Adding masking for all integration test scripts

Author: EMaher

.gitignore

@@ -38,8 +38,9 @@ Desktop.ini
 # Local testing output (use --output .local-extract for local runs)
 .local-extract*/
 
-# Log files for integration tests
+# Files for integration tests
 tests/integration/all-resource-types/logs/**
+tests/integration/all-resource-types/extracted-artifacts/**
 
 # Environment variables
 .env

tests/integration/all-resource-types/Deploy-SourceApim.ps1

@@ -46,16 +46,21 @@ param(
     [ValidateSet('Developer', 'Premium', 'StandardV2', 'PremiumV2')]
     [string]$SkuName = 'StandardV2',
 
-    [switch]$Destroy
+    [switch]$Destroy,
+
+    [ValidateSet('trace', 'debug', 'info', 'warn', 'error', 'silent')]
+    [string]$LogLevel = 'info'
 )
 
 $ErrorActionPreference = 'Stop'
+$maskingHelpers = Join-Path $PSScriptRoot 'Masking.Helpers.ps1'
+. $maskingHelpers
 
 # ---------------------------------------------------------------------------
 # Destroy path
 # ---------------------------------------------------------------------------
 if ($Destroy) {
-    Write-Host "🗑️  Deleting resource group '$ResourceGroupName'..." -ForegroundColor Yellow
+    Write-Host "🗑️  Deleting resource group '$(Mask-Identifier -Value $ResourceGroupName)'..." -ForegroundColor Yellow
     az group delete --name $ResourceGroupName --yes --no-wait
     Write-Host "✅ Deletion initiated (async). Resource group will be removed shortly." -ForegroundColor Green
     exit 0
@@ -78,7 +83,7 @@ if (-not $account) {
 }
 
 $subscriptionId = $account.id
-Write-Host "   Subscription: $($account.name) ($subscriptionId)" -ForegroundColor Gray
+Write-Host "   Subscription: $($account.name) ($(Mask-SubscriptionId -Value $subscriptionId))" -ForegroundColor Gray
 
 # Register required resource providers
 Write-Host "📋 Registering required resource providers..." -ForegroundColor Cyan
@@ -124,7 +129,7 @@ if (-not $allRegistered) {
 Write-Host "   ✅ Resource providers ready" -ForegroundColor Green
 
 # Create resource group if needed
-Write-Host "📦 Ensuring resource group '$ResourceGroupName' exists in '$Location'..." -ForegroundColor Cyan
+Write-Host "📦 Ensuring resource group '$(Mask-Identifier -Value $ResourceGroupName)' exists in '$Location'..." -ForegroundColor Cyan
 az group create --name $ResourceGroupName --location $Location --output none
 
 # Deploy Bicep template
@@ -158,10 +163,11 @@ Write-Host ""
 Write-Host "APIOps CLI extract command:" -ForegroundColor Cyan
 Write-Host ""
 Write-Host "  npx apiops extract \"
-Write-Host "    --subscription-id $($outputs.subscriptionId.value) \"
-Write-Host "    --resource-group  $($outputs.resourceGroupName.value) \"
+Write-Host "    --subscription-id $(Mask-SubscriptionId -Value $outputs.subscriptionId.value) \"
+Write-Host "    --resource-group  $(Mask-Identifier -Value $outputs.resourceGroupName.value) \"
 Write-Host "    --service-name    $($outputs.apimServiceName.value) \"
-Write-Host "    --output-dir      ./extracted"
+Write-Host "    --output-dir      ./extracted \"
+Write-Host "    --log-level       $LogLevel"
 Write-Host ""
 Write-Host "Gateway URL:        $($outputs.gatewayUrl.value)" -ForegroundColor Gray
 Write-Host "Workspace deployed: $($outputs.workspaceDeployed.value)" -ForegroundColor Gray
@@ -178,6 +184,7 @@ $outputObj = @{
     workspaceDeployed = $outputs.workspaceDeployed.value
     gatewayDeployed = $outputs.gatewayDeployed.value
     skuName         = $outputs.skuName.value
+    logLevel        = $LogLevel
 }
 
