wizardchen 86b05d923e fix(middleware): mask camelCase secret fields in request logs ...

The request logger's sanitizeBody only matched lowercase / snake_case
field names (api_key, apikey, access_token, ...), so values for the
camelCase JSON fields actually used by the API (apiKey, secretKey,
refreshToken, accessToken, ...) were written to logs in clear text.

Replace the per-field patterns with a single case-insensitive regex
that tolerates optional `_`/`-` separators, covering snake_case,
camelCase and PascalCase variants, and extend coverage to id_token,
client_secret, private_key, auth_token, api_secret and passwd. The
field name is preserved; only its value is replaced with "***".

Add unit tests for sanitizeBody covering the previously-leaking
camelCase fields and common variants.

Fixes #1287

2026-05-12 19:27:29 +08:00

..

asynqdl

fix(wiki-ingest,asynqdl): review fixups for PR #1241

2026-05-10 00:01:06 +08:00

auth.go

fix(im): rewrite private storage URLs to HTTP in IM channel replies

2026-04-30 11:40:30 +08:00

error_handler.go

init commit

2025-08-05 15:08:07 +08:00

language.go

fix(i18n): use WEKNORA_LANGUAGE env for prompt language fallback instead of hardcoded zh-CN

2026-04-02 12:01:25 +08:00

logger_test.go

fix(middleware): mask camelCase secret fields in request logs

2026-05-12 19:27:29 +08:00

logger.go

fix(middleware): mask camelCase secret fields in request logs

2026-05-12 19:27:29 +08:00

recovery.go

fix: replace standard log with structured logger in main and recovery middleware

2026-02-06 17:59:15 +08:00

trace.go

refactor: Update tenant ID handling across the application

2025-11-25 16:30:54 +08:00