feat: compute derived secrets from test case variables

Updated the processSecrets function to compute derived secrets using effective variables from both the test suite and the test case. Added a new test to verify that secrets are correctly derived from test case-level variables, ensuring sensitive information is properly redacted in the output.

Signed-off-by: Ivan Velasco <ivan.velasco@socotra.com>

Author: ivan-velasco

process_testcase.go

@@ -172,7 +172,17 @@ func (v *Venom) processSecrets(ctx context.Context, ts *TestSuite, tc *TestCase)
 	if tc != nil {
 		collect(tc.Vars)
 	}
-	computedSecrets = appendDerivedSecrets(computedSecrets, seen, ts.Vars, ts.Secrets)
+
+	// Derived secrets (e.g. base64 basic-auth tokens) must be computed from the
+	// effective vars, which may only define the secret at the test case level.
+	derivedVars := ts.Vars.Clone()
+	if derivedVars == nil {
+		derivedVars = H{}
+	}
+	if tc != nil {
+		derivedVars.AddAll(tc.Vars)
+	}
+	computedSecrets = appendDerivedSecrets(computedSecrets, seen, derivedVars, ts.Secrets)
 	return context.WithValue(ctx, ContextKey("secrets"), computedSecrets)
 }
 

venom_output_test.go

@@ -103,6 +103,30 @@ func TestAppendDerivedSecretsBasicAuth(t *testing.T) {
 	assert.Equal(t, "__hidden__", HideSensitive(ctx, token))
 }
 
+func TestAppendDerivedSecretsFromTestCaseVars(t *testing.T) {
+	v := New()
+	ts := TestSuite{
+		Secrets: []string{"basic_auth_password"},
+		Vars:    H{},
+		TestCases: []TestCase{
+			{
+				TestCaseInput: TestCaseInput{
+					Vars: H{
+						"basic_auth_user":     "testuser",
+						"basic_auth_password": "my_secret",
+					},
+				},
+			},
+		},
+	}
+	ctx := v.processSecrets(context.Background(), &ts, &ts.TestCases[0])
+
+	token := base64.StdEncoding.EncodeToString([]byte("testuser:my_secret"))
+	assert.Equal(t, "__hidden__", HideSensitive(ctx, token))
+	assert.Equal(t, "__hidden__", HideSensitive(ctx, base64.StdEncoding.EncodeToString([]byte("my_secret"))))
+	assert.NotContains(t, HideSensitive(ctx, "Authorization: Basic "+token), token)
+}
+
 func TestHideSensitiveBasicAuthHeaderInCleanupContext(t *testing.T) {
 	v := New()
 	ts := TestSuite{