Merge pull request #762 from Keengfk/fix/debug-secret-redaction

fix: redact secrets from debug diagnostic payloads

Author: ritik4ever

backend/src/api/debug.routes.ts

@@ -125,7 +125,6 @@ debugRouter.get('/debug/reflector-test', blockDebugInProduction, async (req: Req
             environment: {
                 nodeEnv: global.process.env.NODE_ENV,
                 apiKeySet: !!global.process.env.COINGECKO_API_KEY,
-                apiKeyLength: global.process.env.COINGECKO_API_KEY?.length || 0
             }
         }
         return ok(res, redactObject(response))

backend/src/test/debug.routes.test.ts

@@ -0,0 +1,87 @@
+import { describe, it, expect, beforeAll, vi } from 'vitest'
+import express, { Express } from 'express'
+import request from 'supertest'
+
+// Enable debug routes for all tests in this file
+vi.mock('../config/featureFlags.js', () => ({
+    getFeatureFlags: () => ({ enableDebugRoutes: true })
+}))
+
+// Mock requireAdmin to pass through
+vi.mock('../middleware/auth.js', () => ({
+    requireAdmin: (_req: any, _res: any, next: any) => next()
+}))
+
+// Mock adminRateLimiter to pass through
+vi.mock('../middleware/rateLimit.js', () => ({
+    adminRateLimiter: (_req: any, _res: any, next: any) => next()
+}))
+
+// Mock reflector service — factory must be self-contained (vi.mock is hoisted)
+vi.mock('../services/reflector.js', () => {
+    const instance = {
+        clearCache: () => undefined,
+        getCacheStatus: () => ({ cached: false }),
+        getCurrentPricesWithMeta: async () => ({ prices: { XLM: 0.1 }, feedMeta: {} }),
+        testApiConnectivity: async () => ({ ok: true }),
+    }
+    return { ReflectorService: function () { return instance } }
+})
+
+// Mock runtimeServices
+vi.mock('../services/runtimeServices.js', () => ({
+    autoRebalancer: null
+}))
+
+// Mock portfolioStorage
+vi.mock('../services/portfolioStorage.js', () => ({
+    portfolioStorage: { getPortfolioCount: async () => 0 }
+}))
+
+// Mock notificationService
+vi.mock('../services/notificationService.js', () => ({
+    notificationService: {
+        getPreferences: () => ({
+            emailEnabled: true,
+            emailAddress: 'user@example.com',
+            webhookEnabled: true,
+            webhookUrl: 'https://hooks.example.com/secret-token',
+        }),
+        notify: async () => undefined,
+    }
+}))
+
+let app: Express
+
+beforeAll(async () => {
+    app = express()
+    app.use(express.json())
+    const { debugRouter } = await import('../api/debug.routes.js')
+    app.use('/api', debugRouter)
+})
+
+describe('debug routes — secret redaction', () => {
+    it('GET /debug/coingecko-test does not expose testUrl', async () => {
+        const res = await request(app).get('/api/debug/coingecko-test')
+        expect(res.status).toBe(200)
+        expect(res.body.data).not.toHaveProperty('testUrl')
+        expect(res.body.data).toHaveProperty('apiKeySet')
+        expect(res.body.data).toHaveProperty('responseStatus')
+    })
+
+    it('GET /debug/reflector-test does not expose apiKeyLength', async () => {
+        const res = await request(app).get('/api/debug/reflector-test')
+        expect(res.status).toBe(200)
+        expect(res.body.data.environment).not.toHaveProperty('apiKeyLength')
+        expect(res.body.data.environment).toHaveProperty('apiKeySet')
+    })
+
+    it('POST /debug/notifications/test redacts email and webhook in sentTo', async () => {
+        const res = await request(app)
+            .post('/api/debug/notifications/test')
+            .send({ userId: 'GUSER123', eventType: 'rebalance' })
+        expect(res.status).toBe(200)
+        expect(res.body.data.sentTo.email).toBe('[REDACTED]')
+        expect(res.body.data.sentTo.webhook).toBe('[REDACTED]')
+    })
+})

