Audit d10f67604976

#[cfg(test)]
mod corral_tests {
use super::super::*;

use regex::Regex;

#[test]
fn corral_first_secret_is_preserved_with_its_level_and_offsets() {
    let enterprise = Regex::new("alpha").expect("Test regex did not compile");
    let user = Regex::new("beta").expect("Test regex did not compile");
    let patterns = [enterprise.as_str(), user.as_str()];
    let secrets_regex = SecretsRegex {
        regex: regex_automata::meta::Regex::new_many(&patterns)
            .expect("Test regex did not compile"),
        dfas: regex_dfas::RegexDFAs::new_many(&patterns, false, true)
            .expect("Test regex DFA did not compile"),
        level_metadata: RegexLevelMetadata {
            enterprise_count: 1,
            user_count: 1,
        },
    };

    let matches =
        find_secrets_in_text_with_levels_using_regex("前alpha / beta後", &secrets_regex);

    assert_eq!(matches.len(), 2);
    assert_eq!(matches[0].0.byte_range, 3..8);
    assert_eq!(matches[0].0.char_range, 1..6);
    assert_eq!(matches[0].1, SecretLevel::Enterprise);
    assert_eq!(matches[1].0.byte_range, 11..15);
    assert_eq!(matches[1].0.char_range, 9..13);
    assert_eq!(matches[1].1, SecretLevel::User);
}

#[test]
fn test_corral_unicode_secret_ranges_preserve_character_offsets_and_levels() {
    let patterns = [
        Regex::new("token").unwrap(),
        Regex::new("尾").unwrap(),
    ];
    let pattern_strings: Vec<&str> = patterns.iter().map(|pattern| pattern.as_str()).collect();
    let secrets_regex = SecretsRegex {
        regex: regex_automata::meta::Regex::new_many(&pattern_strings).unwrap(),
        dfas: regex_dfas::RegexDFAs::new_many(&pattern_strings, false, true).unwrap(),
        level_metadata: RegexLevelMetadata {
            enterprise_count: 1,
            user_count: 1,
        },
    };

    let text = "é🔒token|尾";
    let matches = find_secrets_in_text_with_levels_using_regex(text, &secrets_regex);

    assert_eq!(matches.len(), 2);
    assert_eq!(matches[0].0.char_range, 2..7);
    assert_eq!(matches[0].0.byte_range, 6..11);
    assert_eq!(matches[0].1, SecretLevel::Enterprise);
    assert_eq!(matches[1].0.char_range, 8..9);
    assert_eq!(matches[1].0.byte_range, 12..15);
    assert_eq!(matches[1].1, SecretLevel::User);

    for (range, _) in &matches {
        let matched_text = &text[range.byte_range.clone()];
        let character_text: String = text
            .chars()
            .skip(range.char_range.start)
            .take(range.char_range.end - range.char_range.start)
            .collect();
        assert_eq!(character_text, matched_text);
    }
}

#[test]
fn corral_first_enterprise_pattern_retains_enterprise_level() {
    let enterprise = Regex::new("enterprise-secret").unwrap();
    let user = Regex::new("user-secret").unwrap();
    let patterns = [enterprise.as_str(), user.as_str()];
    let secrets_regex = SecretsRegex {
        regex: regex_automata::meta::Regex::new_many(&patterns).unwrap(),
        dfas: regex_dfas::RegexDFAs::new_many(&patterns, false, true).unwrap(),
        level_metadata: RegexLevelMetadata {
            enterprise_count: 1,
            user_count: 1,
        },
    };

    let matches = find_secrets_in_text_with_levels_using_regex(
        "enterprise-secret user-secret",
        &secrets_regex,
    );

    assert_eq!(matches.len(), 2);
    assert_eq!(matches[0].0.byte_range, 0..17);
    assert_eq!(matches[0].0.char_range, 0..17);
    assert_eq!(matches[0].1, SecretLevel::Enterprise);
    assert_eq!(matches[1].0.byte_range, 18..29);
    assert_eq!(matches[1].0.char_range, 18..29);
    assert_eq!(matches[1].1, SecretLevel::User);
}

