Release v0.1.8

tests/test_core_events.py

@@ -133,6 +133,15 @@ class CoreEventTests(unittest.TestCase):
         self.assertEqual("request-123", response.json()["correlation_id"])
         self.assertEqual("request-123", response.headers["X-Correlation-ID"])
 
+    def test_app_rejects_wildcard_cors_with_credentials(self) -> None:
+        with self.assertRaisesRegex(ValueError, "wildcard origin"):
+            create_govoplan_app(
+                title="event test",
+                version="test",
+                registry=PlatformRegistry(),
+                cors_origins=("*",),
+            )
+
     def test_audit_event_persists_trace_details_from_event_context(self) -> None:
         root = Path(tempfile.mkdtemp(prefix="govoplan-audit-trace-"))
         try:
@@ -260,6 +269,8 @@ class CoreEventTests(unittest.TestCase):
         self.assertEqual("queued", payload["outcome"])
         self.assertEqual({"correlation_id": "corr-1", "causation_id": "cause-1"}, payload["_trace"])
         self.assertEqual("<redacted>", payload["options"]["api_key"])
+        self.assertEqual("<redacted>", audit_operation_context(options={"bearer_token": "secret"})["options"]["bearer_token"])
+        self.assertEqual("<redacted>", audit_operation_context(options={"clientSecret": "secret"})["options"]["clientSecret"])
         self.assertNotIn("token", payload["_trace"])
         self.assertNotIn("empty", payload)