 # Write to GitHub Actions output if running in CI

tests/integration/all-resource-types/Deploy-TargetApim.ps1

@@ -0,0 +1,76 @@
+<#
+.SYNOPSIS
+  Deploys the target APIM instance for round-trip integration testing.
+
+.DESCRIPTION
+  Creates a resource group and deploys the target-apim.bicep template,
+  provisioning a clean APIM instance used as the publish target.
+
+.PARAMETER ResourceGroupName
+  Name of the Azure resource group to create or update.
+
+.PARAMETER PublisherEmail
+  Publisher email required by the APIM deployment.
+
+.PARAMETER Location
+  Azure region. Default: eastus2.
+
+.PARAMETER SkuName
+  APIM SKU. Default: StandardV2. Allowed: Developer, Premium, StandardV2, PremiumV2.
+#>
+
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)]
+    [string]$ResourceGroupName,
+
+    [Parameter(Mandatory = $true)]
+    [string]$PublisherEmail,
+
+    [string]$Location = 'eastus2',
+
+    [ValidateSet('Developer', 'Premium', 'StandardV2', 'PremiumV2')]
+    [string]$SkuName = 'StandardV2'
+)
+
+$ErrorActionPreference = 'Stop'
+$maskingHelpers = Join-Path $PSScriptRoot 'Masking.Helpers.ps1'
+. $maskingHelpers
+
+$bicepFile = Join-Path $PSScriptRoot 'target-apim.bicep'
+
+if (-not (Test-Path $bicepFile)) {
+    Write-Error "Bicep file not found at: $bicepFile"
+}
+
+Write-Host "Starting target APIM deployment..."
+Write-Host "Resource Group: $(Mask-Identifier -Value $ResourceGroupName)"
+Write-Host "SKU: $SkuName"
+Write-Host "Location: $Location"
+
+Write-Host "Creating resource group..."
+az group create --name $ResourceGroupName --location $Location --output none
+if ($LASTEXITCODE -ne 0) {
+    throw "Failed to create target resource group"
+}
+
+Write-Host "Deploying target-apim.bicep (this takes 30-45 minutes)..."
+$raw = az deployment group create `
+    --resource-group $ResourceGroupName `
+    --name "target-apim-$(Get-Date -Format 'yyyyMMddHHmmss')" `
+    --template-file $bicepFile `
+    --parameters skuName=$SkuName location=$Location publisherEmail=$PublisherEmail `
+    --output json
+
+if ($LASTEXITCODE -ne 0) {
+    throw "Target APIM deployment failed"
+}
+
+$result = $raw | ConvertFrom-Json
+if (-not $result.properties.outputs) {
+    throw "Target deployment returned no outputs"
+}
+
+Write-Host "✅ Target APIM deployed successfully: $($result.properties.outputs.apimServiceName.value)"
+
+return $result.properties.outputs

tests/integration/all-resource-types/Masking.Helpers.ps1

@@ -0,0 +1,64 @@
+$EnableMasking = $true # Set to $false only for local debugging.
+
+function Mask-Identifier {
+    param(
+        [string]$Value,
+        [int]$Prefix = 6,
+        [int]$Suffix = 4
+    )
+
+    if (-not $EnableMasking) {
+        return $Value
+    }
+
+    if ([string]::IsNullOrWhiteSpace($Value)) {
+        return '<empty>'
+    }
+
+    if ($Value.Length -le ($Prefix + $Suffix)) {
+        return ('*' * $Value.Length)
+    }
+
+    return "{0}...{1}" -f $Value.Substring(0, $Prefix), $Value.Substring($Value.Length - $Suffix)
+}
+
+function Mask-SubscriptionId {
+    param([string]$Value)
+    return Mask-Identifier -Value $Value -Prefix 8 -Suffix 4
+}
+
+function Protect-LogLine {
+    param(
+        [string]$Line,
+        [hashtable]$Replacements
+    )
+
+    if (-not $EnableMasking -or [string]::IsNullOrEmpty($Line) -or -not $Replacements) {
+        return $Line
+    }
+
+    $protectedLine = $Line
+    foreach ($entry in $Replacements.GetEnumerator()) {
+        if ([string]::IsNullOrEmpty($entry.Key) -or [string]::IsNullOrEmpty($entry.Value)) {
+            continue
+        }
+
+        $protectedLine = $protectedLine.Replace($entry.Key, $entry.Value)
+    }
+
+    return $protectedLine
+}
+
+function Invoke-MaskedApiopsCommand {
+    param(
+        [scriptblock]$Command,
+        [hashtable]$Replacements
+    )
+
+    & $Command 2>&1 | ForEach-Object {
+        $message = $_.ToString()
+        Write-Host (Protect-LogLine -Line $message -Replacements $Replacements)
+    }
+
+    return $LASTEXITCODE
+}