Code sync, security fixes

internal/api/health_test.go

@@ -0,0 +1,44 @@
+package api
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+// The readiness probe is unauthenticated. MongoDB's driver errors embed the
+// topology — host, port, and, when the connection string carries them,
+// credentials — so the raw error must never reach the response body.
+func TestReadinessDoesNotEchoDependencyErrorText(t *testing.T) {
+	secret := "mongodb://relata:sup3rs3cr3t@db.internal:27017/relata?authSource=admin"
+	h := &HealthChecker{
+		Mongo: func(context.Context) error {
+			return fmt.Errorf("server selection error: current topology: { Servers: [{ Addr: %s }] }", secret)
+		},
+		Version: "test",
+		Started: time.Now(),
+	}
+
+	w := httptest.NewRecorder()
+	h.Ready(w, httptest.NewRequest(http.MethodGet, "/health/ready", nil))
+	body := w.Body.String()
+
+	for _, leak := range []string{"sup3rs3cr3t", "db.internal", "27017", "authSource", "topology"} {
+		if strings.Contains(body, leak) {
+			t.Fatalf("readiness response leaks %q from the driver error:\n%s", leak, body)
+		}
+	}
+
+	// It must still report the failure clearly.
+	if w.Code != http.StatusServiceUnavailable {
+		t.Fatalf("status = %d, want %d when a required dependency is down",
+			w.Code, http.StatusServiceUnavailable)
+	}
+	if !strings.Contains(body, "unavailable") {
+		t.Fatalf("readiness hid the failure entirely:\n%s", body)
+	}
+}