sh-mcp/packages/shared/src/redact.test.ts

import { describe, it, expect } from 'vitest';
import { redact, REDACTED } from './redact.js';

// ---------------------------------------------------------------------------
// SSN tests
// ---------------------------------------------------------------------------

describe('redact — SSN', () => {
  it('masks canonical SSN (NNN-NN-NNNN)', () => {
    expect(redact('SSN: 123-45-6789')).toContain(REDACTED);
    expect(redact('SSN: 123-45-6789')).not.toContain('123-45-6789');
  });

  it('masks spaced SSN (NNN NN NNNN)', () => {
    const result = redact('Social security: 123 45 6789');
    expect(result).toContain(REDACTED);
    expect(result).not.toContain('123 45 6789');
  });

  it('masks bare 9-digit SSN after keyword', () => {
    const result = redact('ssn 123456789');
    expect(result).toContain(REDACTED);
    expect(result).not.toContain('123456789');
  });

  it('masks SSN with "tax id" keyword', () => {
    const result = redact('tax id: 123-45-6789');
    expect(result).toContain(REDACTED);
  });

  it('does NOT mask a bare 9-digit number without keyword', () => {
    // Could be an invoice number, PO number, etc.
    const result = redact('Invoice #987654321 is due.');
    expect(result).not.toContain(REDACTED);
  });

  it('preserves surrounding text', () => {
    const result = redact('Employee 123-45-6789 is John Smith.');
    expect(result).toContain('Employee');
    expect(result).toContain('John Smith');
    expect(result).not.toContain('123-45-6789');
  });
});

// ---------------------------------------------------------------------------
// Routing number tests
// ---------------------------------------------------------------------------

describe('redact — routing numbers', () => {
  it('masks routing number with keyword before', () => {
    const result = redact('routing number 021000021');
    expect(result).toContain(REDACTED);
    expect(result).not.toContain('021000021');
  });

  it('masks ABA number with keyword', () => {
    const result = redact('ABA: 021000021');
    expect(result).toContain(REDACTED);
    expect(result).not.toContain('021000021');
  });

  it('masks routing number with keyword after (parenthetical)', () => {
    const result = redact('021000021 (routing)');
    expect(result).toContain(REDACTED);
    expect(result).not.toContain('021000021');
  });

  it('does NOT mask a bare 9-digit number that is not a routing number', () => {
    // Phone number fragment or zip+4 style — no keyword context
    const result = redact('Ref: 123456789 approved.');
    expect(result).not.toContain(REDACTED);
  });

  it('preserves vendor name next to routing number', () => {
    const result = redact('Vendor: Acme Corp, routing number 021000021');
    expect(result).toContain('Acme Corp');
    expect(result).toContain(REDACTED);
  });
});

// ---------------------------------------------------------------------------
// Account number tests
// ---------------------------------------------------------------------------

describe('redact — account numbers', () => {
  it('masks account number with keyword', () => {
    const result = redact('account number 12345678');
    expect(result).toContain(REDACTED);
    expect(result).not.toContain('12345678');
  });

  it('masks acct # shorthand', () => {
    const result = redact('acct #98765');
    expect(result).toContain(REDACTED);
    expect(result).not.toContain('98765');
  });

  it('masks account: prefix', () => {
    const result = redact('Account: 1234567890123');
    expect(result).toContain(REDACTED);
  });

  it('does NOT mask invoice/PO numbers without account keyword', () => {
    const result = redact('Invoice #12345 for Acme Corp');
    expect(result).not.toContain(REDACTED);
  });

  it('does NOT mask numbers below 4 digits', () => {
    const result = redact('account number 123');
    // 3 digits is below the minimum — no match
    expect(result).not.toContain(REDACTED);
  });

  it('preserves contact info adjacent to account number', () => {
    const result = redact('Contact billing@acme.com for account number 987654321');
    expect(result).toContain('billing@acme.com');
    expect(result).toContain(REDACTED);
  });
});

