Initial import from garrytan/gstack@026751e (main snapshot via local relay)

Source: https://github.com/garrytan/gstack/commit/026751e

browse/test/proxy-redact.test.ts

@@ -0,0 +1,64 @@
+import { describe, test, expect } from 'bun:test';
+import { redactProxyUrl, redactUpstream } from '../src/proxy-redact';
+
+describe('redactProxyUrl', () => {
+  test('replaces user:pass with ***:*** in socks5 URL', () => {
+    const out = redactProxyUrl('socks5://alice:secret@host.example.com:1080');
+    expect(out).toContain('***:***');
+    expect(out).not.toContain('alice');
+    expect(out).not.toContain('secret');
+    expect(out).toContain('host.example.com:1080');
+  });
+
+  test('replaces creds in http URL', () => {
+    const out = redactProxyUrl('http://bob:hunter2@proxy.corp:3128');
+    expect(out).not.toContain('bob');
+    expect(out).not.toContain('hunter2');
+    expect(out).toContain('proxy.corp:3128');
+  });
+
+  test('returns URL unchanged when no creds present', () => {
+    const out = redactProxyUrl('http://proxy.corp:3128');
+    expect(out).toContain('proxy.corp:3128');
+    expect(out).not.toContain('***');
+  });
+
+  test('returns placeholder for malformed input', () => {
+    expect(redactProxyUrl('not-a-url')).toBe('<malformed proxy url>');
+    expect(redactProxyUrl('http://')).toBe('<malformed proxy url>');
+  });
+
+  test('returns placeholder for empty/null', () => {
+    expect(redactProxyUrl(null)).toBe('<no proxy>');
+    expect(redactProxyUrl(undefined)).toBe('<no proxy>');
+    expect(redactProxyUrl('')).toBe('<no proxy>');
+  });
+
+  test('does not echo cred bytes when URL is malformed but contains creds', () => {
+    // Defensive: if input has creds AND is malformed, we still don't echo.
+    const out = redactProxyUrl('socks5://leaked:password-bad-host');
+    expect(out).not.toContain('leaked');
+    expect(out).not.toContain('password');
+  });
+});
+
+describe('redactUpstream', () => {
+  test('redacts userId and password', () => {
+    const out = redactUpstream({
+      host: 'proxy.example.com',
+      port: 1080,
+      userId: 'realuser',
+      password: 'realpass',
+    });
+    expect(out.host).toBe('proxy.example.com');
+    expect(out.port).toBe(1080);
+    expect(out.userId).toBe('***');
+    expect(out.password).toBe('***');
+  });
+
+  test('omits userId/password when not present', () => {
+    const out = redactUpstream({ host: 'proxy.example.com', port: 1080 });
+    expect(out.userId).toBeUndefined();
+    expect(out.password).toBeUndefined();
+  });
+});