refactor(fetch): pf-4589 sanitize error messages, logs

src/__tests__/__snapshots__/logger.test.ts.snap

@@ -43,7 +43,7 @@ exports[`formatLogEvent should return a formatted log event, partial 1`] = `"[DE
 
 exports[`formatLogEvent should return a formatted log event, undefined 1`] = `"[INFO]:"`;
 
-exports[`formatLogEvent should support sanitizing messages: sanitized 1`] = `"[INFO]: Authorization: Bearer [REDACTED]	:https://patternfly.org/?lorem=ipsum&private_token=%5BREDACTED%5D"`;
+exports[`formatLogEvent should support sanitizing messages: sanitized 1`] = `"[INFO]: Authorization: [REDACTED]	:https://patternfly.org/?lorem=ipsum&private_token=%5BREDACTED%5D"`;
 
 exports[`formatUnknownError should attempt to return a formatted error on non-errors, bigint 1`] = `"9007199254740991n"`;
 

src/__tests__/__snapshots__/options.defaults.test.ts.snap

@@ -178,6 +178,7 @@ exports[`options defaults should return specific properties: defaults 1`] = `
     "allowBinary": false,
     "maxSizeBytes": 5242880,
     "preflightHead": false,
+    "sanitizeMessages": true,
     "timeoutMs": 15000,
   },
 }

src/__tests__/__snapshots__/server.fetch.test.ts.snap

@@ -3,7 +3,7 @@
 exports[`setFetch should block outbound fetch and log warning in test mode when baseUrl is not configured: warning 1`] = `
 [
   [
-    "Network access blocked for https://patternfly.org: server is in 'test' mode and 'modeOptions.test.baseUrl' is not configured.",
+    "Network access blocked for https://patternfly.org/: server is in 'test' mode and 'modeOptions.test.baseUrl' is not configured.",
     "Configure 'modeOptions.test.baseUrl' to allow outbound fetches.",
   ],
 ]