// ---------------------------------------------------------------------------
// Card number tests
// ---------------------------------------------------------------------------

describe('redact — card numbers', () => {
  it('masks a valid 16-digit Visa card number', () => {
    // 4111111111111111 is the canonical Luhn-valid test card
    const result = redact('Card: 4111111111111111');
    expect(result).toContain(REDACTED);
    expect(result).not.toContain('4111111111111111');
  });

  it('masks a hyphen-separated card number', () => {
    const result = redact('Card: 4111-1111-1111-1111');
    expect(result).toContain(REDACTED);
  });

  it('masks a space-separated card number', () => {
    const result = redact('Card: 4111 1111 1111 1111');
    expect(result).toContain(REDACTED);
  });

  it('masks a valid 15-digit Amex number', () => {
    // 378282246310005 is the canonical Amex test card
    const result = redact('Amex: 378282246310005');
    expect(result).toContain(REDACTED);
  });

  it('does NOT mask a 16-digit number that fails Luhn', () => {
    // 1234567890123456 fails Luhn
    const result = redact('Value: 1234567890123456');
    expect(result).not.toContain(REDACTED);
  });

  it('does NOT mask phone numbers (10 digits, fail Luhn)', () => {
    const result = redact('Call us at 5551234567');
    // 10 digits is below the 13-digit minimum for card pattern
    expect(result).not.toContain(REDACTED);
  });

  it('preserves vendor name next to card number', () => {
    const result = redact('Charged Stripe account for 4111111111111111');
    expect(result).toContain('Stripe');
    expect(result).toContain(REDACTED);
  });
});

// ---------------------------------------------------------------------------
// Vendor names and contacts left intact
// ---------------------------------------------------------------------------

describe('redact — preserves vendor names and contacts', () => {
  it('leaves company names intact', () => {
    const result = redact('Vendor: Consolidated Edison Co.');
    expect(result).toBe('Vendor: Consolidated Edison Co.');
  });

  it('leaves email addresses intact', () => {
    const result = redact('Contact: billing@acmecorp.com');
    expect(result).toBe('Contact: billing@acmecorp.com');
  });

  it('leaves phone numbers intact', () => {
    // Standard US phone — 10 digits, below card threshold
    const result = redact('Phone: 212-555-0100');
    expect(result).toBe('Phone: 212-555-0100');
  });

  it('leaves street addresses intact', () => {
    const result = redact('123 Main Street, New York, NY 10001');
    expect(result).toBe('123 Main Street, New York, NY 10001');
  });

  it('leaves dollar amounts intact', () => {
    const result = redact('Invoice total: $1,234.56');
    expect(result).toBe('Invoice total: $1,234.56');
  });

  it('leaves invoice and PO numbers intact', () => {
    const result = redact('PO #20240001, Invoice #INV-9999');
    expect(result).toBe('PO #20240001, Invoice #INV-9999');
  });
});

// ---------------------------------------------------------------------------
// Mixed / realistic finance response
// ---------------------------------------------------------------------------

describe('redact — realistic finance responses', () => {
  it('masks multiple sensitive fields in a payment record', () => {
    const payload = [
      'Vendor: Acme Supply Co.',
      'Contact: accounts@acme.com',
      'Bank routing: 021000021',
      'Account number: 123456789012',
      'Check amount: $4,500.00',
      'Employee SSN: 123-45-6789',
    ].join('\n');

    const result = redact(payload);

    // Sensitive fields masked
    expect(result).not.toContain('021000021');
    expect(result).not.toContain('123456789012');
    expect(result).not.toContain('123-45-6789');

    // Vendor name and contact intact
    expect(result).toContain('Acme Supply Co.');
    expect(result).toContain('accounts@acme.com');

    // Dollar amount intact
    expect(result).toContain('$4,500.00');
  });

  it('is idempotent — redacting twice produces the same result', () => {
    const payload = 'SSN: 987-65-4321, routing number 021000021';
    const once = redact(payload);
    const twice = redact(once);
    expect(once).toBe(twice);
  });

  it('handles empty string without error', () => {
    expect(redact('')).toBe('');
  });

  it('handles string with no sensitive data unchanged', () => {
    const clean = 'Lookup result: work order WO-12345 for site Central Park.';
    expect(redact(clean)).toBe(clean);
  });
});