test_refresh_auth_security.py

"""Security tests for tp_refresh_auth tool.

These tests verify that cookie values can NEVER leak into tool output.
"""

from tp_mcp.tools.refresh_auth import _sanitize_result


class TestSanitizeResult:
    """Test the result sanitization function."""

    def test_removes_cookie_key(self):
        """Cookie values must never appear in output."""
        result = {
            "success": True,
            "cookie": "SENSITIVE_VALUE_12345",
            "message": "OK",
        }
        sanitized = _sanitize_result(result)
        assert "cookie" not in sanitized
        assert "SENSITIVE_VALUE" not in str(sanitized)

    def test_removes_auth_token_key(self):
        """Auth-related keys must be stripped."""
        result = {
            "success": True,
            "auth_token": "secret123",
            "token": "secret456",
            "message": "OK",
        }
        sanitized = _sanitize_result(result)
        assert "auth_token" not in sanitized
        assert "token" not in sanitized
        assert "secret" not in str(sanitized).lower()

    def test_removes_credential_key(self):
        """Credential keys must be stripped."""
        result = {
            "success": True,
            "credential": "mycred",
            "user_credential": "othercred",
            "message": "OK",
        }
        sanitized = _sanitize_result(result)
        assert "credential" not in sanitized
        assert "user_credential" not in sanitized

    def test_preserves_safe_keys(self):
        """Safe keys should be preserved."""
        result = {
            "success": True,
            "message": "Authentication refreshed",
            "athlete_id": 12345,
            "email": "test@example.com",
            "browser": "chrome",
        }
        sanitized = _sanitize_result(result)
        assert sanitized == result

    def test_case_insensitive_filtering(self):
        """Filtering should be case-insensitive."""
        result = {
            "success": True,
            "COOKIE": "value1",
            "Cookie": "value2",
            "AUTH_TOKEN": "value3",
            "message": "OK",
        }
        sanitized = _sanitize_result(result)
        assert "COOKIE" not in sanitized
        assert "Cookie" not in sanitized
        assert "AUTH_TOKEN" not in sanitized


class TestCredentialResultRepr:
    """Test that CredentialResult doesn't leak cookies in repr."""

    def test_repr_hides_cookie(self):
        """Cookie value must not appear in repr."""
        from tp_mcp.auth.keyring import CredentialResult

        result = CredentialResult(
            success=True,
            message="Credential retrieved",
            cookie="SUPER_SECRET_VALUE_67890",
        )
        repr_str = repr(result)
        assert "SUPER_SECRET" not in repr_str
        assert "67890" not in repr_str
        assert "cookie=<present>" in repr_str

    def test_repr_shows_none_for_missing_cookie(self):
        from tp_mcp.auth.keyring import CredentialResult

        result = CredentialResult(success=False, message="No cred")
        repr_str = repr(result)
        assert "cookie=<None>" in repr_str


class TestBrowserCookieResultRepr:
    """Test that BrowserCookieResult doesn't leak cookies in repr."""

    def test_repr_hides_cookie_value(self):
        """Cookie value must not appear in repr."""
        from tp_mcp.auth.browser import BrowserCookieResult

        result = BrowserCookieResult(
            success=True,
            cookie="SUPER_SECRET_COOKIE_VALUE_12345",
            browser="chrome",
            message="Found cookie",
        )
        repr_str = repr(result)
        assert "SUPER_SECRET" not in repr_str
        assert "12345" not in repr_str
        assert "cookie=<present>" in repr_str

    def test_repr_shows_none_for_missing_cookie(self):
        """Repr should indicate when cookie is None."""
        from tp_mcp.auth.browser import BrowserCookieResult

        result = BrowserCookieResult(success=False, message="Not found")
        repr_str = repr(result)
        assert "cookie=<None>" in repr_str