pre-commit-hooks/tests/detect_azure_credentials_test.py

from __future__ import annotations

import pytest

from pre_commit_hooks.detect_azure_credentials import main
from testing.util import get_resource_path


@pytest.mark.parametrize(
    ("filename", "expected_retval"),
    (
        ("azure_credentials.txt", 1),
        ("azure_no_credentials.txt", 0),
        ("nonsense.txt", 0),
        ("ok_json.json", 0),
    ),
)
def test_detect_azure_credentials(filename, expected_retval):
    """Test detection of Azure credentials in various files."""
    ret = main((get_resource_path(filename),))
    assert ret == expected_retval


def test_detect_multiple_files():
    """Test scanning multiple files at once."""
    ret = main(
        (
            get_resource_path("azure_credentials.txt"),
            get_resource_path("azure_no_credentials.txt"),
        )
    )
    # Should return 1 because at least one file has credentials
    assert ret == 1


def test_detect_multiple_credentials_in_single_file():
    """Test that multiple credentials in one file are all detected."""
    ret = main((get_resource_path("azure_credentials.txt"),))
    assert ret == 1


def test_no_credentials_in_multiple_files():
    """Test scanning multiple clean files."""
    ret = main(
        (
            get_resource_path("azure_no_credentials.txt"),
            get_resource_path("nonsense.txt"),
            get_resource_path("ok_json.json"),
        )
    )
    assert ret == 0


def test_datafactory_shir_key_detection():
    """Test specific detection of Azure Data Factory SHIR keys."""
    ret = main((get_resource_path("azure_credentials.txt"),))
    assert ret == 1


def test_storage_credential_86char_detection():
    """Test detection of 86 character storage credentials."""
    ret = main((get_resource_path("azure_credentials.txt"),))
    assert ret == 1


def test_storage_credential_43char_detection():
    """Test detection of 43 character storage credentials."""
    ret = main((get_resource_path("azure_credentials.txt"),))
    assert ret == 1


def test_blob_url_with_sas_detection():
    """Test detection of blob URLs with SAS tokens."""
    ret = main((get_resource_path("azure_credentials.txt"),))
    assert ret == 1


def test_userid_password_detection():
    """Test detection of userid/password pairs."""
    ret = main((get_resource_path("azure_credentials.txt"),))
    assert ret == 1


def test_machinekey_detection():
    """Test detection of machine keys."""
    ret = main((get_resource_path("azure_credentials.txt"),))
    assert ret == 1


def test_connection_string_password_detection():
    """Test detection of passwords in connection strings."""
    ret = main((get_resource_path("azure_credentials.txt"),))
    assert ret == 1


def test_network_credential_detection():
    """Test detection of network credentials with domains."""
    ret = main((get_resource_path("azure_credentials.txt"),))
    assert ret == 1


def test_devops_pat_detection():
    """Test detection of DevOps Personal Access Tokens."""
    ret = main((get_resource_path("azure_credentials.txt"),))
    assert ret == 1


def test_app_service_deployment_detection():
    """Test detection of App Service deployment secrets."""
    ret = main((get_resource_path("azure_credentials.txt"),))
    assert ret == 1


def test_allows_arbitrarily_encoded_files(tmpdir):
    """Test that binary/arbitrarily encoded files don't cause crashes."""
    arbitrary_encoding = tmpdir.join("binary_file")
    arbitrary_encoding.write_binary(b"\x12\x9a\xe2\xf2\xff\xfe")
    ret = main((str(arbitrary_encoding),))
    assert ret == 0


def test_obfuscation_in_output(capsys):
    """Test that credentials are obfuscated in output."""
    ret = main((get_resource_path("azure_credentials.txt"),))
    assert ret == 1

    out, _ = capsys.readouterr()
    # Verify output contains filename and pattern name
    assert "azure_credentials.txt" in out
    assert "datafactory-shir" in out
    # Verify the actual credential is obfuscated (contains ***)
    assert "***" in out
    # Verify the full credential is NOT in output
    assert "uUY/w9WdKTdAWWPDMrEEWdAEZIgeXlrO51GtVUR1/BE=" not in out


def test_output_format_with_pattern_name(capsys):
    """Test that output includes pattern name for easier debugging."""
    ret = main((get_resource_path("azure_credentials.txt"),))
    assert ret == 1

    out, _ = capsys.readouterr()
    # Should mention the file
    assert "azure_credentials.txt" in out
    # Should include pattern names in parentheses
    assert "(" in out and ")" in out


def test_empty_file(tmpdir):
    """Test scanning an empty file."""
    empty_file = tmpdir.join("empty.txt")
    empty_file.write("")
    ret = main((str(empty_file),))
    assert ret == 0


def test_file_with_partial_patterns(tmpdir):
    """Test that partial/incomplete patterns don't trigger false positives."""
    partial = tmpdir.join("partial.txt")
    partial.write(
        "# These are incomplete patterns that should NOT match\n"
        "IR@incomplete\n"
        "AccountKey=short\n"
        "password=\n"
        "sig=toolittledata\n",
    )
    ret = main((str(partial),))
    assert ret == 0