滑动续期、网络错误归类、API Key 激活乐观锁与生效提示

internal/api/ociconfig_test.go

@@ -1,8 +1,14 @@
 package api
 
 import (
+	"bytes"
+	"errors"
 	"fmt"
+	"log"
+	"net/http"
 	"net/http/httptest"
+	"net/url"
+	"strings"
 	"testing"
 
 	"github.com/gin-gonic/gin"
@@ -52,3 +58,30 @@ func TestRespondErrorOCIStatus(t *testing.T) {
 		})
 	}
 }
+
+func TestRespondNetworkErrorHidesProxyCredentials(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	rec := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(rec)
+	c.Request = httptest.NewRequest(http.MethodGet, "/api/v1/oci-configs/1/instances", nil)
+	proxyErr := &url.Error{
+		Op: "Dial", URL: "http://proxy-user:proxy-pass@proxy.example.com:8080",
+		Err: errors.New("connect: connection refused"),
+	}
+	err := &url.Error{Op: "Get", URL: "https://iaas.example.com/instances",
+		Err: fmt.Errorf("proxyconnect tcp: %w", proxyErr)}
+	var logs bytes.Buffer
+	oldWriter := log.Writer()
+	log.SetOutput(&logs)
+	t.Cleanup(func() { log.SetOutput(oldWriter) })
+
+	respondError(c, err)
+	if rec.Code != http.StatusBadGateway || !strings.Contains(logs.String(), "[NET ") {
+		t.Fatalf("response/log = %d %q / %q", rec.Code, rec.Body.String(), logs.String())
+	}
+	for _, output := range []string{rec.Body.String(), logs.String()} {
+		if strings.Contains(output, "proxy-user") || strings.Contains(output, "proxy-pass") {
+			t.Fatalf("proxy credentials leaked: %q", output)
+		}
+	}
+}