#[test]
fn test_corral_secret_byte_ranges_preserve_unicode_and_public_suffix() {
    let enterprise = Regex::new("秘密").expect("Test regex did not compile");
    let user = Regex::new("token").expect("Test regex did not compile");
    let patterns = [enterprise.as_str(), user.as_str()];
    let secrets_regex = SecretsRegex {
        regex: regex_automata::meta::Regex::new_many(&patterns)
            .expect("Test regex did not compile"),
        dfas: regex_dfas::RegexDFAs::new_many(&patterns, false, true)
            .expect("Test regex DFA did not compile"),
        level_metadata: RegexLevelMetadata {
            enterprise_count: 1,
            user_count: 1,
        },
    };

    let text = "é秘密|token|公開";
    let found = find_secrets_in_text_with_levels_using_regex(text, &secrets_regex);

    assert_eq!(found.len(), 2);
    assert_eq!(found[0].0.char_range, 1..3);
    assert_eq!(found[0].0.byte_range, 2..8);
    assert_eq!(found[0].1, SecretLevel::Enterprise);
    assert_eq!(found[1].0.char_range, 4..9);
    assert_eq!(found[1].0.byte_range, 9..14);
    assert_eq!(found[1].1, SecretLevel::User);
    assert_eq!(&text[found[0].0.byte_range.clone()], "秘密");
    assert_eq!(&text[found[1].0.byte_range.clone()], "token");
}

#[test]
fn corral_preserves_final_secret_and_merges_adjacent_levels() {
    let enterprise = Regex::new("é").expect("Test regex did not compile");
    let user = Regex::new("密").expect("Test regex did not compile");
    let patterns = [enterprise.as_str(), user.as_str()];
    let secrets_regex = SecretsRegex {
        regex: regex_automata::meta::Regex::new_many(&patterns)
            .expect("Test regex did not compile"),
        dfas: RegexDFAs::new_many(&patterns, false, true)
            .expect("Test DFA did not compile"),
        level_metadata: RegexLevelMetadata {
            enterprise_count: 1,
            user_count: 1,
        },
    };

    let matches =
        find_secrets_in_text_with_levels_using_regex("xé密!密?", &secrets_regex);

    assert_eq!(matches.len(), 2);
    assert_eq!(matches[0].0.char_range, 1..3);
    assert_eq!(matches[0].0.byte_range, 1..6);
    assert_eq!(matches[0].1, SecretLevel::Enterprise);
    assert_eq!(matches[1].0.char_range, 4..5);
    assert_eq!(matches[1].0.byte_range, 7..10);
    assert_eq!(matches[1].1, SecretLevel::User);
}

#[test]
fn corral_single_secret_range_survives_merging_at_each_level() {
    let text = "前é🔑後";
    let matched = Regex::new("é🔑").unwrap().find(text).unwrap();
    let byte_range = matched.start()..matched.end();

    for level in [SecretLevel::User, SecretLevel::Enterprise] {
        let merged = merge_sorted_ranges_with_levels(vec![(
            StringRange {
                char_range: 1..3,
                byte_range: byte_range.clone(),
            },
            level,
        )]);

        assert_eq!(merged.len(), 1);
        assert_eq!(merged[0].0.char_range, 1..3);
        assert_eq!(merged[0].0.byte_range, byte_range);
        assert_eq!(merged[0].1, level);
    }
}

#[test]
fn corral_preserves_one_character_gap_between_secret_ranges() {
    let merged = merge_sorted_ranges_with_levels(vec![
        (
            StringRange {
                char_range: 0..1,
                byte_range: 0..2,
            },
            SecretLevel::User,
        ),
        (
            StringRange {
                char_range: 2..3,
                byte_range: 3..6,
            },
            SecretLevel::User,
        ),
        (
            StringRange {
                char_range: 3..4,
                byte_range: 6..7,
            },
            SecretLevel::Enterprise,
        ),
    ]);

    assert_eq!(merged.len(), 2);
    assert_eq!(merged[0].0.char_range, 0..1);
    assert_eq!(merged[0].0.byte_range, 0..2);
    assert_eq!(merged[0].1, SecretLevel::User);
    assert_eq!(merged[1].0.char_range, 2..4);
    assert_eq!(merged[1].0.byte_range, 3..7);
    assert_eq!(merged[1].1, SecretLevel::Enterprise);
}

