// ---------------------------------------------------------------------------// Introspection must not log a credential carried in the query string.//// `query` is a supported credential carrier, so a GraphQL endpoint can be// reached with `?token=<secret>`. Introspection logs the raw failure cause on// any transport error, and every `HttpClientError` renders `${method}// ${request.url}` into its message — so if the request is built from a URL// STRING, the secret is inside that message and goes straight to the log.//// Building the request from a URL OBJECT moves the query into// `request.urlParams`, out of `request.url` and therefore out of the message,// while the client still recombines the two when it executes.//// Both directions are asserted. A test that only checked "the secret is absent"// would pass just as happily against a logger that captured nothing at all, or// a change that stopped sending the parameter entirely.// --------------------------------------------------------------------------- import { describe, expect, it } from "@effect/vitest";import { Cause, Effect, Layer, Logger } from "effect";import { FetchHttpClient } from "effect/unstable/http"; import { GraphqlIntrospectionError } from "./errors";import { introspect } from "./introspect"; const SECRET = "tok_live_introspection_MUST_NOT_LOG";const ENDPOINT = "https://graph.example.test/graphql"; /** Collects everything a logger would have written, message and cause alike — *  `Cause.pretty` is the renderer that rebuilds the first line from the error's *  live `message` getter, which is the exact path the leak took. */const capturingLogger = (sink: Array<string>) =>  Logger.make<unknown, void>((options) => {    sink.push(String(options.message));    sink.push(Cause.pretty(options.cause));  }); /** A fetch that records the URL it was handed and then fails at the transport *  layer, which is what drives introspection down its logging path. */const failingFetch = (seen: Array<string>): typeof globalThis.fetch =>  (async (input: RequestInfo | URL) => {    seen.push(input instanceof Request ? input.url : String(input));    // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: simulates the platform fetch rejecting on a dead host    throw new Error("getaddrinfo ENOTFOUND graph.example.test");  }) as typeof globalThis.fetch; const clientLayer = (seen: Array<string>) =>  FetchHttpClient.layer.pipe(    Layer.provide(Layer.succeed(FetchHttpClient.Fetch)(failingFetch(seen))),  ); describe("GraphQL introspection credential logging", () => {  it.effect("does not write a query-carried credential to the log", () =>    Effect.gen(function* () {      const logged: Array<string> = [];      const seen: Array<string> = [];       yield* introspect(ENDPOINT, undefined, { token: SECRET }).pipe(        Effect.flip,        Effect.provide(clientLayer(seen)),        Effect.provide(Logger.layer([capturingLogger(logged)])),      );       const output = logged.join("\n");       // Positive control FIRST: prove the logger actually captured the failure.      // Without this, an empty capture would satisfy every assertion below.      expect(output).toContain("graphql introspection request failed");      expect(output).toContain("graph.example.test");       // The credential is absent from everything that was logged.      expect(output).not.toContain(SECRET);      expect(output).not.toContain("token=");    }),  );   it.effect("still sends the query-carried credential on the wire", () =>    Effect.gen(function* () {      const logged: Array<string> = [];      const seen: Array<string> = [];       yield* introspect(ENDPOINT, undefined, { token: SECRET }).pipe(        Effect.flip,        Effect.provide(clientLayer(seen)),        Effect.provide(Logger.layer([capturingLogger(logged)])),      );       // Keeping it out of the log is only correct if it still reaches the      // upstream — otherwise this "fix" silently breaks authentication.      expect(seen).toHaveLength(1);      expect(seen[0]).toContain(`token=${SECRET}`);    }),  );   it.effect("keeps a credential carried in the endpoint's own query out of the log", () =>    Effect.gen(function* () {      // A configured endpoint can carry the secret itself, with no separate      // queryParams argument at all.      const logged: Array<string> = [];      const seen: Array<string> = [];       yield* introspect(`${ENDPOINT}?token=${SECRET}`).pipe(        Effect.flip,        Effect.provide(clientLayer(seen)),        Effect.provide(Logger.layer([capturingLogger(logged)])),      );       const output = logged.join("\n");      expect(output).toContain("graphql introspection request failed");      expect(output).not.toContain(SECRET);      expect(seen[0]).toContain(`token=${SECRET}`);    }),  );   it.effect("fails a malformed endpoint instead of dialing it without the query params", () =>    Effect.gen(function* () {      // Only a parseable endpoint can carry the query in `urlParams`. An      // unparseable one must fail rather than quietly dial without the      // credential it was told to send.      const logged: Array<string> = [];      const seen: Array<string> = [];       const error = yield* introspect("not a url", undefined, { token: SECRET }).pipe(        Effect.flip,        Effect.provide(clientLayer(seen)),        Effect.provide(Logger.layer([capturingLogger(logged)])),      );       expect(error).toBeInstanceOf(GraphqlIntrospectionError);      expect(error.reason).toBe("invalid-endpoint");       // Nothing was sent: no request at all, rather than one missing the token.      expect(seen).toHaveLength(0);      // And the rejection itself does not echo the credential anywhere.      expect(Cause.pretty(Cause.fail(error))).not.toContain(SECRET);      expect(logged.join("\n")).not.toContain(SECRET);    }),  );});