@@ -442,3 +442,73 @@ def test_pretty_from_binary_roundtrip(bin_file):
442442 assert txn .SerializeToString () == re_proto .SerializeToString (), (
443443 f"Binary roundtrip failed for { Path (bin_file ).name }
444444 )
445+
446+
447+ # ---------------------------------------------------------------------------
448+ # CSV storage integration secret masking
449+ #
450+ # Secret credentials are masked as "***" on print, so they cannot round-trip
451+ # through a fixture. These tests cover masking directly instead.
452+ # ---------------------------------------------------------------------------
453+
454+ _STORAGE_INTEGRATION_LQP = """(transaction
455+ (epoch
456+ (writes
457+ (define
458+ (fragment :f1
459+ (csv_data
460+ (csv_locator (paths "s3://private-bucket/data.csv"))
461+ (csv_config {}
462+ (storage_integration {
463+ :provider "s3"
464+ :s3_region "us-west-2"
465+ :s3_access_key_id "AKIAEXAMPLE"
466+ :s3_secret_access_key "topsecret-value"
467+ :azure_sas_token "sas-token-value" }))
468+ (columns (column "id" :x [INT]))
469+ (asof "2025-01-01T00:00:00Z")))))
470+ (reads (output :x :x))))"""
471+
472+
473+ def _parsed_storage_integration ():
474+ proto , _ = generated_parse (_STORAGE_INTEGRATION_LQP )
475+ config = (
476+ proto .epochs [0 ].writes [0 ].define .fragment .declarations [0 ].data .csv_data .config
477+ )
478+ return proto , config
479+
480+
481+ def test_storage_integration_parse_preserves_secrets ():
482+ """Parsing keeps the real secret values; masking is a print-only concern."""
483+ _ , config = _parsed_storage_integration ()
484+ assert config .HasField ("storage_integration" )
485+ si = config .storage_integration
486+ assert si .provider == "s3"
487+ assert si .s3_region == "us-west-2"
488+ assert si .s3_access_key_id == "AKIAEXAMPLE"
489+ assert si .s3_secret_access_key == "topsecret-value"
490+ assert si .azure_sas_token == "sas-token-value"
491+
492+
493+ def test_storage_integration_secrets_masked_on_print ():
494+ """Secret fields print as "***"; non-secret fields print verbatim."""
495+ proto , _ = _parsed_storage_integration ()
496+ printed = pretty (proto )
497+ # Secret values must never leak into the human-readable output.
498+ assert "AKIAEXAMPLE" not in printed
499+ assert "topsecret-value" not in printed
500+ assert "sas-token-value" not in printed
501+ assert ':s3_access_key_id "***"' in printed
502+ assert ':s3_secret_access_key "***"' in printed
503+ assert ':azure_sas_token "***"' in printed
504+ # Non-secret fields are shown as-is.
505+ assert ':provider "s3"' in printed
506+ assert ':s3_region "us-west-2"' in printed
507+
508+
509+ def test_storage_integration_absent_emits_no_block ():
510+ """A CSVConfig without a storage integration prints no storage_integration block."""
511+ config = logic_pb2 .CSVConfig ()
512+ assert not config .HasField ("storage_integration" )
513+ printer = PrettyPrinter ()
514+ assert printer .deconstruct_csv_storage_integration_optional (config ) is None
0 commit comments