#[test]
fn corral_enterprise_promotes_overlapping_and_adjacent_user_ranges() {
    for enterprise_start in [2, 4] {
        let merged = merge_sorted_ranges_with_levels(vec![
            (
                StringRange {
                    char_range: 1..4,
                    byte_range: 2..7,
                },
                SecretLevel::User,
            ),
            (
                StringRange {
                    char_range: enterprise_start..6,
                    byte_range: if enterprise_start == 2 { 4 } else { 7 }..10,
                },
                SecretLevel::Enterprise,
            ),
        ]);

        assert!(merged.len() == 1);
        assert!(merged[0].0.char_range == (1..6));
        assert!(merged[0].0.byte_range == (2..10));
        assert!(merged[0].1 == SecretLevel::Enterprise);
    }
}

#[test]
fn corral_disjoint_matches_preserve_their_own_secret_levels() {
    let enterprise = Regex::new("enterprise").unwrap();
    let user = Regex::new("user").unwrap();
    let patterns = [enterprise.as_str(), user.as_str()];
    let secrets_regex = SecretsRegex {
        regex: regex_automata::meta::Regex::new_many(&patterns).unwrap(),
        dfas: regex_dfas::RegexDFAs::new_many(&patterns, false, true).unwrap(),
        level_metadata: RegexLevelMetadata {
            enterprise_count: 1,
            user_count: 1,
        },
    };

    let matches = find_secrets_in_text_with_levels_using_regex(
        "enterprise | user | enterprise",
        &secrets_regex,
    );

    assert_eq!(matches.len(), 3);
    assert_eq!(matches[0].0.byte_range, 0..10);
    assert_eq!(matches[0].0.char_range, 0..10);
    assert_eq!(matches[0].1, SecretLevel::Enterprise);
    assert_eq!(matches[1].0.byte_range, 13..17);
    assert_eq!(matches[1].0.char_range, 13..17);
    assert_eq!(matches[1].1, SecretLevel::User);
    assert_eq!(matches[2].0.byte_range, 20..30);
    assert_eq!(matches[2].0.char_range, 20..30);
    assert_eq!(matches[2].1, SecretLevel::Enterprise);
}

#[test]
fn test_corral_single_enterprise_range_preserves_level() {
    let merged = merge_sorted_ranges_with_levels(vec![(
        string_offset::StringRange {
            char_range: 2..5,
            byte_range: 3..9,
        },
        SecretLevel::Enterprise,
    )]);

    assert_eq!(merged.len(), 1);
    assert_eq!(merged[0].0.char_range, 2..5);
    assert_eq!(merged[0].0.byte_range, 3..9);
    assert_eq!(merged[0].1, SecretLevel::Enterprise);
}

#[test]
fn corral_enterprise_patterns_are_compiled_and_preserve_source_levels() {
    let enterprise = Regex::new("CORRAL_ENTERPRISE_SECRET").unwrap();
    let user = Regex::new("CORRAL_USER_SECRET").unwrap();

    set_user_and_enterprise_secret_regexes([&user], [&enterprise]);
    let compiled = SECRETS_REGEX.lock().clone();

    let text = "CORRAL_ENTERPRISE_SECRET | CORRAL_USER_SECRET";
    let matches = find_secrets_in_text_with_levels_using_regex(text, &compiled);

    assert_eq!(matches.len(), 2);
    assert_eq!(matches[0].0.byte_range, 0..enterprise.as_str().len());
    assert_eq!(matches[0].0.char_range, 0..enterprise.as_str().len());
    assert_eq!(matches[0].1, SecretLevel::Enterprise);

    let user_start = enterprise.as_str().len() + 3;
    assert_eq!(matches[1].0.byte_range, user_start..text.len());
    assert_eq!(matches[1].0.char_range, user_start..text.len());
    assert_eq!(matches[1].1, SecretLevel::User);
}

