mirror of
https://github.com/coder/coder.git
synced 2026-06-03 04:58:23 +00:00
Cian Johnston
38f5d3f0b2
Follow-up to #24564 addressing unresolved review findings. - **DEREM-1**: Add `Test_diff/Chat/TitleMasked` to `enterprise/audit/diff_internal_test.go` so flipping `title` back to `ActionTrack` fails loudly. Verified: the case passes today, fails with a clear diff after flipping to `ActionTrack`, passes again after reverting. - **DEREM-4**: Inline comment at `coderd/audit/request.go:138` explaining why `ResourceTarget` for `database.Chat` returns a UUID prefix instead of the title. - **DEREM-5**: Trailing comment on `enterprise/audit/table.go` `title` entry, matching the surrounding `ActionSecret` comment style. Won't-fix, with rationale (per user): - **DEREM-2** (8-char prefix collision risk): `resource_target` is a display hint, not an identifier; the full UUID lives in `resource_id`. - **DEREM-3** (named constant for `[:8]`): single call site; extracting would be ceremony. - **DEREM-6** (PR title misleading): merged PR title is immutable. - **DEREM-7** (historical log redaction): the offending version only shipped to dogfood for a couple of hours and not to customers. > 🤖
48 lines
1.0 KiB
Go
48 lines
1.0 KiB
Go
package audit_test
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/google/uuid"
|
|
"github.com/stretchr/testify/require"
|
|
"go.opentelemetry.io/otel/propagation"
|
|
|
|
"github.com/coder/coder/v2/coderd/audit"
|
|
"github.com/coder/coder/v2/coderd/database"
|
|
)
|
|
|
|
func TestBaggage(t *testing.T) {
|
|
t.Parallel()
|
|
prop := propagation.NewCompositeTextMapPropagator(
|
|
propagation.TraceContext{},
|
|
propagation.Baggage{},
|
|
)
|
|
|
|
expected := audit.WorkspaceBuildBaggage{
|
|
IP: "127.0.0.1",
|
|
}
|
|
|
|
ctx, err := audit.BaggageToContext(context.Background(), expected)
|
|
require.NoError(t, err)
|
|
|
|
carrier := propagation.MapCarrier{}
|
|
prop.Inject(ctx, carrier)
|
|
bCtx := prop.Extract(ctx, carrier)
|
|
got := audit.BaggageFromContext(bCtx)
|
|
|
|
require.Equal(t, expected, got)
|
|
}
|
|
|
|
func TestResourceTarget_ChatTitleNotLeaked(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
chat := database.Chat{
|
|
ID: uuid.UUID{1},
|
|
Title: "sensitive-project-name",
|
|
}
|
|
target := audit.ResourceTarget(chat)
|
|
require.NotContains(t, target, chat.Title,
|
|
"ResourceTarget for Chat must not contain the title; it should use a UUID prefix")
|
|
}
|