proxy-redact.ts
46 lines · browse/src/proxy-redact.ts at 3f79d81
1/**
2 * Single source of truth for redacting proxy credentials in log lines.
3 *
4 * Anywhere browse logs a proxy URL (startup banner, error messages, debug
5 * output), it MUST go through redactProxyUrl first. Tests assert this for
6 * every log path that prints proxy config.
7 */
9const REDACTED = '***';
11/**
12 * Redact creds in a proxy URL string. Returns the URL with username and
13 * password replaced by '***'. If the input isn't parseable as a URL, returns
14 * a generic placeholder rather than echoing it back (input may be malformed
15 * AND contain creds).
16 */
17export function redactProxyUrl(input: string | null | undefined): string {
18 if (!input) return '<no proxy>';
19 let url: URL;
20 try {
21 url = new URL(input);
22 } catch {
23 return '<malformed proxy url>';
24 }
25 if (url.username) url.username = REDACTED;
26 if (url.password) url.password = REDACTED;
27 return url.toString();
28}
30/**
31 * Redact creds in an upstream config object (host/port/userId/password).
32 * Returns a plain object suitable for logging.
33 */
34export function redactUpstream(upstream: {
35 host: string;
36 port: number;
37 userId?: string;
38 password?: string;
39}): { host: string; port: number; userId?: string; password?: string } {
40 return {
41 host: upstream.host,
42 port: upstream.port,
43 ...(upstream.userId ? { userId: REDACTED } : {}),
44 ...(upstream.password ? { password: REDACTED } : {}),
45 };
46}