Hide credentials in Git endpoint diagnostics

internal/git/display_test.go

@@ -0,0 +1,74 @@
+package git
+
+import (
+	"context"
+	"errors"
+	"os/exec"
+	"strings"
+	"testing"
+)
+
+func TestDisplayURL(t *testing.T) {
+	for _, test := range []struct{ input, want string }{
+		{"https://user:password@example.test/repo", "https://redacted@example.test/repo"},
+		{"https://token@example.test/repo", "https://redacted@example.test/repo"},
+		{"https://user%40example:secret%2Fvalue@example.test/repo", "https://redacted@example.test/repo"},
+		{"http://broken%zz:secret@example.test/repo", "[redacted URL]"},
+		{"https://example.test/repo", "https://example.test/repo"},
+		{"git@example.test:owner/repo", "git@example.test:owner/repo"},
+	} {
+		if got := DisplayURL(test.input); got != test.want {
+			t.Errorf("DisplayURL(%q) = %q, want %q", test.input, got, test.want)
+		}
+	}
+}
+
+func TestGitFailuresRedactCredentialsAndPreserveCause(t *testing.T) {
+	installFakeGit(t, `case "$*" in
+  *check-ref-format*) exit 0 ;;
+esac
+printf '%s\n' "fatal: unable to access 'https://user:secret@example.test/repo': https://token@example.test/path" >&2
+exit 23`)
+	endpoint := Endpoint{PushURL: "https://user:secret@example.test/repo", ScopedName: "fixture"}
+	for _, operation := range []struct {
+		name string
+		run  func() error
+	}{
+		{"query", func() error { _, err := endpoint.Query(context.Background(), t.TempDir(), "v1.2.3"); return err }},
+		{"push", func() error {
+			return endpoint.PushTag(context.Background(), t.TempDir(), "v1.2.3", strings.Repeat("a", 40))
+		}},
+	} {
+		t.Run(operation.name, func(t *testing.T) {
+			err := operation.run()
+			var exit *exec.ExitError
+			if !errors.As(err, &exit) || exit.ExitCode() != 23 {
+				t.Fatalf("error = %v, want Git exit 23", err)
+			}
+			if strings.Contains(err.Error(), "secret") || strings.Contains(err.Error(), "token") || strings.Contains(err.Error(), "user") || !strings.Contains(err.Error(), "example.test/repo") {
+				t.Fatalf("unsafe or unhelpful diagnostic: %v", err)
+			}
+		})
+	}
+}
+
+func TestDisplayErrorPreservesWrappedCause(t *testing.T) {
+	cause := errors.New("failed at https://token@example.test/path")
+	err := displayError{cause: cause}
+	if !errors.Is(err, cause) || strings.Contains(err.Error(), "token") {
+		t.Fatalf("sanitized error = %v", err)
+	}
+}
+
+func TestEndpointChangeRedactsNewDestination(t *testing.T) {
+	fixture := newRemoteFixture(t)
+	endpoint, err := Resolve(t.Context(), fixture.work, "origin")
+	if err != nil {
+		t.Fatal(err)
+	}
+	gitRun(t, fixture.work, "remote", "set-url", "--push", "origin", "https://new-token@example.test/repo")
+	err = endpoint.Recheck(t.Context(), fixture.work)
+	if !errors.Is(err, ErrEndpointChanged) || strings.Contains(err.Error(), "new-token") || !strings.Contains(err.Error(), "example.test/repo") {
+		t.Fatalf("endpoint change error = %v", err)
+	}
+}