fix(opencode): redact secrets from config responses

2026-06-24 16:27:09 -05:00
parent 4b83f5d8f0
commit c44ef334e4
4 changed files with 160 additions and 2 deletions
@@ -64,6 +64,93 @@ describe("config HttpApi", () => {
    }),
  )

+  it.live(
+    "redacts resolved provider and MCP secrets",
+    Effect.gen(function* () {
+      const secrets = [
+        "CANARY_PROVIDER_API_KEY",
+        "CANARY_PROVIDER_CLIENT_SECRET",
+        "CANARY_PROVIDER_NESTED_TOKEN",
+        "CANARY_MCP_ENV",
+        "CANARY_MCP_HEADER",
+        "CANARY_MCP_CLIENT_SECRET",
+      ]
+      const tmp = yield* tmpdirEffect({
+        init: (dir) =>
+          Promise.all(secrets.map((secret, index) => Bun.write(path.join(dir, `secret-${index}`), secret))),
+        config: {
+          formatter: false,
+          lsp: false,
+          provider: {
+            canary: {
+              name: "Canary Provider",
+              options: {
+                apiKey: "{file:secret-0}",
+                clientSecret: "{file:secret-1}",
+                nested: { accessToken: "{file:secret-2}", temperature: 0.5 },
+                baseURL: "https://provider.example.com",
+              },
+            },
+          },
+          mcp: {
+            local: {
+              type: "local",
+              command: ["canary-command"],
+              environment: { TOKEN: "{file:secret-3}" },
+              enabled: false,
+            },
+            remote: {
+              type: "remote",
+              url: "https://mcp.example.com",
+              headers: { Authorization: "{file:secret-4}" },
+              oauth: { clientId: "canary-client", clientSecret: "{file:secret-5}", scope: "read" },
+              enabled: false,
+            },
+          },
+        },
+      })
+
+      const response = yield* Effect.promise(() =>
+        Promise.resolve(
+          app().request("/config", {
+            headers: {
+              "x-opencode-directory": tmp.path,
+            },
+          }),
+        ),
+      )
+      const text = yield* Effect.promise(() => response.text())
+      const body = JSON.parse(text)
+
+      expect(response.status).toBe(200)
+      secrets.forEach((secret) => expect(text).not.toContain(secret))
+      expect(body).toMatchObject({
+        provider: {
+          canary: {
+            name: "Canary Provider",
+            options: {
+              apiKey: "[redacted]",
+              clientSecret: "[redacted]",
+              nested: { accessToken: "[redacted]", temperature: 0.5 },
+              baseURL: "https://provider.example.com",
+            },
+          },
+        },
+        mcp: {
+          local: {
+            command: ["canary-command"],
+            environment: { TOKEN: "[redacted]" },
+          },
+          remote: {
+            url: "https://mcp.example.com",
+            headers: { Authorization: "[redacted]" },
+            oauth: { clientId: "canary-client", clientSecret: "[redacted]", scope: "read" },
+          },
+        },
+      })
+    }),
+  )
+
  it.live(
    "serves config with active provider model status",
    Effect.gen(function* () {