Repository navigation
fix(feishu): stop logging tenant access token fragments - #4399
Merged
Merged
Conversation
GetTenantAccessToken logged the first 8 and last 4 characters of every issued tenant_access_token at Info level. Keep the refresh event and its expiry, drop all token material. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Refactor client initialization for better readability.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
GetTenantAccessTokenlogs the first 8 and last 4 characters of every freshly issuedtenant_access_tokenat Info level (internal/datasource/connector/feishu/core/client.go,[Feishu] got tenant_access_token: %s...%s). Tenant access tokens are bearer credentials for the whole Feishu app; partial fragments in shared logs narrow brute-force space and are flagged by secret scanners. This PR keeps the refresh event and expiry but drops every token character:Type of Change
Testing
TestTenantAccessTokenNeverAppearsInLogs(fails before the fix): a fake token endpoint returns a long and a 3-character token; the captured log must keepexpire=7200sand contain neither the token nor its 8-character prefix / 4-character suffix, and the cached token must not trigger a second request.go test -race ./internal/datasource/connector/feishu/core/git diff --check origin/main...HEADRelated Issue
None filed; the problem and reproduction are described above.
Checklist
git diff --check origin/main...HEADpassesgofmt -lis clean)golangci-lintwas not available in my environment; I will follow up on any CI lint findings🤖 Generated with Claude Code