ZacharyZhang-NYandClaude
bd68382921
Passwords and refresh tokens go only to the system keychain; a refused keychain keeps them in memory until exit and says why. Gmail and Microsoft sign in by authorization code with S256 PKCE on a loopback redirect; refresh tokens are kept, and revoked grants ask to sign in again. Client IDs come from the build (env or oauth.env). ureq trace records never reach the log. Co-Authored-By: Claude <noreply@anthropic.com>
859 B
859 B
FAIL
- crates/ely-mail-engine/src/oauth/token.rs:81 — [P1] 读取令牌回复时，ureq-proto 会在 trace 级别逐字节记录整个 JSON，访问令牌与刷新令牌因此进入普通诊断日志，违反 §18.2 与 agents.md 的日志规则。复现：以
ELY_LOG=trace初始化真实的ely_platform::logging，调用实际oauth::refresh，替身端点返回ACCESSMARKER与ROTATEDMARKER；两者均出现在ely.log（.work/C12.4-r2/oauth-logger/ely.log，核对输出在actual-logger.log）。换码同样经过此读取路径；现有日志隐私测试只跑邮件协议，没有覆盖 OAuth，所以 Windows 97 个、Linux 94 个测试全部通过仍未发现泄漏。修复方向：阻止 HTTP 库在任何日志级别记录令牌回复的敏感载荷，并以真实日志器补测换码与刷新的令牌不进入日志。