bxcore: sanitize::refuse, what a memory write may never hold

Co-Authored-By: ornith-1.5-35b-a3b <agent@wntrmute.dev>

crates/bxcore/tests/support/keys.rs

@@ -0,0 +1,39 @@
+//! Fake secrets for the sanitizer's tests, built from pieces so that no test file holds one whole,
+//! and the one-line refusal check. Do not edit.
+
+#![allow(dead_code)] // each test file uses a different part of this module
+
+use bxcore::sanitize::refuse;
+
+/// The name of the rule `text` breaks, or `None`.
+pub fn rule(text: &str) -> Option<&'static str> {
+    refuse(text).map(|refusal| refusal.rule)
+}
+
+/// `n` characters with upper-case letters, lower-case letters and digits: shaped like a key.
+pub fn mixed(n: usize) -> String {
+    "Ab1Cd2Ef3Gh4Ij5Kl6Mn7Op8Qr9St0Uv"
+        .chars()
+        .cycle()
+        .take(n)
+        .collect()
+}
+
+/// `n` lower-case letters: shaped like part of a name.
+pub fn lower(n: usize) -> String {
+    "abcdefghijklmnopqrstuvwxyz"
+        .chars()
+        .cycle()
+        .take(n)
+        .collect()
+}
+
+/// `n` upper-case letters and digits, as in an AWS access key id.
+pub fn caps(n: usize) -> String {
+    "Q7XR2KD9MZ4WT8PL".chars().cycle().take(n).collect()
+}
+
+/// A PEM boundary line: five dashes, the label, five dashes.
+pub fn pem(label: &str) -> String {
+    format!("-----{label}-----")
+}