fix: redact sensitive auth failure logs

Author: AlejandroAkbal

src/booru/services/booru-auth-manager.service.spec.ts

@@ -115,6 +115,39 @@ describe('BooruAuthManagerService', () => {
 expect(loggedMessage).toContain('auth_user=REDACTED')
 expect(loggedMessage).toContain('auth_pass=REDACTED')
 expect(loggedMessage).not.toContain('auth_pass=secret123')
+expect(loggedMessage).not.toContain('www-gel-user')
+
+errorSpy.mockRestore()
+warnSpy.mockRestore()
+})
+
+it('should redact sensitive key=value pairs outside of URLs in auth failure logs',()=>{
+consterrorSpy=jest.spyOn(console,'error').mockImplementation(()=>undefined)
+constwarnSpy=jest.spyOn(console,'warn').mockImplementation(()=>undefined)
+
+service.reportAuthFailure({
+domain: 'https://www.gelbooru.com/index.php?page=dapi',
+user: 'www-gel-user',
+password: 'www-gel-pass',
+error:
+'HTTP 403: Forbidden auth_user=www-gel-user auth_pass=secret123 token=abc123 api_key=xyz789 user_id=42 key=plain-key limit=10',
+timestamp: newDate()
+})
+
+constloggedMessage=errorSpy.mock.calls[0][0]
+
+expect(loggedMessage).toContain('auth_user=REDACTED')
+expect(loggedMessage).toContain('auth_pass=REDACTED')
+expect(loggedMessage).toContain('token=REDACTED')
+expect(loggedMessage).toContain('api_key=REDACTED')
+expect(loggedMessage).toContain('user_id=REDACTED')
+expect(loggedMessage).toContain('key=REDACTED')
+expect(loggedMessage).toContain('limit=10')
+expect(loggedMessage).not.toContain('www-gel-user')
+expect(loggedMessage).not.toContain('secret123')
+expect(loggedMessage).not.toContain('abc123')
+expect(loggedMessage).not.toContain('xyz789')
+expect(loggedMessage).not.toContain('plain-key')
 
 errorSpy.mockRestore()
 warnSpy.mockRestore()

src/booru/services/booru-auth-manager.service.ts

@@ -93,6 +93,7 @@ export class BooruAuthManagerService implements OnModuleInit {
 publicreportAuthFailure(authFailure: AuthFailureEvent): void{
 constnormalizedDomain=this.normalizeDomain(authFailure.domain)
 constsanitizedError=this.sanitizeErrorMessage(authFailure.error)
+constsanitizedUser=this.sanitizeUserIdentifier(authFailure.user)
 
 if(this.isCredentialDisabled(normalizedDomain,authFailure.user,authFailure.password)){
 return
@@ -110,7 +111,7 @@ export class BooruAuthManagerService implements OnModuleInit {
 this.broadcastDisabledCredential(disabledCredential)
 
 conststats=this.getDomainStats(normalizedDomain)
-console.error(`❌ Auth failure for ${normalizedDomain}:${authFailure.user} - ${sanitizedError}`)
+console.error(`❌ Auth failure for ${normalizedDomain}:${sanitizedUser} - ${sanitizedError}`)
 console.warn(
 `📊 ${normalizedDomain} credentials: ${stats.available}/${stats.total} available, ${stats.disabled} disabled`
 )
@@ -222,7 +223,28 @@ export class BooruAuthManagerService implements OnModuleInit {
 }
 
 consturlPattern=/https?:\/\/[^\s]+/gi
-returnmessage.replace(urlPattern,(url)=>this.sanitizeUrl(url))
+constsanitizedUrlMessage=message.replace(urlPattern,(url)=>this.sanitizeUrl(url))
+returnthis.sanitizeKeyValueTokens(sanitizedUrlMessage)
+}
+
+privatesanitizeUserIdentifier(user: string): string{
+if(!user){
+return'REDACTED'
+}
+
+return`REDACTED(${user.length})`
+}
+
+privatesanitizeKeyValueTokens(message: string): string{
+letsanitizedMessage=message
+
+for(constkeyofthis.sensitiveParams){
+constescapedKey=key.replace(/[.*+?^${}()|[\]\\]/g,'\\$&')
+constpattern=newRegExp(`\\b(${escapedKey})(\\s*=\\s*)([^\\s&#,;\\]\\)\\}]+)`,'gi')
+sanitizedMessage=sanitizedMessage.replace(pattern,'$1$2REDACTED')
+}
+
+returnsanitizedMessage
 }
 
 privatesanitizeUrl(url: string): string{