Osy#betaRun it on Osyrin: osyrin.com

Reference / Testing

Assert.NoTraceOf(token)

Assert.NoTraceOf(string token)

The erasure oracle: the token is found nowhere the app keeps data — any column of any table (the audit trail, memory, outboxes, translations and the model-call log included), any path-written file, any stored file — except a row kept restricted. Plant a unique token in everything a person gave you, erase them, then assert this.

preview2 examples compiled by CItestingprivacyerasureassert

Summary#

An erasure is proven the only way it can be: write a word nobody else would ever write into everything a person gives you, erase them, and look for the word everywhere. Assert.NoTraceOf("zanzibar-quill") fails naming each place it is still found — table Customer, column Name: 1 row(s), file receipts/O-1.pdf — so a missed copy is a red test that says where it is.

Signature#

Assert.NoTraceOf(string token)   // a [Test] only

Description#

Where it looks, enumerated from the platform's own registries rather than a list someone keeps: every text and JSON column the database reports for every table of the app (its own entities, every kit's and capability's — so the audit trail, memory, outboxes, translation storage and the model-call log too); every file in the app's path store; every stored file version, inline or in the blob store. The test's own pending writes are committed first.

What it excepts: a row kept restricted (restricted rows and purpose reads (Restriction, [PurposeRead])) — the copy an erasure kept on purpose, for a stated basis. Everything else is a trace.

What it cannot see, said plainly: a token inside compressed content (a PDF's streams, a zip), and anything a processor outside the platform holds (a mail provider's logs).

Assert.NoTraceOf is refused outside a [Test]: it reads every store the app keeps.

Examples#

app Notes { use Osysharp.Observability; }   // the audit trail is on — and is searched too

entity Note {
  [Required, MaxLength(40)] string Tag;
  [Classification(Personal.Content), MaxLength(400)] string? Text;   // so the trail never records it
  security { allow read, create, update, delete when IsAuthenticated || IsAnonymous; }
}
[Test]
void A_deleted_note_leaves_no_trace() {
  var n = new Note { Tag = "a", Text = "zanzibar-quill" };
  UnitOfWork.Commit();
  n.Delete();
  UnitOfWork.Commit();
  Assert.NoTraceOf("zanzibar-quill");
}

See also#

Related

Assert

The assertions a test makes. Beyond the usual equality and null checks there are comparisons (Greater, Less, InRange)…

restricted rows and purpose reads (Restriction, [PurposeRead])

Keep a row only for a stated purpose: Restriction.Restrict stamps it with a privacy category and the end of its period…

File.WriteAllBytes(..., about: row)

Write a file by path ABOUT a row — a receipt for an order, a label for a shipment — and the row finds it again:…