api/services/nginx/app/tests/Unit/Bird/BirdConfigSecretRedactionTest.php

<?php

app_require('traits/module_config_t.php');

use traits\module_config_t;

if (!class_exists('BirdSecretConfigDefinitionStub')) {
    class BirdSecretConfigDefinitionStub
    {
        public bool $config_variable_is_secret = true;

        public function getVariableName(): string
        {
            return 'api_key';
        }
    }
}

if (!class_exists('BirdPublicConfigDefinitionStub')) {
    class BirdPublicConfigDefinitionStub
    {
        public bool $config_variable_is_secret = false;

        public function getVariableName(): string
        {
            return 'workspaceId';
        }
    }
}

if (!class_exists('BirdModuleConfigRedactionHarness')) {
    class BirdModuleConfigRedactionHarness
    {
        use module_config_t;

        public function __construct()
        {
            $this->config_classes = [
                BirdSecretConfigDefinitionStub::class,
                BirdPublicConfigDefinitionStub::class,
            ];
        }

        public function extract(object $db): array
        {
            return $this->extracted($db, 'SELECT test');
        }
    }
}

it('redacts configured Bird secrets while preserving isSet metadata', function (): void {
    $rows = [
        ['module' => 'bird', 'variable' => 'api_key', 'type' => 'string', 'value' => 'never-return-this'],
        ['module' => 'bird', 'variable' => 'workspaceId', 'type' => 'string', 'value' => 'workspace-1'],
    ];
    $result = new class($rows) {
        public function __construct(private array $rows)
        {
        }

        public function fetch_assoc(): ?array
        {
            return array_shift($this->rows);
        }
    };
    $db = new class($result) {
        public function __construct(private object $result)
        {
        }

        public function query(string $sql): object
        {
            return $this->result;
        }
    };

    $config = (new BirdModuleConfigRedactionHarness())->extract($db);

    expect($config[0])->toMatchArray([
        'variable' => 'api_key',
        'value' => '[redacted]',
        'isSecret' => true,
        'isSet' => true,
    ])->and($config[1])->toMatchArray([
        'variable' => 'workspaceId',
        'value' => 'workspace-1',
        'isSecret' => false,
        'isSet' => true,
    ]);
});