fix: redact bot secrets in startup logs

2026-04-23 20:28:52 +03:00
parent 1c4cfb71c0
commit 9e7a202f42
3 changed files with 86 additions and 2 deletions
@@ -0,0 +1,47 @@
+using System.Text.RegularExpressions;
+using Npgsql;
+
+namespace GmRelay.Bot.Infrastructure.Logging;
+
+public static partial class SecretRedactor
+{
+    public static string RedactConnectionString(string? connectionString)
+    {
+        if (string.IsNullOrWhiteSpace(connectionString))
+        {
+            return string.Empty;
+        }
+
+        try
+        {
+            var builder = new NpgsqlConnectionStringBuilder(connectionString);
+            if (!string.IsNullOrWhiteSpace(builder.Password))
+            {
+                builder.Password = "***";
+            }
+
+            return builder.ToString();
+        }
+        catch (ArgumentException)
+        {
+            return RedactText(connectionString);
+        }
+    }
+
+    public static string RedactText(string? text)
+    {
+        if (string.IsNullOrWhiteSpace(text))
+        {
+            return string.Empty;
+        }
+
+        return SecretKeyValueRegex().Replace(
+            text,
+            static match => $"{match.Groups["key"].Value}={GetRedactedValue()}");
+    }
+
+    private static string GetRedactedValue() => "***";
+
+    [GeneratedRegex(@"(?<key>password|pwd|passwd|token|secret|api[-_]?key)\s*=\s*(?<value>[^;\s,]+)", RegexOptions.IgnoreCase | RegexOptions.CultureInvariant)]
+    private static partial Regex SecretKeyValueRegex();
+}