@@ -255,4 +255,152 @@ describe("QA Lab UI evidence render", () => {
255255expect(html).not.toContain("<video controls");
256256expect(html).not.toContain('data-evidence-entry-id="null"');
257257});
258+259+it("redacts secret-like capture payload fields in raw previews", () => {
260+const payload =
261+'{"message":"visible context","message":"duplicate context","completion_tokens":100,"cookies":["session=abc"],"apiToken":"secret-token","tokenValue":"token-value-secret","authTokens":["auth-token-secret"],"tokens":{"refresh":"refresh-token-secret"},"AWS_SECRET_ACCESS_KEY":"aws-secret","secretAccessKey":"access-secret","x-goog-api-key":"goog-secret","nested":{"password":"secret-password"}}';
262+const html = renderQaLabUi(
263+evidenceState({
264+activeTab: "capture",
265+captureDetailView: "payload",
266+capturePayloadDetailLayout: "raw",
267+captureEvents: [
268+{
269+contentType: "application/json",
270+dataText: payload,
271+direction: "outbound",
272+flowId: "flow-1",
273+host: "api.example.test",
274+id: 1,
275+kind: "request",
276+method: "POST",
277+path: "/v1/messages",
278+payloadPreview: payload,
279+protocol: "https",
280+provider: "mock",
281+ts: 1,
282+},
283+],
284+selectedCaptureEventKey: "1:flow-1:1:request",
285+}),
286+);
287+288+expect(html).toContain("visible context");
289+expect(html).toContain("duplicate context");
290+expect(html).toContain("completion_tokens");
291+expect(html).toContain("100");
292+expect(html).toContain("apiToken");
293+expect(html).toContain("nested");
294+expect(html).toContain("[redacted]");
295+expect(html).not.toContain("session=abc");
296+expect(html).not.toContain("secret-token");
297+expect(html).not.toContain("token-value-secret");
298+expect(html).not.toContain("auth-token-secret");
299+expect(html).not.toContain("refresh-token-secret");
300+expect(html).not.toContain("aws-secret");
301+expect(html).not.toContain("access-secret");
302+expect(html).not.toContain("goog-secret");
303+expect(html).not.toContain("secret-password");
304+});
305+306+it("redacts secret-like fields when captured JSON previews are truncated", () => {
307+const payload =
308+'{"apiToken":"secret-token","nested":{"password":"secret-password"},"message":"visible context"';
309+for (const capturePayloadDetailLayout of ["raw", "formatted"] as const) {
310+const html = renderQaLabUi(
311+evidenceState({
312+activeTab: "capture",
313+captureDetailView: "payload",
314+ capturePayloadDetailLayout,
315+captureEvents: [
316+{
317+contentType: "application/json",
318+dataText: payload,
319+direction: "outbound",
320+flowId: "flow-1",
321+host: "api.example.test",
322+id: 1,
323+kind: "request",
324+method: "POST",
325+path: "/v1/messages",
326+payloadPreview: payload,
327+protocol: "https",
328+provider: "mock",
329+ts: 1,
330+},
331+],
332+selectedCaptureEventKey: "1:flow-1:1:request",
333+}),
334+);
335+336+expect(html).toContain("visible context");
337+expect(html).toContain("[redacted]");
338+expect(html).not.toContain("secret-token");
339+expect(html).not.toContain("secret-password");
340+}
341+});
342+343+it("redacts secret-like SSE data fields in formatted payloads", () => {
344+const payload = 'event: message\ndata: {"apiToken":"secret-token","message":"visible"}';
345+const html = renderQaLabUi(
346+evidenceState({
347+activeTab: "capture",
348+captureDetailView: "payload",
349+capturePayloadDetailLayout: "formatted",
350+captureEvents: [
351+{
352+contentType: "text/event-stream",
353+dataText: payload,
354+direction: "inbound",
355+flowId: "flow-1",
356+host: "api.example.test",
357+id: 1,
358+kind: "response",
359+path: "/v1/messages",
360+payloadPreview: payload,
361+protocol: "https",
362+provider: "mock",
363+ts: 1,
364+},
365+],
366+selectedCaptureEventKey: "1:flow-1:1:response",
367+}),
368+);
369+370+expect(html).toContain("visible");
371+expect(html).toContain("[redacted]");
372+expect(html).not.toContain("secret-token");
373+});
374+375+it("redacts secret-like fields when capture cuts inside a JSON value", () => {
376+const payload = '{"apiToken":"secret-token';
377+const html = renderQaLabUi(
378+evidenceState({
379+activeTab: "capture",
380+captureDetailView: "payload",
381+capturePayloadDetailLayout: "raw",
382+captureEvents: [
383+{
384+contentType: "application/json",
385+dataText: payload,
386+direction: "outbound",
387+flowId: "flow-1",
388+host: "api.example.test",
389+id: 1,
390+kind: "request",
391+method: "POST",
392+path: "/v1/messages",
393+payloadPreview: payload,
394+protocol: "https",
395+provider: "mock",
396+ts: 1,
397+},
398+],
399+selectedCaptureEventKey: "1:flow-1:1:request",
400+}),
401+);
402+403+expect(html).toContain("[redacted]");
404+expect(html).not.toContain("secret-token");
405+});
258406});
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。