1 files changed, 104 insertions, 0 deletions
diff --git a/spec/lib/expand_variables_spec.rb b/spec/lib/expand_variables_spec.rb
index ad73665326a..695e63b6db1 100644
--- a/spec/lib/expand_variables_spec.rb
+++ b/spec/lib/expand_variables_spec.rb
@@ -187,6 +187,102 @@ RSpec.describe ExpandVariables, feature_category: :secrets_management do
     end
   end
 
+  shared_examples 'masked variable expansion with fail_on_masked true' do |expander|
+    using RSpec::Parameterized::TableSyntax
+
+    subject { expander.call(value, variables, fail_on_masked: true) }
+
+    where do
+      {
+        'simple expansion with a masked variable': {
+          value: 'key$variable',
+          variables: [
+            { key: 'variable', value: 'value', masked: true }
+          ]
+        },
+        'complex expansion with a masked variable': {
+          value: 'key${variable}${variable2}',
+          variables: [
+            { key: 'variable', value: 'value', masked: true },
+            { key: 'variable2', value: 'result', masked: false }
+          ]
+        },
+        'expansion using % with a masked variable': {
+          value: 'key%variable%',
+          variables: [
+            { key: 'variable', value: 'value', masked: true }
+          ]
+        }
+      }
+    end
+
+    with_them do
+      it 'raises an error' do
+        expect { subject }.to raise_error(
+          ExpandVariables::VariableExpansionError, /masked variables cannot be expanded/
+        )
+      end
+    end
+
+    context 'expansion without a masked variable' do
+      let(:value) { 'key$variable${variable2}' }
+
+      let(:variables) do
+        [
+          { key: 'variable', value: 'value', masked: false },
+          { key: 'variable2', value: 'result', masked: false }
+        ]
+      end
+
+      it { is_expected.to eq('keyvalueresult') }
+    end
+  end
+
+  shared_examples 'masked variable expansion with fail_on_masked false' do |expander|
+    using RSpec::Parameterized::TableSyntax
+
+    subject { expander.call(value, variables, fail_on_masked: false) }
+
+    where do
+      {
+        'simple expansion with a masked variable': {
+          value: 'key$variable',
+          result: 'keyvalue',
+          variables: [
+            { key: 'variable', value: 'value', masked: true }
+          ]
+        },
+        'complex expansion with a masked variable': {
+          value: 'key${variable}${variable2}',
+          result: 'keyvalueresult',
+          variables: [
+            { key: 'variable', value: 'value', masked: true },
+            { key: 'variable2', value: 'result', masked: false }
+          ]
+        },
+        'expansion using % with a masked variable': {
+          value: 'key%variable%',
+          result: 'keyvalue',
+          variables: [
+            { key: 'variable', value: 'value', masked: true }
+          ]
+        },
+        'expansion without a masked variable': {
+          value: 'key$variable${variable2}',
+          result: 'keyvalueresult',
+          variables: [
+            { key: 'variable', value: 'value', masked: false },
+            { key: 'variable2', value: 'result', masked: false }
+          ]
+        }
+      }
+    end
+
+    with_them do
+      it { is_expected.to eq(result) }
+    end
+  end
+
   describe '#expand' do
     context 'table tests' do
       it_behaves_like 'common variable expansion', described_class.method(:expand)
@@ -195,6 +291,10 @@ RSpec.describe ExpandVariables, feature_category: :secrets_management do
 
       it_behaves_like 'file variable expansion with expand_file_refs false', described_class.method(:expand)
 
+      it_behaves_like 'masked variable expansion with fail_on_masked true', described_class.method(:expand)
+
+      it_behaves_like 'masked variable expansion with fail_on_masked false', described_class.method(:expand)
+
       context 'with missing variables' do
         using RSpec::Parameterized::TableSyntax
 
@@ -265,6 +365,10 @@ RSpec.describe ExpandVariables, feature_category: :secrets_management do
 
       it_behaves_like 'file variable expansion with expand_file_refs false', described_class.method(:expand_existing)
 
+      it_behaves_like 'masked variable expansion with fail_on_masked true', described_class.method(:expand)
+
+      it_behaves_like 'masked variable expansion with fail_on_masked false', described_class.method(:expand)
+
       context 'with missing variables' do
         using RSpec::Parameterized::TableSyntax