Skip to content

fix(feishu): stop logging tenant access token fragments - #4399

Merged
lyingbug merged 2 commits into
Tencent:mainfrom
davien:fix/feishu-token-log
Oct 17, 2026
Merged

lyingbug merged 2 commits into
Tencent:mainfrom
davien:fix/feishu-token-log

Conversation

@davien

@davien davien commented Oct 16, 2026

Copy link
Copy Markdown
Contributor

Description

GetTenantAccessToken logs the first 8 and last 4 characters of every freshly issued tenant_access_token at Info level (internal/datasource/connector/feishu/core/client.go, [Feishu] got tenant_access_token: %s...%s). Tenant access tokens are bearer credentials for the whole Feishu app; partial fragments in shared logs narrow brute-force space and are flagged by secret scanners. This PR keeps the refresh event and expiry but drops every token character:

logger.Infof(ctx, "[Feishu] tenant access token refreshed expire=%ds", result.Expire)

Type of Change

  • 🐛 Bug fix

Testing

  • Added TestTenantAccessTokenNeverAppearsInLogs (fails before the fix): a fake token endpoint returns a long and a 3-character token; the captured log must keep expire=7200s and contain neither the token nor its 8-character prefix / 4-character suffix, and the cached token must not trigger a second request.
  • go test -race ./internal/datasource/connector/feishu/core/
  • git diff --check origin/main...HEAD

Related Issue

None filed; the problem and reproduction are described above.

Checklist

  • git diff --check origin/main...HEAD passes
  • Changed source files are formatted (gofmt -l is clean)
  • Targeted tests for the changed packages/components pass
  • Diff-scoped lint passes where applicable — golangci-lint was not available in my environment; I will follow up on any CI lint findings
  • Full-repository checks were run, or any unrelated/environment-dependent failures are documented above
  • Self-reviewed the code
  • Added/updated tests covering the change
  • Updated related documentation — not needed, no user-facing configuration or API shape changes
  • Breaking changes are clearly called out in the description above (none)

🤖 Generated with Claude Code

davien and others added 2 commits October 16, 2026 22:51
GetTenantAccessToken logged the first 8 and last 4 characters of every
issued tenant_access_token at Info level. Keep the refresh event and its
expiry, drop all token material.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Refactor client initialization for better readability.
@lyingbug
lyingbug merged commit 2c0d838 into Tencent:main Oct 17, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants