Set the decision and its input
SYNTHETIC_ONLY is a test marker, never a credential. The supplied rule makes it server-only. The faulty builder embeds it literally in client source while rendering Demo; the repair omits it from client configuration and keeps Demo.
| Case | Input JSON |
|---|---|
| Base test | {"syntheticToken":"SYNTHETIC_ONLY","serverOnly":true} |
Run the supplied comparison
The generated fixed source executes locally and its bytes are inspected. Hiding a UI field would not remove an embedded literal. No real key or provider configuration is used.
| Path | Output JSON |
|---|---|
| Faulty path | {"clientContainsToken":true,"publicLabel":"Demo"} |
| Required path | {"clientContainsToken":false,"publicLabel":"Demo"} |
import assert from 'node:assert/strict';
const run=function run(i,corrected=true){
if(typeof i.syntheticToken!=='string'||!i.syntheticToken||typeof i.serverOnly!=='boolean')return {held:true};
const clientConfig=corrected&&i.serverOnly?{}:{token:i.syntheticToken};
const clientSource='return '+JSON.stringify({label:'Demo',config:clientConfig})+';';
const rendered=Function(clientSource)();
return {clientContainsToken:Buffer.from(clientSource).includes(Buffer.from(i.syntheticToken)),publicLabel:rendered.label};
};
const cases=[{"input":{"syntheticToken":"SYNTHETIC_ONLY","serverOnly":true},"corrected":false,"expected":{"clientContainsToken":true,"publicLabel":"Demo"}},{"input":{"syntheticToken":"SYNTHETIC_ONLY","serverOnly":true},"corrected":true,"expected":{"clientContainsToken":false,"publicLabel":"Demo"}},{"input":{"syntheticToken":"PUBLIC_LABEL","serverOnly":false},"corrected":true,"expected":{"clientContainsToken":true,"publicLabel":"Demo"}},{"input":{"syntheticToken":null,"serverOnly":true},"corrected":true,"expected":{"held":true}}];
for(const test of cases){const actual=await run(test.input,test.corrected);assert.deepEqual(actual,test.expected);console.log(actual);}
Choose from the boundary evidence
An explicitly public marker may appear. Missing marker is held because empty-string matching cannot establish useful exclusion.
- Classify the supplied setting
- Generate client content
- Inspect bytes and public output
Use harmless markers; do not paste actual credentials.
| Condition | Input JSON | Expected output JSON |
|---|---|---|
| declared public setting | {"syntheticToken":"PUBLIC_LABEL","serverOnly":false} | {"clientContainsToken":true,"publicLabel":"Demo"} |
| setting not supplied | {"syntheticToken":null,"serverOnly":true} | {"held":true} |
What does the repaired base demonstrate?
Show the worked answer
The server-only test marker is absent from those client bytes while Demo renders. It does not certify all secret-bearing outputs.