if got := pub.Values[tc.field]; got != tc.want {
			t.Errorf("%s = %v, want %v", tc.field, got, tc.want)
		}
	}

	// A mask on a field inside an object_list has to fire for every entry, or
	// the one place secrets and PII actually accumulate stays in the clear.
	rows, _ := pub.Values["contacts"].([]any)
	if len(rows) != 2 {
		t.Fatalf("contacts = %v", pub.Values["contacts"])
	}
	first, _ := rows[0].(map[string]any)
	if got := first["phone"]; got != "******5678" {
		t.Errorf("contacts[0].phone = %v", got)
	}
	if got := first["label"]; got != "mobile" {
		t.Errorf("contacts[0].label = %v, want it untouched", got)
	}
	// Four characters would leave nothing hidden.
	second, _ := rows[1].(map[string]any)
	if got := second["phone"]; got != "****" {
		t.Errorf("a short value must be replaced outright, got %v", got)
	}
}

func TestRedactDoesNotMutateTheDocument(t *testing.T) {
	c := maskSchema(t)
	doc := maskDoc()
	_ = c.Redact(doc)

	if got := doc.Values["national_id"]; got != "A123456789" {
		t.Errorf("Redact rewrote its argument: %v", got)
	}
	rows, _ := doc.Values["contacts"].([]any)
	first, _ := rows[0].(map[string]any)
	if got := first["phone"]; got != "0912345678" {
		t.Errorf("Redact rewrote a nested value in its argument: %v", got)
	}
}

func TestMaskRendersEachRule(t *testing.T) {
	for _, tc := range []struct {
		name string
		m    *Mask
		in   any
		want string
	}{
		{"the whole value", MaskAll(), "anything at all", "***************"},
		{"a tail", &Mask{KeepTail: 4}, "0912345678", "******5678"},
		{"both ends", &Mask{KeepHead: 3, KeepTail: 3}, "0912345678", "091****678"},
		{"a chosen character", &Mask{KeepTail: 4, Char: "•"}, "0912345678", "••••••5678"},
		{"a fixed width hides the length", &Mask{KeepTail: 4, Width: 6}, "0912345678901234", "******1234"},
		{"a fixed width with no keeps", &Mask{Width: 8}, "x", "********"},
		// The one failure a mask must not have is passing its input through.
		{"a value exactly as long as the rule keeps", &Mask{KeepTail: 4}, "6789", "****"},
		{"a value shorter than the rule keeps", &Mask{KeepHead: 3, KeepTail: 3}, "abcd", "****"},
		{"an empty value", &Mask{KeepTail: 4}, "", ""},
		// A number reaches Redact as json.Number and must mask as it was
		// written, not as Go's default formatting of a float.
		{"a number", &Mask{KeepTail: 4}, json.Number("102938"), "**2938"},
		{"a bool", &Mask{KeepTail: 4}, true, "****"},
		{"characters, not bytes", &Mask{KeepTail: 4}, "王小明的祕密", "**明的祕密"},
	} {
		t.Run(tc.name, func(t *testing.T) {
			if got := tc.m.Apply(tc.in); got != tc.want {
				t.Errorf("Apply(%v) = %q, want %q", tc.in, got, tc.want)
			}
		})
	}
}

func TestMaskIsRejectedWhereItCouldNotFire(t *testing.T) {
	for _, tc := range []struct{ name, field string }{
		{"on a secret", `{"name":"a","type":"secret","label":"A","mask":"all"}`},
		{"on a container", `{"name":"a","type":"json","label":"A","mask":"all"}`},
		{"on an object_list", `{"name":"a","type":"object_list","label":"A","mask":"all","fields":[{"name":"b","type":"string","label":"B"}]}`},
		{"omit combined with a keep", `{"name":"a","type":"string","label":"A","mask":{"keep_tail":4,"omit":true}}`},
		{"a negative keep", `{"name":"a","type":"string","label":"A","mask":{"keep_tail":-1}}`},
		{"a negative width", `{"name":"a","type":"string","label":"A","mask":{"width":-2}}`},
		{"a char that is not one character", `{"name":"a","type":"string","label":"A","mask":{"keep_tail":4,"char":"xy"}}`},
		{"an unknown shorthand", `{"name":"a","type":"string","label":"A","mask":"sha256"}`},
		{"an unknown key", `{"name":"a","type":"string","label":"A","mask":{"keep_domain":true}}`},
	} {
		t.Run(tc.name, func(t *testing.T) {
			errs := ValidateSchema([]byte(`{"schema_version":1,"groups":[{"key":"g","label":"G","fields":[` + tc.field + `]}]}`))
			if len(errs) == 0 {
				t.Fatalf("expected a complaint, got none")
			}
		})
	}
}

