rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Stop leaking customer email domain in cassette guard → Add PKCE coverage tests for entropy and replay

Browse Source 
- Stop leaking customer email domain in cassette guard
- Deep-copy ExtraAuthParams in ApplyProviderDefaults
- Drop raw monday graphql error from returned errors
- Add PKCE coverage tests for entropy and replay

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
This commit is contained in:
Aurélien Sibiril
2026-05-17 17:22:49 +02:00
parent 7504099507
commit 842f9cfbc5
4 changed files with 146 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
pkg/accessreview/drivers/cassette_safety_test.go
View File

@@ -47,6 +47,8 @@ func TestCassettesUseSyntheticEmails(t *testing.T) {
".test",
".invalid",
".localhost",
// Google Workspace test domain family (RFC-style synthetic).
".test-google-a.com",
}
// allowedExactDomains lists individual domains that pre-date this
@@ -83,7 +85,6 @@ func TestCassettesUseSyntheticEmails(t *testing.T) {
seen[email] = true
domain := email[strings.IndexByte(email, '@')+1:]
domain = strings.TrimSuffix(domain, ".test-google-a.com")
if allowedExactDomains[domain] {
continue
}
@@ -96,19 +97,20 @@ func TestCassettesUseSyntheticEmails(t *testing.T) {
}
}
// Log the domain (actionable) but never the local-part
// — a failed assertion ends up in CI logs, and the whole
// point of this guard is to keep PII out of those logs.
// Operators can grep the cassette locally to identify the
// offending row.
// A failed assertion lands in CI logs. Keep both the
// local-part AND the domain out of the message — together
// they form a complete PII tuple, which is exactly what
// this guard exists to prevent. Operators can grep the
// cassette locally to identify the offending row.
assert.Truef(
t,
ok,
"cassette %s contains an email with non-synthetic domain %q; "+
"either replace with a synthetic *.example.com address or "+
"add the domain to allowedExactDomains in cassette_safety_test.go "+
"cassette %s contains an email with a non-synthetic "+
"domain; either replace with a synthetic "+
"*.example.com address or add the domain to "+
"allowedExactDomains in cassette_safety_test.go "+
"with a justification",
filepath.Base(cassette), domain,
filepath.Base(cassette),
)
}
})