backend/src/test/secretRedactor.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import { redactObject } from '../utils/secretRedactor.js'
+import { redactObject, redactString } from '../utils/secretRedactor.js'
 
 describe('secretRedactor', () => {
     it('redacts authorization header values', () => {
@@ -72,4 +72,40 @@ describe('secretRedactor', () => {
         expect(output.arrayValues[1].asset).toBe('XLM')
         expect(output.request.meta.retries).toBe(2)
     })
+
+    it('redacts webhookUrl and webhook fields', () => {
+        const input = {
+            sentTo: {
+                webhookUrl: 'https://hooks.example.com/secret-token',
+                webhook: 'https://hooks.example.com/other-token',
+            },
+        }
+        const output = redactObject(input)
+        expect((output.sentTo as any).webhookUrl).toBe('[REDACTED]')
+        expect((output.sentTo as any).webhook).toBe('[REDACTED]')
+    })
+
+    it('redacts email address fields', () => {
+        const input = { emailAddress: 'user@example.com', smtpUser: 'smtp@example.com', smtpPass: 'hunter2' }
+        const output = redactObject(input)
+        expect((output as any).emailAddress).toBe('[REDACTED]')
+        expect((output as any).smtpUser).toBe('[REDACTED]')
+        expect((output as any).smtpPass).toBe('[REDACTED]')
+    })
+
+    it('redacts Bearer tokens in strings', () => {
+        expect(redactString('Authorization: Bearer abc123xyz')).toBe('Authorization: Bearer [REDACTED]')
+        expect(redactString('no token here')).toBe('no token here')
+    })
+
+    it('redacts Stellar secret keys in strings', () => {
+        // Valid Stellar secret key: S + 55 chars from base32 alphabet [A-Z2-7]
+        const stellarSecret = 'SABCDEFGHIJKLMNOPQRSTUVWXYZ234567ABCDEFGHIJKLMNOPQRSTUVW'
+        expect(redactString(stellarSecret)).toBe('[REDACTED]')
+    })
+
+    it('redacts API keys in query params', () => {
+        const url = 'https://api.example.com/data?api_key=supersecret&foo=bar'
+        expect(redactString(url)).toBe('https://api.example.com/data?api_key=[REDACTED]&foo=bar')
+    })
 })

backend/src/utils/secretRedactor.ts

@@ -9,6 +9,8 @@ const STELLAR_SECRET_REGEX = /S[A-Z2-7]{55}/g;
 const CG_API_KEY_REGEX = /c?g-[a-zA-Z0-9_-]{10,}/g;
 // Matches general query parameter API keys: ?api_key=SECRET or &apikey=SECRET or ?x_cg_pro_api_key=SECRET
 const QUERY_PARAM_KEY_REGEX = /([?&](?:api_key|apikey|x_cg_pro_api_key|x_cg_demo_api_key)=)[^&]+/gi;
+// Matches Bearer tokens in Authorization header values
+const BEARER_TOKEN_REGEX = /\bBearer\s+\S+/gi;
 
 const REDACTED_HINT = '[REDACTED]';
 
@@ -53,7 +55,9 @@ export function redactString(str: string): string {
         // Redact explicit CoinGecko Keys if identifiable
         .replace(CG_API_KEY_REGEX, REDACTED_HINT)
         // Redact keys in URLs
-        .replace(QUERY_PARAM_KEY_REGEX, `$1${REDACTED_HINT}`);
+        .replace(QUERY_PARAM_KEY_REGEX, `$1${REDACTED_HINT}`)
+        // Redact Bearer tokens
+        .replace(BEARER_TOKEN_REGEX, `Bearer ${REDACTED_HINT}`);
 
     return redacted;
 }