src/__tests__/logger.helpers.test.ts

@@ -10,13 +10,23 @@ describe('sanitizeHeaderContent', () => {
     {
       description: 'authorization bearer token',
       input: 'Authorization: Bearer abc123',
-      expected: 'Authorization: Bearer [REDACTED]'
+      expected: 'Authorization: [REDACTED]'
+    },
+    {
+      description: 'authorization header redacts its complete value',
+      input: 'Authorization: Basic dXNlcjpwYXNz additional context',
+      expected: 'Authorization: [REDACTED]'
     },
     {
       description: 'private token header',
       input: 'Private-Token: abc123',
       expected: 'Private-Token: [REDACTED]'
     },
+    {
+      description: 'private token header with whitespace before delimiter',
+      input: 'Private-Token : abc123 additional context',
+      expected: 'Private-Token : [REDACTED]'
+    },
     {
       description: 'non-string input',
       input: undefined,
@@ -26,7 +36,54 @@ describe('sanitizeHeaderContent', () => {
       description: 'custom redacted marker',
       input: 'Authorization: Bearer abc123',
       options: { redacted: '<MASKED>' },
-      expected: 'Authorization: Bearer <MASKED>'
+      expected: 'Authorization: <MASKED>'
+    },
+    {
+      description: 'api_key assignment',
+      input: 'api_key=xyz123',
+      expected: 'api_key=[REDACTED]'
+    },
+    {
+      description: 'api-key header',
+      input: 'api-key: xyz123',
+      expected: 'api-key: [REDACTED]'
+    },
+    {
+      description: 'token assignment',
+      input: 'token=abc456',
+      expected: 'token=[REDACTED]'
+    },
+    {
+      description: 'key assignment',
+      input: 'key=secret123',
+      expected: 'key=[REDACTED]'
+    },
+    {
+      description: 'auth assignment',
+      input: 'auth=secret123',
+      expected: 'auth=[REDACTED]'
+    },
+    {
+      description: 'authorization assignment',
+      input: 'authorization=secret123',
+      expected: 'authorization=[REDACTED]'
+    },
+    {
+      description: 'api-key without space after colon',
+      input: 'api-key:xyz123',
+      expected: 'api-key:[REDACTED]'
+    },
+    {
+      description: 'custom secretParamRegExp option',
+      input: 'custom_identifier=xyz123',
+      options: { secretParamRegExp: /custom_identifier/i },
+      expected: 'custom_identifier=[REDACTED]'
+    },
+    {
+      description: 'global custom secretParamRegExp with multiple assignments',
+      input: 'custom_one=xyz123&custom_two=abc456',
+      options: { secretParamRegExp: /custom_/gi },
+      expected: 'custom_one=[REDACTED]&custom_two=[REDACTED]'
     }
   ])('should sanitize header content, $description', ({ input, options, expected }) => {
     expect(sanitizeHeaderContent(input, options as any)).toBe(expected);
@@ -55,6 +112,37 @@ describe('sanitizeUrlContent', () => {
       input: 'Fetch https://example.com/api?access_token=xyz now',
       expected: 'Fetch https://example.com/api?access_token=%5BREDACTED%5D now'
     },
+    {
+      description: 'global custom secretParamRegExp with multiple URL params',
+      input: 'https://example.com/docs?custom_one=xyz123&custom_two=abc456',
+      options: { secretParamRegExp: /custom_/gi },
+      expected: 'https://example.com/docs?custom_one=%5BREDACTED%5D&custom_two=%5BREDACTED%5D'
+    },
+    {
+      description: 'sanitize a URL with a parenthesis in its path',
+      input: 'Fetch https://example.com/a)path?token=abc123 now',
+      expected: 'Fetch https://example.com/a)path?token=%5BREDACTED%5D now'
+    },
+    {
+      description: 'sanitize a token ending in a parenthesis',
+      input: 'Fetch (https://example.com/docs?token=abc123)',
+      expected: 'Fetch (https://example.com/docs?token=%5BREDACTED%5D'
+    },
+    {
+      description: 'sanitize a token ending in nested parentheses',
+      input: 'Fetch ((https://example.com/a)path?token=abc123))',
+      expected: 'Fetch ((https://example.com/a)path?token=%5BREDACTED%5D'
+    },
+    {
+      description: 'sanitize a token ending in square brackets',
+      input: 'Fetch [https://example.com/docs?token=abc123]',
+      expected: 'Fetch [https://example.com/docs?token=%5BREDACTED%5D'
+    },
+    {
+      description: 'sanitize a token ending in an angle bracket',
+      input: 'Fetch <https://example.com/docs?token=abc123>',
+      expected: 'Fetch <https://example.com/docs?token=%5BREDACTED%5D'
+    },
     {
       description: 'non-string input',
       input: null,
@@ -66,7 +154,8 @@ describe('sanitizeUrlContent', () => {
       options: { redacted: '<MASKED>' },
       expected: 'https://example.com/docs?token=%3CMASKED%3E'
     }
-  ])('should sanitize url content, $description', ({ input, options, expected }) => {
+  ])('should sanitize url content while maintaining delimiter-like characters, $description', ({ input, options, expected }) => {
+    // IMPORTANT: Delimiter-like characters are intentionally kept intact and not stripped from URLs.
     expect(sanitizeUrlContent(input as any, options as any)).toBe(expected);
   });
 });
@@ -123,9 +212,9 @@ describe('sanitizeTokenContent', () => {
 describe('sanitizeMessage', () => {
   it.each([
     {
-      description: 'sanitize bearer token and url query token in one message',
+      description: 'replace everything after a recognized header',
       input: 'Authorization: Bearer abc123 https://example.com/api?access_token=xyz',
-      expected: 'Authorization: Bearer [REDACTED] https://example.com/api?access_token=%5BREDACTED%5D'
+      expected: 'Authorization: [REDACTED]'
     },
     {
       description: 'sanitize secret in Error message',
@@ -136,6 +225,11 @@ describe('sanitizeMessage', () => {
       description: 'non-string serializable object',
       input: { auth: 'Authorization: Bearer abc123' },
       expected: '{"auth":"Authorization: Bearer [REDACTED]"}'
+    },
+    {
+      description: 'sanitize non-URL api_key and token assignments',
+      input: 'Failed upstream: api_key=xyz123 and token=abc456',
+      expected: 'Failed upstream: api_key=[REDACTED] and token=[REDACTED]'
     }
   ])('should sanitize message content, $description', ({ input, expected }) => {
     expect(sanitizeMessage(input)).toContain(expected);

src/__tests__/logger.test.ts

@@ -115,7 +115,7 @@ describe('formatUnknownError', () => {
   it('should support sanitizing messages', () => {
     const input = 'Authorization: Bearer abc123';
 
-    expect(formatUnknownError(input)).toBe('Authorization: Bearer [REDACTED]');
+    expect(formatUnknownError(input)).toBe('Authorization: [REDACTED]');
   });
 });