mirror of
https://github.com/headroomlabs-ai/headroom.git
synced 2026-08-27 14:17:10 -04:00
4640587a06
## Description Extracts the pure secret-redaction logic used by opt-in Codex wire-debug capture from `helpers.py` into `headroom.proxy.wire_debug_redaction_policy`. This keeps the debug capture path behavior intact while making the sensitive-key policy directly testable. Closes # ## Type of Change - [ ] Bug fix (non-breaking change that fixes an issue) - [ ] New feature (non-breaking change that adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update - [ ] Performance improvement - [x] Code refactoring (no functional changes) ## Changes Made - Added `wire_debug_redaction_policy.py` for secret-key matching and recursive wire-debug redaction. - Kept existing helper entry points and private compatibility names delegating to the extracted policy. - Added direct tests for direct secret headers, nested suffix-matched secrets, and key normalization. - Carried forward the LiteLLM callback compatibility shim needed for current mypy on `main`. ## Testing - [x] Unit tests pass (`pytest`) - [x] Linting passes (`ruff check .`) - [x] Type checking passes (`mypy headroom`) - [x] New tests added for new functionality - [ ] Manual testing performed ### Test Output ```text python -m pytest tests\test_wire_debug_redaction_policy.py 3 passed in 0.16s python -m ruff check . All checks passed! python -m ruff format --check . 1095 files already formatted python -m mypy headroom --ignore-missing-imports Success: no issues found in 409 source files gitleaks protect --staged --no-banner --redact no leaks found ``` ## Real Behavior Proof - Environment: Windows, Python 3.13.13, branch `jd/architecture-slice-25`. - Exact command / steps: ran focused wire-debug redaction tests, ruff, ruff format check, mypy, and staged gitleaks scan. - Observed result: redaction policy is directly covered and local lint/type/security checks pass. - Not tested: full proxy wire-debug capture runtime; this slice preserves the existing helper entry points. ## Review Readiness - [x] I have performed a self-review - [x] This PR is ready for human review ## Checklist - [x] My code follows the project's style guidelines - [x] I have performed a self-review of my code - [x] I have commented my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation - [x] My changes generate no new warnings - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [ ] I have updated the CHANGELOG.md if applicable ## Screenshots (if applicable) N/A ## Additional Notes Documentation and changelog updates are N/A for this internal architecture-only refactor. The push reported existing default-branch Dependabot alerts; no staged secret leaks were found for this PR.
45 lines
1.4 KiB
Python
45 lines
1.4 KiB
Python
from __future__ import annotations
|
|
|
|
from headroom.proxy.wire_debug_redaction_policy import (
|
|
WIRE_DEBUG_REDACTED,
|
|
redact_for_wire_debug,
|
|
should_redact_key,
|
|
)
|
|
|
|
|
|
def test_wire_debug_redacts_direct_secret_keys() -> None:
|
|
redacted = redact_for_wire_debug(
|
|
{
|
|
"Authorization": "Bearer test-token",
|
|
"x-api-key": "sk-test",
|
|
"safe": "visible",
|
|
}
|
|
)
|
|
|
|
assert redacted == {
|
|
"Authorization": WIRE_DEBUG_REDACTED,
|
|
"x-api-key": WIRE_DEBUG_REDACTED,
|
|
"safe": "visible",
|
|
}
|
|
|
|
|
|
def test_wire_debug_redacts_nested_secret_suffixes() -> None:
|
|
redacted = redact_for_wire_debug(
|
|
{
|
|
"messages": [
|
|
{"content": "visible", "service_access_token": "secret-token"},
|
|
{"metadata": {"database_password": "secret-password", "trace_id": "abc"}},
|
|
]
|
|
}
|
|
)
|
|
|
|
assert redacted["messages"][0]["content"] == "visible"
|
|
assert redacted["messages"][0]["service_access_token"] == WIRE_DEBUG_REDACTED
|
|
assert redacted["messages"][1]["metadata"]["database_password"] == WIRE_DEBUG_REDACTED
|
|
assert redacted["messages"][1]["metadata"]["trace_id"] == "abc"
|
|
|
|
|
|
def test_wire_debug_key_matching_normalizes_dashes_and_case() -> None:
|
|
assert should_redact_key("Anthropic-API-Key")
|
|
assert should_redact_key("custom-refresh-token")
|
|
assert not should_redact_key("token_count")
|