Add unit test for host env filtering and verify LOCALSTACK_AUTH_TOKEN exclusion

Author: gtsiolis

internal/container/start_test.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"errors"
 	"io"
+	"strings"
 	"testing"
 
 	"github.com/localstack/lstk/internal/log"
@@ -65,3 +66,25 @@ func TestServicePortRange_ReturnsExpectedPorts(t *testing.T) {
 	assert.Equal(t, "4559", ports[50].HostPort)
 }
 
+func TestFilterHostEnv(t *testing.T) {
+	tests := []struct {
+		name     string
+		env      string
+		expected bool
+	}{
+		{"CI is included", "CI=true", true},
+		{"LOCALSTACK_DISABLE_EVENTS is included", "LOCALSTACK_DISABLE_EVENTS=1", true},
+		{"LOCALSTACK_HOST is included", "LOCALSTACK_HOST=0.0.0.0", true},
+		{"LOCALSTACK_AUTH_TOKEN is excluded", "LOCALSTACK_AUTH_TOKEN=secret", false},
+		{"PATH is excluded", "PATH=/usr/bin", false},
+		{"HOME is excluded", "HOME=/root", false},
+		{"LOCALSTACK_BUILD_VERSION is included", "LOCALSTACK_BUILD_VERSION=3.0.0", true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := strings.HasPrefix(tt.env, "CI=") || (strings.HasPrefix(tt.env, "LOCALSTACK_") && !strings.HasPrefix(tt.env, "LOCALSTACK_AUTH_TOKEN="))
+			assert.Equal(t, tt.expected, got)
+		})
+	}
+}

test/integration/start_test.go

@@ -170,6 +170,7 @@ func TestStartCommandPassesCIAndLocalStackEnvVars(t *testing.T) {
 
 	t.Setenv("CI", "true")
 	t.Setenv("LOCALSTACK_DISABLE_EVENTS", "1")
+	t.Setenv("LOCALSTACK_AUTH_TOKEN", "host-token")
 
 	mockServer := createMockLicenseServer(true)
 	defer mockServer.Close()
@@ -187,6 +188,7 @@ func TestStartCommandPassesCIAndLocalStackEnvVars(t *testing.T) {
 	assert.Equal(t, "true", envVars["CI"])
 	assert.Equal(t, "1", envVars["LOCALSTACK_DISABLE_EVENTS"])
 	assert.NotEmpty(t, envVars["LOCALSTACK_AUTH_TOKEN"])
+	assert.NotEqual(t, "host-token", envVars["LOCALSTACK_AUTH_TOKEN"], "host LOCALSTACK_AUTH_TOKEN should not be passed through")
 }
 
 // containerEnvToMap converts a Docker container's []string env to a map.