test(refusals): detect escaped malformed identifiers (#1873)

packages/organization/tests/safe-names.test.mjs

@@ -9,12 +9,14 @@ import { BusinessError } from '../src/errors.mjs';
 
 const bad = 'sk-test-NOT-A-SECRET-1234';
 const badId = `${bad.toLowerCase()} "`;
-function refusal(fn, names = [], omitted = bad) {
+function refusal(fn, names = [], omitted = bad, validation = null) {
   assert.throws(fn, error => {
     assert.ok(error instanceof BusinessError);
     assert.equal(error.exitCode, 2);
     for (const name of names) assert.ok(error.message.includes(name), error.message);
+    assert.doesNotMatch(error.message + error.stack, /sk-test|NOT-A-SECRET/i);
     assert.ok(!error.message.includes(omitted), error.message);
+    if (validation !== null) assert.match(error.message, validation);
     return true;
   });
 }
@@ -44,7 +46,7 @@ for (const kind of ['creative', 'outside']) test(`hireable ${kind} names a known
     if (kind === 'outside') writeFileSync(join(root, 'helper.json'), JSON.stringify({ ...d, name, hireable: [], authority: { withinRole: ['role.hire'], crossRole: [] } }));
   };
   refusal(role(t, edit), kind === 'creative' ? ['companion'] : ['helper', 'role.hire']);
-  refusal(role(t, d => { d.hireable = [badId]; }), [], badId);
+  refusal(role(t, d => { d.hireable = [badId]; }), [], badId, /role hireable entry must match/);
 });
 test('hireable wider action rejects unknown action before naming it', t => {
   refusal(role(t, (d, root) => {
@@ -82,5 +84,6 @@ for (const kind of ['reserved', 'human', 'user', 'grant', 'project', 'instance']
   }
   const value = { reserved: 'human', human: 'jason', user: 'bean', grant: 'g-known-1', project: '11111111-2222-4333-8444-555555555555', instance: 'coder' }[kind];
   refusal(run(value), [value]);
-  refusal(run(badId), [], badId);
+  const validation = kind === 'project' ? /lowercase UUID/ : kind === 'instance' ? /declared instance/ : /\.id must match/;
+  refusal(run(badId), [], badId, validation);
 });