fix(security): sanitize credential test logs

2026-05-15 02:44:50 -04:00
1 parent b92cf62c4c
commit c20d3942a8
@@ -0,0 +1,256 @@
+import type { IpcMainInvokeEvent } from "electron";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import type { DesktopResult } from "../../src/shared/contracts";
+import { IPC_CHANNELS } from "../../src/shared/contracts";
+import type { CredentialResolver } from "../../src/main/credentials/credential-resolver";
+import type { CredentialStore } from "../../src/main/credentials/credential-store";
+
+const streamMocks = vi.hoisted(() => ({
+  safeStreamSimpleWithEnv: vi.fn(),
+}));
+
+vi.mock("electron", () => ({
+  ipcMain: {
+    removeHandler: vi.fn(),
+  },
+}));
+
+vi.mock("../../src/main/worker/runtime/pi-safe-stream", () => ({
+  safeStreamSimpleWithEnv: streamMocks.safeStreamSimpleWithEnv,
+}));
+
+import { registerCredentialIpcHandlers } from "../../src/main/ipc-credentials-handlers";
+
+type IpcHandler = (
+  event: IpcMainInvokeEvent,
+  ...args: unknown[]
+) => Promise<DesktopResult<unknown>> | DesktopResult<unknown>;
+
+function createDeps(overrides: { resolver?: Partial<CredentialResolver>; store?: Partial<CredentialStore> } = {}) {
+  const handlers = new Map<string, IpcHandler>();
+  const logger = {
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+  };
+  const resolver = {
+    resolve: vi.fn(async () => ({
+      apiKey: "sk-proj-testcredentialsecret0123456789",
+    })),
+    ...(overrides.resolver ?? {}),
+  } as unknown as CredentialResolver;
+
+  registerCredentialIpcHandlers({
+    store: {
+      list: vi.fn(() => []),
+      save: vi.fn(),
+      remove: vi.fn(),
+      ...(overrides.store ?? {}),
+    } as unknown as CredentialStore,
+    resolver,
+    emitEvent: vi.fn(),
+    refreshConnectorHealth: vi.fn(async () => {}),
+    registerHandle: (channel, handler) => {
+      handlers.set(channel, handler);
+    },
+    fail: (code, message) => ({ ok: false, error: { code, message } }),
+    logger,
+  });
+
+  const handler = handlers.get(IPC_CHANNELS.credentialsTest);
+  if (!handler) {
+    throw new Error("credentialsTest handler was not registered.");
+  }
+  return { handler, handlers, logger };
+}
+
+async function runCredentialTest(handler: IpcHandler) {
+  return handler(null as unknown as IpcMainInvokeEvent, { connectorId: "fireworks" }) as Promise<DesktopResult<{
+    ok: boolean;
+    message: string;
+  }>>;
+}
+
+function requireHandler(handlers: Map<string, IpcHandler>, channel: string) {
+  const handler = handlers.get(channel);
+  if (!handler) {
+    throw new Error(`${channel} handler was not registered.`);
+  }
+  return handler;
+}
+
+function joinLogCalls(mock: ReturnType<typeof vi.fn>) {
+  return mock.mock.calls.flat().map(String).join(" ");
+}
+
+describe("credential IPC handler logging", () => {
+  beforeEach(() => {
+    streamMocks.safeStreamSimpleWithEnv.mockReset();
+  });
+
+  it("redacts resolver failures for the UI and logs only safe credential test metadata", async () => {
+    const secret = "sk-proj-resolversecret012345678901234";
+    const error = Object.assign(
+      new Error(`failed for ${secret} at https://api.fireworks.ai/inference/v1`),
+      { code: "CREDENTIAL_INVALID", $metadata: { requestId: "req_resolver_123" } },
+    );
+    const { handler, logger } = createDeps({
+      resolver: {
+        resolve: vi.fn(async () => {
+          throw error;
+        }),
+      },
+    });
+
+    const result = await runCredentialTest(handler);
+    const log = joinLogCalls(logger.error);
+
+    expect(result).toEqual({
+      ok: true,
+      data: {
+        ok: false,
+        message: "failed for sk-proj-[REDACTED] at https://api.fireworks.ai/inference/v1",
+      },
+    });
+    expect(log).toBe("[credentials] test failed: connector=fireworks provider=fireworks code=CREDENTIAL_INVALID requestId=req_resolver_123");
+    expect(log).not.toContain(secret);
+    expect(log).not.toContain("api.fireworks.ai");
+  });
+
+  it("keeps stream error messages out of credential test logs", async () => {
+    const secret = "Bearer eyJhbGciOiJIUzI1NiJ9.secret.payload";
+    streamMocks.safeStreamSimpleWithEnv.mockReturnValueOnce({
+      result: vi.fn(async () => ({
+        stopReason: "error",
+        errorMessage: `provider rejected ${secret} for https://api.fireworks.ai/inference/v1`,
+      })),
+    });
+    const { handler, logger } = createDeps();
+
+    const result = await runCredentialTest(handler);
+    const log = joinLogCalls(logger.warn);
+
+    expect(result).toEqual({
+      ok: true,
+      data: {
+        ok: false,
