mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
J3vbandClaude Opus 4.8
4fc21cb372
Make server failures debuggable without leaking secrets: - configurable stdout log level (config.yaml logging.level + OWNCORD_LOGGING_LEVEL) - preserve the DB cause in ErrInternal wraps; log auth-DB failures distinctly from bad tokens; log the previously-silent expired-session cleanup goroutine - route HTTP handler panics through slog (was chi stderr-only, invisible to the admin log stream) - stackutil: argument-free panic stacks so key/token bytes never reach the admin ring buffer / SSE; slog.LogValuer redaction on VoiceConfig/GitHubConfig/ GIFConfig/Config and db.User/db.Session - logctx: req_id/trace_id correlation on ...Context log calls Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
46 lines
1.4 KiB
Go
46 lines
1.4 KiB
Go
package config
|
|
|
|
import (
|
|
"bytes"
|
|
"log/slog"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// TestSecretConfigsRedactedInLogs is the security guard for config redaction:
|
|
// no matter whether the whole Config or a single section is logged, the
|
|
// LiveKit key/secret, GitHub token, and Klipy key must never reach the output.
|
|
func TestSecretConfigsRedactedInLogs(t *testing.T) {
|
|
const (
|
|
lkKey = "LIVEKIT_KEY_should_not_appear"
|
|
lkSecret = "LIVEKIT_SECRET_should_not_appear"
|
|
ghToken = "ghp_token_should_not_appear"
|
|
gifKey = "klipy_key_should_not_appear"
|
|
)
|
|
cfg := Config{
|
|
Voice: VoiceConfig{LiveKitAPIKey: lkKey, LiveKitAPISecret: lkSecret, Quality: "high"},
|
|
GitHub: GitHubConfig{Token: ghToken, Owner: "acme"},
|
|
GIF: GIFConfig{APIKey: gifKey},
|
|
}
|
|
|
|
var buf bytes.Buffer
|
|
log := slog.New(slog.NewTextHandler(&buf, nil))
|
|
log.Info("whole", "config", cfg) // whole-config path (delegating LogValue)
|
|
log.Info("voice", "voice", cfg.Voice)
|
|
log.Info("github", "github", cfg.GitHub)
|
|
log.Info("gif", "gif", cfg.GIF)
|
|
|
|
out := buf.String()
|
|
for _, secret := range []string{lkKey, lkSecret, ghToken, gifKey} {
|
|
if strings.Contains(out, secret) {
|
|
t.Errorf("secret leaked into log output: %q\n%s", secret, out)
|
|
}
|
|
}
|
|
if !strings.Contains(out, "high") || !strings.Contains(out, "acme") {
|
|
t.Errorf("expected non-secret fields in output:\n%s", out)
|
|
}
|
|
if !strings.Contains(out, "[REDACTED]") {
|
|
t.Errorf("expected redaction marker in output:\n%s", out)
|
|
}
|
|
}
|