Documentation
¶
Overview ¶
Package secrettest provides the adversary that the module's secret-hiding design is measured against: a reflection walker that reads unexported fields and follows pointers, in the manner of go-spew and of the structured loggers and debug dumpers built the same way.
It lives here, in a normal package rather than in a _test.go file, because two test packages need it and neither can import the other's tests: pkg/auth's external tests (package auth_test) exercise the exported secret-bearing types, while its internal tests (package auth) exercise the unexported ones — the PKCE verifier, the CSRF state, the authorization code — which no external test can name. One adversary, tested against from both sides, beats two that can drift apart. internal/mcptest is the precedent for a test-only helper living in a normal internal package.
Nothing outside a test may import this. It is in internal/ so nothing outside the module can, and it does nothing useful except attack our own types.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Dump ¶
Dump renders everything reachable in v, defeating the protections a well-behaved printer respects.
It is deliberately hostile in three specific ways, each mirroring something a real reflection-based dumper does:
- it uses unsafe.Pointer + reflect.NewAt to rebuild unexported fields as readable values, which defeats reflect.Value.CanInterface — this is the move that makes "the field is unexported" insufficient on its own;
- it follows pointers at any depth, unlike fmt, which follows one only at depth 0 and only into a composite — this is what makes a *string field insufficient;
- it ignores String, GoString and Format entirely, because a dumper's whole purpose is to show what a value *is* rather than what it says it is.
What it cannot do is call a function. That is the entire thesis of the secret-in-a-closure design: a closure's captured environment is not a field, so the only route to the bytes is to call the func, and a walker cannot know to. A secret held this way renders as "func@0x...".
func ReachedSecret ¶
ReachedSecret reports whether a Dump result shows the walker actually got as far as a secret's hiding place, rather than stopping short.
Without this, a redaction assertion is worthless: a walker that reached nothing also leaks nothing, and would pass. "func@" is a secret's closure; "keys:" is a MemoryStore, which renders its own summary.
Types ¶
This section is empty.
Source Files