+        message: "provider rejected Bearer [REDACTED] for https://api.fireworks.ai/inference/v1",
+      },
+    });
+    expect(log).toBe("[credentials] test failed: connector=fireworks provider=fireworks code=stream_error");
+    expect(log).not.toContain(secret);
+    expect(log).not.toContain("api.fireworks.ai");
+  });
+
+  it("logs safe code and request id when credential test streaming throws", async () => {
+    const secret = "AKIA1234567890ABCDEF";
+    const error = Object.assign(
+      new Error(`upstream threw ${secret} at https://bedrock-runtime.us-east-1.amazonaws.com`),
+      {
+        code: "AccessDeniedException",
+        response: { headers: new Map([["x-request-id", "req_stream_456"]]) },
+      },
+    );
+    streamMocks.safeStreamSimpleWithEnv.mockReturnValueOnce({
+      result: vi.fn(async () => {
+        throw error;
+      }),
+    });
+    const { handler, logger } = createDeps();
+
+    const result = await runCredentialTest(handler);
+    const log = joinLogCalls(logger.error);
+
+    expect(result).toEqual({
+      ok: true,
+      data: {
+        ok: false,
+        message: "upstream threw AKIA[REDACTED] at https://bedrock-runtime.us-east-1.amazonaws.com",
+      },
+    });
+    expect(log).toBe("[credentials] test failed: connector=fireworks provider=fireworks code=AccessDeniedException requestId=req_stream_456");
+    expect(log).not.toContain(secret);
+    expect(log).not.toContain("bedrock-runtime.us-east-1.amazonaws.com");
+  });
+
+  it("keeps raw save failure messages out of credential logs", async () => {
+    const secret = "sk-proj-savesecret012345678901234";
+    const error = Object.assign(
+      new Error(`save failed for ${secret} at https://api.fireworks.ai/account/acme`),
+      { requestId: "req_save_789" },
+    );
+    const { handlers, logger } = createDeps({
+      store: {
+        save: vi.fn(() => {
+          throw error;
+        }),
+      },
+    });
+    const saveHandler = requireHandler(handlers, IPC_CHANNELS.credentialsSave);
+
+    const result = await saveHandler(null as unknown as IpcMainInvokeEvent, {
+      connectorId: "fireworks",
+      payload: {
+        kind: "api_key",
+        value: { source: "literal", value: secret },
+      },
+    });
+    const log = joinLogCalls(logger.error);
+
+    expect(result).toEqual({
+      ok: false,
+      error: {
+        code: "SAVE_FAILED",
+        message: "Could not save credential. Check application logs for details.",
+      },
+    });
+    expect(log).toBe("[credentials] save failed: connector=fireworks provider=fireworks code=credentials.save.failed requestId=req_save_789");
+    expect(log).not.toContain(secret);
+    expect(log).not.toContain("api.fireworks.ai");
+  });
+
+  it("sanitizes connector ids on remove failure logs", async () => {
+    const connectorId = "unknown\nhttps://api.fireworks.ai/account/sk-proj-remove012345678901234";
+    const { handlers, logger } = createDeps({
+      store: {
+        remove: vi.fn(() => {
+          throw new Error("remove failed for https://api.fireworks.ai/account/sk-proj-remove012345678901234");
+        }),
+      },
+    });
+    const removeHandler = requireHandler(handlers, IPC_CHANNELS.credentialsRemove);
+
+    const result = await removeHandler(null as unknown as IpcMainInvokeEvent, { connectorId });
+    const log = joinLogCalls(logger.error);
+
+    expect(result).toEqual({
+      ok: false,
+      error: {
+        code: "REMOVE_FAILED",
+        message: "Could not remove credential. Check application logs for details.",
+      },
+    });
+    expect(log).toBe("[credentials] remove failed: connector=invalid provider=unknown code=credentials.remove.failed");
+    expect(log).not.toContain("api.fireworks.ai");
+    expect(log).not.toContain("sk-proj-remove012345678901234");
+  });
+
+  it("sanitizes connector ids on unknown connector test logs", async () => {
+    const connectorId = "missing\nhttps://api.fireworks.ai/account/sk-proj-unknown012345678901234";
+    const { handler, logger } = createDeps();
+
+    const result = await handler(null as unknown as IpcMainInvokeEvent, { connectorId });
+    const log = joinLogCalls(logger.error);
+
+    expect(result).toEqual({
+      ok: false,
+      error: {
+        code: "UNKNOWN_CONNECTOR",
+        message: "Unknown connector.",
+      },
+    });
+    expect(log).toBe("[credentials] test failed: connector=invalid provider=unknown code=credentials.test.unknown_connector");
+    expect(log).not.toContain("api.fireworks.ai");
+    expect(log).not.toContain("sk-proj-unknown012345678901234");
+  });
+});