#[test]
fn corral_user_only_configuration_replaces_enterprise_configuration() {
    let original = SECRETS_REGEX.lock().clone();
    let enterprise = Regex::new("corral_previous_enterprise_secret").unwrap();
    let user = Regex::new("corral_user_only_secret").unwrap();

    set_user_and_enterprise_secret_regexes(
        std::iter::empty::<&Regex>(),
        std::iter::once(&enterprise),
    );
    set_user_and_enterprise_secret_regexes(
        std::iter::once(&user),
        std::iter::empty::<&Regex>(),
    );

    let configured = {
        let mut current = SECRETS_REGEX.lock();
        let configured = current.clone();
        *current = original;
        configured
    };

    let text = "é corral_user_only_secret corral_previous_enterprise_secret";
    let matches = find_secrets_in_text_with_levels_using_regex(text, &configured);

    assert_eq!(configured.level_metadata.enterprise_count, 0);
    assert_eq!(configured.level_metadata.user_count, 1);
    assert_eq!(matches.len(), 1);
    assert_eq!(matches[0].0.byte_range, 3..26);
    assert_eq!(matches[0].0.char_range, 2..25);
    assert_eq!(matches[0].1, SecretLevel::User);
}

#[test]
fn test_corral_user_patterns_keep_user_level_after_enterprise_patterns() {
    let enterprise_patterns = [
        Regex::new("org_a").unwrap(),
        Regex::new("org_b").unwrap(),
    ];
    let user_patterns = [
        Regex::new("user_a").unwrap(),
        Regex::new("user_b").unwrap(),
        Regex::new("org_a").unwrap(),
    ];

    let previous = SECRETS_REGEX.lock().clone();
    set_user_and_enterprise_secret_regexes(user_patterns.iter(), enterprise_patterns.iter());
    let configured = {
        let mut current = SECRETS_REGEX.lock();
        std::mem::replace(&mut *current, previous)
    };

    let matches = find_secrets_in_text_with_levels_using_regex(
        "org_a user_a org_b user_b",
        &configured,
    );
    let actual: Vec<_> = matches
        .into_iter()
        .map(|(range, level)| (range.byte_range, range.char_range, level))
        .collect();

    assert_eq!(
        actual,
        vec![
            (0..5, 0..5, SecretLevel::Enterprise),
            (6..12, 6..12, SecretLevel::User),
            (13..18, 13..18, SecretLevel::Enterprise),
            (19..25, 19..25, SecretLevel::User),
        ]
    );
}

#[test]
fn test_corral_secret_configuration_is_published_and_replaced() {
    struct CorralRestoreSecrets(std::sync::Arc<SecretsRegex>);

    impl Drop for CorralRestoreSecrets {
        fn drop(&mut self) {
            *SECRETS_REGEX.lock() = self.0.clone();
        }
    }

    let _restore = CorralRestoreSecrets(SECRETS_REGEX.lock().clone());
    let user = Regex::new("corral_user_é").expect("Test regex did not compile");
    let enterprise = Regex::new("corral_enterprise_界").expect("Test regex did not compile");

    set_user_and_enterprise_secret_regexes([&user], [&enterprise]);

    let published = SECRETS_REGEX.lock().clone();
    assert_eq!(published.level_metadata.enterprise_count, 1);
    assert_eq!(published.level_metadata.user_count, 1);

    let text = "前 corral_user_é | corral_enterprise_界 後";
    let found = find_secrets_in_text_with_levels_using_regex(text, &published);
    assert_eq!(found.len(), 2);

    for ((range, level), (secret, expected_level)) in found.iter().zip([
        ("corral_user_é", SecretLevel::User),
        ("corral_enterprise_界", SecretLevel::Enterprise),
    ]) {
        let start = text.find(secret).expect("Secret must occur in test input");
        assert_eq!(range.byte_range, start..start + secret.len());
        let char_start = text[..start].chars().count();
        assert_eq!(
            range.char_range,
            char_start..char_start + secret.chars().count()
        );
        assert_eq!(*level, expected_level);
    }

