Censor domain authcode by default in tools

When inspecting domain entities with tools like GetDomainCommand, displaying
plaintext authentication codes is unnecessary and presents a security risk
for credential exposure in logs and bug ticket comments (b/537293980).

This commit modifies GetDomainCommand to override printResource, masking any
sensitive password strings with [REDACTED] in the output string while preserving
entity immutability. An optional --show_authcode flag with arity 1 is introduced
to explicitly display authcodes when required for transfer authorization.

BUG= http://b/537293980

Author: CydeWeys

core/src/main/java/google/registry/tools/GetDomainCommand.java

@@ -18,6 +18,7 @@
 
 import com.beust.jcommander.Parameter;
 import com.beust.jcommander.Parameters;
+import google.registry.model.EppResource;
 import google.registry.model.ForeignKeyUtils;
 import google.registry.model.domain.Domain;
 import google.registry.persistence.transaction.QueryComposer.Comparator;
@@ -32,6 +33,12 @@ final class GetDomainCommand extends GetEppResourceCommand {
   @Parameter(names = "--show_deleted", description = "Include deleted domains in the print out")
   private boolean showDeleted = false;
 
+  @Parameter(
+      names = "--show_authcode",
+      description = "Include domain authentication code in output",
+      arity = 1)
+  private boolean showAuthcode = false;
+
   @Parameter(
       description = "Fully qualified domain name(s)",
       required = true)
@@ -61,4 +68,22 @@ public void runAndPrint() {
       }
     }
   }
+
+  @Override
+  void printResource(
+      String resourceType, String uniqueId, Optional<? extends EppResource> resource) {
+    if (resource.isEmpty() || showAuthcode || !(resource.get() instanceof Domain domain)) {
+      super.printResource(resourceType, uniqueId, resource);
+      return;
+    }
+    String output = expand ? domain.toHydratedString() : domain.toString();
+    if (domain.getAuthInfo() != null && domain.getAuthInfo().getPw() != null) {
+      String secret = domain.getAuthInfo().getPw().getValue();
+      if (secret != null && !secret.isEmpty()) {
+        output = output.replace("value=" + secret, "value=[REDACTED]");
+      }
+    }
+    System.out.println(
+        String.format("%s\n\nWebsafe key: %s", output, domain.createVKey().stringify()));
+  }
 }

core/src/test/java/google/registry/tools/GetDomainCommandTest.java

@@ -24,6 +24,8 @@
 import static org.junit.jupiter.api.Assertions.assertThrows;
 
 import com.beust.jcommander.ParameterException;
+import google.registry.model.domain.DomainAuthInfo;
+import google.registry.model.eppcommon.AuthInfo.PasswordAuth;
 import google.registry.testing.DatabaseHelper;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -136,4 +138,28 @@ void testSuccess_printsEntireDomainHistory() throws Exception {
     // Deleted
     assertInStdout("Websafe key: kind:Domain@sql:rO0ABXQABTMtVExE");
   }
+
+  @Test
+  void testSuccess_censorsAuthcodeByDefault() throws Exception {
+    persistResource(
+        DatabaseHelper.newDomain("example.tld")
+            .asBuilder()
+            .setAuthInfo(DomainAuthInfo.create(PasswordAuth.create("secret123")))
+            .build());
+    runCommand("example.tld");
+    assertInStdout("value=[REDACTED]");
+    assertNotInStdout("secret123");
+  }
+
+  @Test
+  void testSuccess_showAuthcode() throws Exception {
+    persistResource(
+        DatabaseHelper.newDomain("example.tld")
+            .asBuilder()
+            .setAuthInfo(DomainAuthInfo.create(PasswordAuth.create("secret123")))
+            .build());
+    runCommand("example.tld", "--show_authcode=true");
+    assertInStdout("value=secret123");
+    assertNotInStdout("[REDACTED]");
+  }
 }