Initial server source import

2026-09-30 20:30:56 +03:00
commit 170dd941b9
498 changed files with 261563 additions and 0 deletions
@@ -0,0 +1,61 @@
+from pathlib import Path
+import sys
+import unittest
+from unittest import mock
+
+import pandas as pd
+
+
+ROOT = Path(__file__).resolve().parents[1]
+APP_DIR = ROOT / 'app'
+sys.path.insert(0, str(APP_DIR))
+
+import dashboard
+from scanner_db import extract_redacted_secret
+
+
+class DashboardSecretGuardTests(unittest.TestCase):
+    def test_raw_only_finding_never_populates_redacted_column_with_raw(self):
+        self.assertEqual(
+            extract_redacted_secret({'Raw': 'raw-secret-value'}),
+            '***REDACTED***',
+        )
+
+    def test_historical_unmasked_redacted_value_is_masked_before_render(self):
+        frame = pd.DataFrame([{'redacted_secret': 'historical-raw-secret', 'detector_name': 'OpenAI'}])
+        with mock.patch.object(dashboard.st, 'dataframe') as render:
+            dashboard.display_df(frame)
+        rendered = render.call_args.args[0]
+        self.assertEqual(rendered.iloc[0]['redacted_secret'], '***REDACTED***')
+        self.assertNotIn('historical-raw-secret', rendered.to_string())
+
+    def test_historical_endpoint_credentials_are_removed_before_render(self):
+        sentinels = (
+            'DASHBOARD-URL-USER-SENTINEL',
+            'DASHBOARD-URL-PASSWORD-SENTINEL',
+            'DASHBOARD-API-KEY-SENTINEL',
+            'DASHBOARD-TOKEN-SENTINEL',
+            'DASHBOARD-QUERY-PASSWORD-SENTINEL',
+        )
+        contaminated = (
+            f'https://{sentinels[0]}:{sentinels[1]}@normal.openai.azure.com:443/openai/deployments/demo'
+            f'?api_key={sentinels[2]}&token={sentinels[3]}&password={sentinels[4]}#private'
+        )
+        normal = 'https://normal.openai.azure.com/openai/deployments/ordinary'
+        frame = pd.DataFrame([
+            {'endpoint': contaminated, 'detector_name': 'OpenAI'},
+            {'endpoint': normal, 'detector_name': 'AzureOpenAI'},
+        ])
+        with mock.patch.object(dashboard.st, 'dataframe') as render:
+            dashboard.display_df(frame)
+        rendered = render.call_args.args[0]
+        self.assertEqual(
+            rendered.iloc[0]['endpoint'],
+            'https://normal.openai.azure.com:443/openai/deployments/demo',
+        )
+        self.assertEqual(rendered.iloc[1]['endpoint'], normal)
+        self.assertTrue(all(sentinel not in rendered.to_string() for sentinel in sentinels))
+
+
+if __name__ == '__main__':
+    unittest.main()