1import { serverEnvironmentNames } from "./env_contract.ts";2import { loadNamedEnvironment } from "./load_env.ts";3import { findSecretLeaks } from "./secret_scan.ts";45function assert(condition: unknown, message: string): asserts condition {6 if (!condition) throw new Error(message);7}89Deno.test("server secret loaded only from env file is detected in a build fixture", async () => {10 const directory = await Deno.makeTempDir({ dir: ".", prefix: ".secret-scan-test-" });11 const envPath = `${directory}/.env`;12 const artifactPath = `${directory}/dist/app.js`;13 const secret = "fixture-server-secret-that-must-not-leak";14 try {15 await Deno.mkdir(`${directory}/dist`);16 await Deno.writeTextFile(envPath, `JAZZ_ADMIN_SECRET=${secret}\n`);17 await Deno.writeTextFile(artifactPath, `globalThis.accidental = "${secret}";\n`);18 const environment = await loadNamedEnvironment(19 serverEnvironmentNames,20 envPath,21 () => undefined,22 );23 const leaks = findSecretLeaks(24 [{ path: artifactPath, content: await Deno.readFile(artifactPath) }],25 serverEnvironmentNames26 .map((name) => ({ name, value: environment[name] ?? "" }))27 .filter(({ value }) => value.length > 0),28 );29 assert(leaks.length === 1, "expected one detected leak");30 assert(leaks[0].name === "JAZZ_ADMIN_SECRET", "leak should name the source variable");31 assert(leaks[0].path === artifactPath, "leak should name the artifact path");32 assert(!("value" in leaks[0]), "leak result must not expose the secret value");33 } finally {34 await Deno.remove(directory, { recursive: true });35 }36});