#213
Pull Requests/monid-ai/monid/#213

fix(testing): redact redirect userinfo and fragments

Opensdivyanshu90wants to merge intofrom
1 commit2 files changed+60-5

Fixes #211.

I removed userinfo and redacted fragments when scrubbing absolute redirect URLs, including URLs without query parameters. Query rewriting now preserves repeated keys and their order while redacting each value. Previously username/password and fragment tokens could remain in recorded Location headers, and repeated query keys collapsed.

Tests exercise queryless userinfo/fragment URLs and the scrubCalls path, checking query multiplicity/order and that caller objects are not mutated. Existing plain-URL and non-URL pass-through checks remain. Relative URL handling and path-embedded values are outside this change.

Validation (Deno 2.9.7):

  • Both regressions fail before the fix; fixture suite: 12 passed, 0 failed.
  • All 251 test modules imported into one temporary shared-process entry point: 1,300 passed, 0 failed, 221 gated live tests ignored. This is not a standard isolated-module deno task test run.
  • deno task check, deno task lint, changed-file deno fmt --check, git diff --check, and deno task version:check --base upstream/main pass.

@ooctoo777, could you review and merge this fix?

Summary by CodeRabbit

  • Bug Fixes
    • URL redaction now removes embedded credentials and hides fragment values, including when a URL has no query string. Query values remain hidden while repeated keys and their order are preserved.
    • Redirect destinations are also covered, while request data and the original input remain unchanged.

Activity

2
S
fix(testing): redact redirect userinfo and fragments
d29e9e1
coderabbitai[bot]4d ago

No actionable comments were generated in the recent review.

Recent review info
Run configuration
Commits

Reviewing files that changed from the base of the PR and between 09d54479142e36eff876383beacfbd37b33b5908 and d29e9e1fe10dafc5692218b22f68badcd4d2e831.

Files selected for processing: 2
  • shared/testing/fixture-size.test.ts
  • shared/testing/fixtures.ts

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 6 remain after this review.

Walkthrough

scrubUrlCredentials now removes URL userinfo, redacts fragments and query values, and preserves repeated query keys and their order. Tests cover URLs without queries, redirect Location values, unchanged requests, and input immutability.

Priority: Normal

Severity of issue fixed: Medium

Merge Risk: Minimal · up to d29e9

No merge-blocking risk was identified in the redirect URL scrubbing change.

Pre-merge checks: 4
Check nameStatusExplanation
Description CheckCheck skipped - CodeRabbit’s high-level summary is enabled.
Title checkThe title clearly summarizes the main change: redacting userinfo and fragments in redirect URLs during testing.
Linked Issues checkIssue #211 requirements are implemented. scrubUrlCredentials removes URL userinfo, replaces non-empty fragments with REDACTED, and rebuilds every query occurrence in its original order with `REDAC…
Out of Scope Changes checkThe changes are limited to scrubUrlCredentials behavior and regression tests in shared/testing/fixture-size.test.ts. They address the absolute response-header URL scope of issue #211. No unrelated…
Full details: Linked Issues check

Explanation

Issue #211 requirements are implemented. scrubUrlCredentials removes URL userinfo, replaces non-empty fragments with REDACTED, and rebuilds every query occurrence in its original order with REDACTED values. scrubCalls applies the helper to response headers and returns copied objects. Added tests cover queryless userinfo and fragment URLs, repeated query keys, the scrubCalls path, and input preservation.

Full details: Out of Scope Changes check

Explanation

The changes are limited to scrubUrlCredentials behavior and regression tests in shared/testing/fixture-size.test.ts. They address the absolute response-header URL scope of issue #211. No unrelated implementation or test changes are shown.

  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.