TenantAtlas/apps/platform/tests/Feature/OpsUx/FailureSanitizationTest.php

<?php

use App\Models\ManagedEnvironment;
use App\Services\OperationRunService;
use Illuminate\Notifications\DatabaseNotification;

it('sanitizes persisted run failures and terminal notifications', function () {
    $tenant = ManagedEnvironment::factory()->create();
    [$user, $tenant] = createUserWithTenant($tenant, role: 'owner');

    /** @var OperationRunService $runs */
    $runs = app(OperationRunService::class);

    $run = $runs->ensureRun(
        tenant: $tenant,
        type: 'test.sanitize',
        inputs: [],
        initiator: $user,
    );

    $rawBearer = 'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.'.str_repeat('A', 90);

    $runs->updateRun(
        $run,
        status: 'completed',
        outcome: 'failed',
        failures: [[
            'code' => 'graph_forbidden',
            'message' => "Authorization: {$rawBearer} client_secret=supersecret passwordMinimumLength is still readable user=test.user@example.com",
        ]],
    );

    $run->refresh();

    $failureSummaryJson = json_encode($run->failure_summary, JSON_THROW_ON_ERROR);

    expect($failureSummaryJson)->not->toContain('client_secret=supersecret');
    expect($failureSummaryJson)->not->toContain($rawBearer);
    expect($failureSummaryJson)->not->toContain('test.user@example.com');

    expect($run->failure_summary[0]['reason_code'] ?? null)->toBe('provider_permission_denied');

    $notification = DatabaseNotification::query()
        ->where('notifiable_id', $user->getKey())
        ->latest('id')
        ->first();

    expect($notification)->not->toBeNull();

    $notificationJson = json_encode($notification?->data, JSON_THROW_ON_ERROR);

    expect($notificationJson)->not->toContain('client_secret=supersecret');
    expect($notificationJson)->not->toContain($rawBearer);
    expect($notificationJson)->not->toContain('test.user@example.com');
    expect($notificationJson)->toContain('passwordMinimumLength');

    $this->actingAs($user)
        ->get(route('admin.operations.view', [
            'workspace' => (int) $run->workspace_id,
            'run' => (int) $run->getKey(),
        ]))
        ->assertSuccessful();
});