test(v2): define secure control-plane contracts

tests/unit/test_redaction.py

@@ -0,0 +1,38 @@
+from __future__ import annotations
+
+import importlib
+
+
+def test_redaction_removes_nested_secret_fields_and_canaries() -> None:
+    redaction = importlib.import_module("backup_tool.security.redaction")
+    canary = "canary-a96f"
+    value = {
+        "username": "operator",
+        "password": canary,
+        "nested": {"token": canary, "safe": "visible"},
+        "items": [{"secret": canary}, canary],
+    }
+    result = redaction.redact(value, canaries=(canary,))
+    rendered = repr(result)
+    assert canary not in rendered
+    assert result["username"] == "operator"
+    assert result["nested"]["safe"] == "visible"
+    assert result["password"] == "[REDACTED]"
+
+
+def test_envelope_cipher_round_trips_with_purpose_binding(tmp_path) -> None:
+    secrets = importlib.import_module("backup_tool.security.secrets")
+    key_path = tmp_path / "master.key"
+    key_path.write_bytes(b"x" * 32)
+    cipher = secrets.EnvelopeCipher.from_file(key_path)
+    ciphertext, key_id = cipher.encrypt("sensitive", purpose="ssh", version=1)
+    assert b"sensitive" not in ciphertext
+    assert cipher.decrypt(ciphertext, purpose="ssh", version=1) == "sensitive"
+    assert key_id
+
+    try:
+        cipher.decrypt(ciphertext, purpose="database", version=1)
+    except Exception as error:
+        assert error.__class__.__name__ == "InvalidTag"
+    else:  # pragma: no cover - required safety assertion
+        raise AssertionError("ciphertext accepted under a different purpose")