Merge pull request #209 from InsForge/feedback/348ab693

fix(current): redact privileged api_key from --json output

Author: tonychang04

src/commands/info.test.ts

@@ -0,0 +1,70 @@
+import { describe, it, expect, vi, beforeEach, type Mock } from 'vitest';
+import { Command } from 'commander';
+import { registerContextCommand } from './info.js';
+
+const PROJECT_CONFIG = {
+  project_id: 'p1',
+  project_name: 'demo',
+  org_id: 'o1',
+  appkey: 'k',
+  region: 'us-east',
+  api_key: 'uak_secret_key',
+  oss_host: 'http://localhost',
+};
+
+vi.mock('../lib/config.js', () => ({
+  getCredentials: vi.fn(() => null),
+  getGlobalConfig: vi.fn(() => ({})),
+  getProjectConfig: vi.fn(),
+}));
+vi.mock('../lib/command-telemetry.js', () => ({
+  trackTopLevelUsage: vi.fn(async () => {}),
+}));
+
+function makeProgram() {
+  const program = new Command().exitOverride();
+  program.option('--json').option('--api-url <url>');
+  registerContextCommand(program);
+  return program;
+}
+
+async function runJson(argv: string[]): Promise<string> {
+  const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+  try {
+    await makeProgram().parseAsync(argv, { from: 'user' });
+    return logSpy.mock.calls.flat().join('\n');
+  } finally {
+    logSpy.mockRestore();
+  }
+}
+
+describe('current command', () => {
+  beforeEach(async () => {
+    vi.clearAllMocks();
+    const { getProjectConfig } = await import('../lib/config.js');
+    (getProjectConfig as Mock).mockReturnValue(PROJECT_CONFIG);
+  });
+
+  it('redacts the privileged api_key from --json output', async () => {
+    const output = await runJson(['current', '--json']);
+
+    const payload = JSON.parse(output);
+    expect(payload.project).toMatchObject({
+      project_id: 'p1',
+      project_name: 'demo',
+      appkey: 'k',
+      region: 'us-east',
+      oss_host: 'http://localhost',
+    });
+    expect(payload.project).not.toHaveProperty('api_key');
+    expect(output).not.toContain('uak_secret_key');
+  });
+
+  it('reports a null project in --json output when no project is linked', async () => {
+    const { getProjectConfig } = await import('../lib/config.js');
+    (getProjectConfig as Mock).mockReturnValue(null);
+
+    const payload = JSON.parse(await runJson(['current', '--json']));
+    expect(payload.project).toBeNull();
+  });
+});

src/commands/info.ts

@@ -18,11 +18,16 @@ export function registerContextCommand(program: Command): void {
         await trackTopLevelUsage('current', true);
 
         if (json) {
+          // Strip the privileged api_key — identity output must not leak
+          // credentials (the human-readable branch already omits it).
+          const project = projectConfig
+            ? (({ api_key: _api_key, ...rest }) => rest)(projectConfig)
+            : null;
           outputJson({
             authenticated: !!creds,
             user: creds?.user ?? null,
             default_org_id: globalConfig.default_org_id ?? null,
-            project: projectConfig,
+            project,
           });
           return;
         }