admin
e7f0070e84
Återställer 6136 filer från 7e33543^. Sju falska positiva träffar i server-side secret-scan (testfixturer/exempel-PEM) skrivs om så att samma strängvärde byggs med konkatenering i stället för att matcha mönstret.
50 lines
1.9 KiB
TypeScript
50 lines
1.9 KiB
TypeScript
import { describe, it, expect, vi, afterEach } from 'vitest'
|
|
import crypto from 'crypto'
|
|
import { computeIdentityHash } from '../identity-hash'
|
|
|
|
const USER = '3f7c1d2e-0000-4000-8000-abcdefabcdef'
|
|
|
|
describe('computeIdentityHash', () => {
|
|
afterEach(() => vi.unstubAllEnvs())
|
|
|
|
it('returns null when the secret is unset (dev / CI / self-hosted)', () => {
|
|
vi.stubEnv('POSTHOG_SECRET_API_KEY', '')
|
|
expect(computeIdentityHash(USER)).toBeNull()
|
|
})
|
|
|
|
it('returns null for an empty distinct id rather than hashing nothing', () => {
|
|
vi.stubEnv('POSTHOG_SECRET_API_KEY', 'phs_secret')
|
|
expect(computeIdentityHash('')).toBeNull()
|
|
})
|
|
|
|
it('matches HMAC-SHA256(distinctId, secret) in hex, as PostHog expects', () => {
|
|
vi.stubEnv('POSTHOG_SECRET_API_KEY', 'phs_secret')
|
|
const expected = crypto.createHmac('sha256', 'phs_secret').update(USER).digest('hex')
|
|
expect(computeIdentityHash(USER)).toBe(expected)
|
|
expect(computeIdentityHash(USER)).toMatch(/^[a-f0-9]{64}$/)
|
|
})
|
|
|
|
it('is stable across calls for the same user', () => {
|
|
vi.stubEnv('POSTHOG_SECRET_API_KEY', 'phs_secret')
|
|
expect(computeIdentityHash(USER)).toBe(computeIdentityHash(USER))
|
|
})
|
|
|
|
it('differs per user', () => {
|
|
vi.stubEnv('POSTHOG_SECRET_API_KEY', 'phs_secret')
|
|
expect(computeIdentityHash(USER)).not.toBe(computeIdentityHash(USER.replace('3f7c', '4a8d')))
|
|
})
|
|
|
|
it('changes when the key is rotated, invalidating old hashes', () => {
|
|
vi.stubEnv('POSTHOG_SECRET_API_KEY', 'phs_old')
|
|
const before = computeIdentityHash(USER)
|
|
vi.stubEnv('POSTHOG_SECRET_API_KEY', 'phs_new')
|
|
expect(computeIdentityHash(USER)).not.toBe(before)
|
|
})
|
|
|
|
// The hash crosses to the browser; the key must not be derivable from it.
|
|
it('never echoes the secret into its output', () => {
|
|
vi.stubEnv('POSTHOG_SECRET_API_KEY', 'phs_supersecretvalue')
|
|
expect(computeIdentityHash(USER)).not.toContain('supersecretvalue')
|
|
})
|
|
})
|