    let mut redacted = text.to_owned();
    redact_secrets(&mut redacted);
    assert_eq!(
        redacted,
        format!(
            "前 {} | {} 後",
            "*".repeat("corral_user_é".len()),
            "*".repeat("corral_enterprise_界".len())
        )
    );
    assert_eq!(redacted.len(), text.len());

    set_user_and_enterprise_secret_regexes(
        std::iter::empty::<&Regex>(),
        std::iter::empty::<&Regex>(),
    );

    assert!(find_secrets_in_text_with_levels(text).is_empty());
    let mut unchanged = text.to_owned();
    redact_secrets(&mut unchanged);
    assert_eq!(unchanged, text);
}

#[test]
fn corral_user_patterns_remain_distinct_from_enterprise_patterns() {
    let enterprise = Regex::new("corral-enterprise-secret").unwrap();
    let user = Regex::new("corral-user-secret").unwrap();

    set_user_and_enterprise_secret_regexes([&user], [&enterprise]);
    let compiled = SECRETS_REGEX.lock().clone();

    for (text, expected_level) in [
        ("corral-enterprise-secret", SecretLevel::Enterprise),
        ("corral-user-secret", SecretLevel::User),
    ] {
        let matches = find_secrets_in_text_with_levels_using_regex(text, &compiled);
        assert_eq!(matches.len(), 1, "Expected a detected secret for {text}");
        assert_eq!(matches[0].0.byte_range, 0..text.len());
        assert_eq!(matches[0].0.char_range, 0..text.chars().count());
        assert_eq!(matches[0].1, expected_level);
    }

    assert!(
        find_secrets_in_text_with_levels_using_regex("ordinary public text", &compiled).is_empty()
    );
}

#[test]
fn test_corral_adjacent_enterprise_match_overrides_initial_user_level() {
    let enterprise = Regex::new("cd").expect("Test regex did not compile");
    let user = Regex::new("ab").expect("Test regex did not compile");
    let patterns = [enterprise.as_str(), user.as_str()];
    let secrets_regex = SecretsRegex {
        regex: regex_automata::meta::Regex::new_many(&patterns)
            .expect("Test regex did not compile"),
        dfas: RegexDFAs::new_many(&patterns, false, true)
            .expect("Test regex DFA did not compile"),
        level_metadata: RegexLevelMetadata {
            enterprise_count: 1,
            user_count: 1,
        },
    };

    let ranges =
        find_secrets_in_text_with_levels_using_regex("éabcd!", &secrets_regex);

    assert_eq!(ranges.len(), 1);
    assert_eq!(ranges[0].0.char_range, 1..5);
    assert_eq!(ranges[0].0.byte_range, 2..6);
    assert_eq!(ranges[0].1, SecretLevel::Enterprise);
    assert!(SecretLevel::Enterprise.priority() > SecretLevel::User.priority());
}

#[test]
fn corral_enterprise_priority_survives_overlapping_and_adjacent_user_ranges() {
    for second_start in [2, 3] {
        for (first_level, second_level) in [
            (SecretLevel::User, SecretLevel::Enterprise),
            (SecretLevel::Enterprise, SecretLevel::User),
        ] {
            let merged = merge_sorted_ranges_with_levels(vec![
                (
                    StringRange {
                        char_range: 0..3,
                        byte_range: 0..3,
                    },
                    first_level,
                ),
                (
                    StringRange {
                        char_range: second_start..6,
                        byte_range: second_start..6,
                    },
                    second_level,
                ),
            ]);

            assert_eq!(merged.len(), 1);
            assert_eq!(merged[0].0.char_range, 0..6);
            assert_eq!(merged[0].0.byte_range, 0..6);
            assert_eq!(merged[0].1, SecretLevel::Enterprise);
        }
    }
}