// A typo in a mask must not become a weaker mask than the one that was written
// down, so an unknown key is a parse error rather than a default.
func TestMaskRejectsWhatItCannotRead(t *testing.T) {
	for _, in := range []string{`"sha256"`, `{"keep_domain":true}`, `{"keep_tail":"4"}`, `7`} {
		var m Mask
		if err := json.Unmarshal([]byte(in), &m); err == nil {
			t.Errorf("%s parsed as %+v, want an error", in, m)
		}
	}
}

func TestMaskSurvivesAWriteOutAndReadBack(t *testing.T) {
	for _, in := range []string{
		`"all"`, `"omit"`, `{"keep_tail":4}`, `{"keep_head":3,"keep_tail":3}`,
		`{"keep_tail":4,"char":"•"}`, `{"keep_tail":4,"width":6}`,
	} {
		t.Run(in, func(t *testing.T) {
			var m Mask
			if err := json.Unmarshal([]byte(in), &m); err != nil {
				t.Fatalf("%s: %v", in, err)
			}
			out, err := json.Marshal(m)
			if err != nil {
				t.Fatal(err)
			}
			var again Mask
			if err := json.Unmarshal(out, &again); err != nil {
				t.Fatalf("what Marshal wrote will not parse: %s: %v", out, err)
			}
			if again != m {
				t.Errorf("round trip wrote %s, which reads back as %+v, want %+v", out, again, m)
			}
		})
	}

	// And the same through a whole schema, which is what actually gets stored.
	c := maskSchema(t)
	data, err := json.Marshal(c.Schema())
	if err != nil {
		t.Fatal(err)
	}
	again, err := Parse(data)
	if err != nil {
		t.Fatalf("a schema this library wrote will not parse: %v", err)
	}
	got := again.Groups[0].Fields[2].Mask
	if got == nil || got.KeepTail != 4 {
		t.Errorf("mask was lost in the round trip: %+v", got)
	}
}

// omit is the other half of "hide it on the way out": the key is gone from the
// redacted document rather than present with a mask over it.
func TestMaskOmitRemovesTheKey(t *testing.T) {
	c, err := Load([]byte(`{
	  "schema_version": 1,
	  "groups": [{
	    "key": "customer",
	    "label": "Customer",
	    "fields": [
	      {"name": "name", "type": "string", "label": "Name"},
	      {"name": "internal_score", "type": "integer", "label": "Score", "mask": "omit"}
	    ]
	  }]
	}`))
	if err != nil {
		t.Fatalf("schema does not compile: %v", err)
	}
	doc := ValueDocument{
		Values:  map[string]any{"name": "Wu Mei-ling", "internal_score": json.Number("87")},
		Secrets: map[string]string{},
	}

	safe := c.Redact(doc)
	if _, ok := safe.Values["internal_score"]; ok {
		t.Fatalf("omit left the key behind: %v", safe.Values)
	}
	if safe.Values["name"] != "Wu Mei-ling" {
		t.Fatalf("omit touched a field it does not own: %v", safe.Values)
	}
	if _, ok := doc.Values["internal_score"]; !ok {
		t.Fatalf("Redact mutated the caller's document")
	}
}

// The rule that replaced the write-back guard: a mask is an ordinary string to
// everything downstream, so nothing stops it from being stored -- which is why
// the client must send only what it changed. Diff is what makes that true.
func TestDiffKeepsAMaskFromBeingWrittenBack(t *testing.T) {
	c := maskSchema(t)
	stored, errs := c.Validate(maskDoc())
	if len(errs) != 0 {
		t.Fatalf("fixture does not validate: %v", errs)
	}

	// What a form is handed, and what it holds after one edit.
	loaded := ValueDocument{Values: c.Redact(stored).Values, Secrets: map[string]string{}}
	edited := deepCopyDoc(loaded)
	edited.Values["name"] = "Wu Mei-ling (updated)"

	patch := c.Diff(loaded, edited)
	if _, ok := patch.Values["national_id"]; ok {
		t.Fatalf("the patch carries a value the user never touched: %v", patch.Values)
	}

	got, errs := c.Apply(stored, patch)
	if len(errs) != 0 {
		t.Fatalf("unexpected errors: %v", errs)
	}
	if got.Values["national_id"] != "A123456789" {
		t.Fatalf("the mask overwrote the stored value: %v", got.Values["national_id"])
	}
	if got.Values["email"] != "mei.ling@example.com" {
		t.Fatalf("the mask overwrote the stored value: %v", got.Values["email"])
	}
	if got.Values["name"] != "Wu Mei-ling (updated)" {
		t.Fatalf("the real edit was lost: %v", got.Values["name"])
	}
}

func deepCopyDoc(d ValueDocument) ValueDocument {
	out := ValueDocument{Values: cloneMap(d.Values), Secrets: map[string]string{}}
	for k, v := range d.Secrets {
		out.Secrets[k] = v
	}
	return out
}