expectVantageExportArtifactsSafe function

void expectVantageExportArtifactsSafe(List<VantageExportArtifact> artifacts)

Asserts artifacts are safe to place in an exported bug bundle: bundle-relative filenames that are non-empty, unique and traversal-free, and text payloads that the producer already redacted (defence in depth — the host pipeline redacts again).

Implementation

void expectVantageExportArtifactsSafe(List<VantageExportArtifact> artifacts) {
  const redactor = VantageDefaultRedactor();
  final names = artifacts.map((a) => a.filename).toList();

  expect(
    names,
    everyElement(isNotEmpty),
    reason: 'filenames must be non-empty',
  );
  expect(
    names.toSet().length,
    names.length,
    reason: 'artifact filenames must be unique within a plugin',
  );
  for (final name in names) {
    expect(
      name,
      isNot(contains('/')),
      reason: 'the host namespaces artifacts by plugin id — do not add paths',
    );
    expect(name, isNot(contains(r'\')), reason: 'no path separators');
    expect(
      name,
      isNot(contains('..')),
      reason: 'no parent-directory traversal',
    );
  }
  for (final artifact in artifacts) {
    if (!artifact.isText) continue;
    final text = utf8.decode(artifact.bytes, allowMalformed: true);
    expect(
      redactor.redact(text),
      text,
      reason: 'redact text artifacts at capture with context.redactor — a '
          'credential must never exist in an artifact, even briefly',
    );
  }
}