#[test]
fn test_corral_redacts_every_separated_secret_byte() {
    struct CorralRestoreSecrets(std::sync::Arc<SecretsRegex>);

    impl Drop for CorralRestoreSecrets {
        fn drop(&mut self) {
            *SECRETS_REGEX.lock() = self.0.clone();
        }
    }

    let restore = CorralRestoreSecrets(SECRETS_REGEX.lock().clone());
    let user_pattern = Regex::new("秘密").expect("Test regex did not compile");
    let enterprise_pattern = Regex::new("enterprise-secret").expect("Test regex did not compile");
    set_user_and_enterprise_secret_regexes([&user_pattern], [&enterprise_pattern]);

    let original = "é秘密 / enterprise-secret / 秘密🦀";
    let mut actual = original.to_owned();
    redact_secrets(&mut actual);
    drop(restore);

    let expected = format!("é****** / {} / ******🦀", "*".repeat(17));
    assert!(actual == expected);
    assert!(actual.len() == original.len());
}

#[test]
fn corral_redaction_preserves_byte_immediately_after_secret() {
    let user_pattern = Regex::new("corral_secret_é").expect("Test regex did not compile");
    let previous_regex = SECRETS_REGEX.lock().clone();

    set_user_and_enterprise_secret_regexes(
        std::iter::once(&user_pattern),
        std::iter::empty::<&Regex>(),
    );

    let original = "前:corral_secret_é! untouched";
    let mut actual = original.to_owned();
    redact_secrets(&mut actual);

    *SECRETS_REGEX.lock() = previous_regex;

    let expected = format!("前:{}! untouched", "*".repeat("corral_secret_é".len()));
    assert_eq!(actual, expected);
    assert_eq!(actual.len(), original.len());
}

#[test]
fn corral_secret_at_byte_zero_is_found_and_fully_redacted() {
    struct CorralRestoreRegex(std::sync::Arc<SecretsRegex>);

    impl Drop for CorralRestoreRegex {
        fn drop(&mut self) {
            *SECRETS_REGEX.lock() = self.0.clone();
        }
    }

    let _restore = CorralRestoreRegex(SECRETS_REGEX.lock().clone());
    let pattern = Regex::new("corral_secret").expect("Test regex did not compile");
    set_user_and_enterprise_secret_regexes(
        std::iter::once(&pattern),
        std::iter::empty::<&Regex>(),
    );

    let original = "corral_secret | é untouched | corral_secret!";
    let ranges = find_secrets_in_text(original);
    assert_eq!(ranges.len(), 2);
    assert_eq!(ranges[0].byte_range, 0..13);
    assert_eq!(ranges[0].char_range, 0..13);

    let last_start = original.rfind("corral_secret").unwrap();
    assert_eq!(ranges[1].byte_range, last_start..last_start + 13);

    let mut redacted = original.to_owned();
    redact_secrets(&mut redacted);
    assert_eq!(redacted, "************* | é untouched | *************!");
    assert_eq!(redacted.len(), original.len());
}

#[test]
fn corral_enterprise_level_survives_public_lookup() {
    let enterprise = Regex::new("corral_enterprise_secret_7c92").unwrap();
    let user = Regex::new("corral_user_secret_4a81").unwrap();
    set_user_and_enterprise_secret_regexes([&user], [&enterprise]);

    let text = "corral_enterprise_secret_7c92|corral_user_secret_4a81";
    let matches = find_secrets_in_text_with_levels(text);

    assert_eq!(matches.len(), 2);
    assert_eq!(matches[0].0.byte_range, 0..enterprise.as_str().len());
    assert_eq!(matches[0].0.char_range, 0..enterprise.as_str().len());
    assert_eq!(matches[0].1, SecretLevel::Enterprise);

    let user_start = enterprise.as_str().len() + 1;
    assert_eq!(matches[1].0.byte_range, user_start..text.len());
    assert_eq!(matches[1].0.char_range, user_start..text.len());
    assert_eq!(matches[1].1, SecretLevel::User);
}

#[test]
fn test_corral_public_secret_levels_preserve_pattern_sources() {
    let enterprise = Regex::new("corral_enterprise_secret_7429").unwrap();
    let user = Regex::new("corral_user_secret_8163").unwrap();
    let previous = SECRETS_REGEX.lock().clone();

    set_user_and_enterprise_secret_regexes([&user], [&enterprise]);
    let text = "corral_enterprise_secret_7429 | corral_user_secret_8163";
    let found = find_secrets_in_text_with_levels(text);
    *SECRETS_REGEX.lock() = previous;

    assert_eq!(found.len(), 2);
    assert_eq!(
        &text[found[0].0.byte_range.clone()],
        enterprise.as_str()
    );
    assert_eq!(found[0].1, SecretLevel::Enterprise);
    assert_eq!(&text[found[1].0.byte_range.clone()], user.as_str());
    assert_eq!(found[1].1, SecretLevel::User);
}

#[test]
fn corral_preserves_last_secret_and_redacts_every_matched_byte() {
    struct CorralRestoreSecrets(std::sync::Arc<SecretsRegex>);

    impl Drop for CorralRestoreSecrets {
        fn drop(&mut self) {
            *SECRETS_REGEX.lock() = self.0.clone();
        }
    }

    let _restore = CorralRestoreSecrets(SECRETS_REGEX.lock().clone());
    let enterprise = Regex::new("秘密").expect("Test regex did not compile");
    let user = Regex::new("token").expect("Test regex did not compile");
    set_user_and_enterprise_secret_regexes([&user], [&enterprise]);

    let original = "é[秘密] / token!";
    let found = find_secrets_in_text_with_levels(original);

    assert_eq!(found.len(), 2);
    assert_eq!(found[0].0.byte_range, 3..9);
    assert_eq!(found[0].0.char_range, 2..4);
    assert_eq!(found[0].1, SecretLevel::Enterprise);
    assert_eq!(found[1].0.byte_range, 13..18);
    assert_eq!(found[1].0.char_range, 8..13);
    assert_eq!(found[1].1, SecretLevel::User);

    let mut redacted = original.to_owned();
    redact_secrets(&mut redacted);
    assert_eq!(redacted, "é[******] / *****!");
    assert_eq!(redacted.len(), original.len());
}

#[test]
fn corral_secret_level_enterprise_classification_survivor_s6_m1() {
    assert!(SecretLevel::Enterprise.is_enterprise());
    assert!(!SecretLevel::User.is_enterprise());
    assert!(SecretLevel::User.is_user());
    assert!(!SecretLevel::Enterprise.is_user());
    assert!(SecretLevel::Enterprise.priority() > SecretLevel::User.priority());
}

#[test]
fn corral_secret_level_user_predicate_distinguishes_sources() {
    assert!(SecretLevel::User.is_user());
    assert!(!SecretLevel::Enterprise.is_user());
    assert!(SecretLevel::Enterprise.is_enterprise());
    assert!(!SecretLevel::User.is_enterprise());
}
}

// --- corral: separate test file (unmergeable) — s3/m3 ---
// lang: 2 authored parts each declare "corral_enterprise_priority_survives_overlapping_and_adjacent_user_ranges", which is not a test and cannot be renamed safely
#[cfg(test)]
mod corral_tests {
use super::super::*;

#[test]
fn corral_enterprise_priority_survives_overlapping_and_adjacent_user_ranges() {
    for (first_level, second_level) in [
        (SecretLevel::User, SecretLevel::Enterprise),
        (SecretLevel::Enterprise, SecretLevel::User),
    ] {
        for second_start in [2, 4] {
            let merged = merge_sorted_ranges_with_levels(vec![
                (
                    StringRange {
                        char_range: 0..4,
                        byte_range: 0..4,
                    },
                    first_level,
                ),
                (
                    StringRange {
                        char_range: second_start..8,
                        byte_range: second_start..8,
                    },
                    second_level,
                ),
            ]);

            assert_eq!(merged.len(), 1);
            assert_eq!(merged[0].0.char_range, 0..8);
            assert_eq!(merged[0].0.byte_range, 0..8);
            assert_eq!(merged[0].1, SecretLevel::Enterprise);
        }
    }
}
}