Function TestLogQueryErrorCapturesRedactedSecret

server/recent_errors_test.go:47–78

The load-bearing invariant: a failed CREATE SECRET must NOT leak its credential into the Errors-page ring — neither via the stored query nor the error message (engine errors echo the offending SQL). logQueryError redacts both at capture.

(t *testing.T)

// into the Errors-page ring — neither via the stored query nor the error message
// (engine errors echo the offending SQL). logQueryError redacts both at capture.
func TestLogQueryErrorCapturesRedactedSecret(t *testing.T) {
	installFakeQueryTracker(t)
	s := &Server{recentErrors: newRecentErrorRing(0)}
	c := &clientConn{server: s, orgID: "acme", username: "root", pid: 1000, workerID: 42, ctx: context.Background()}

	const cred = "topsecretAKIA"
	query := "CREATE SECRET s (TYPE S3, KEY_ID 'AKIAEXAMPLE', SECRET '" + cred + "')"
	// DuckDB echoes the offending SQL (incl. the literal) in its error text.
	engineErr := errors.New("Parser Error: syntax error at or near \"" + cred + "\"\nLINE 1: " + query)

	c.logQueryError(query, engineErr)

	got := s.RecentErrors(10)
	if len(got) != 1 {
		t.Fatalf("ring len = %d, want 1", len(got))
	}
	e := got[0]
	if strings.Contains(e.Query, cred) {
		t.Errorf("stored Query leaks credential: %q", e.Query)
	}
	if strings.Contains(e.Message, cred) {
		t.Errorf("stored Message leaks credential: %q", e.Message)
	}
	if e.OrgID != "acme" || e.Username != "root" || e.WorkerID != 42 || e.PID != 1000 {
		t.Errorf("metadata not captured: %+v", e)
	}
	// A syntax error is user-attributable (42601); the point of this test is the
	// redaction above — just assert classification was captured.
	if e.Category == "" || e.SQLState == "" {
		t.Errorf("classification missing: category=%q sqlstate=%q", e.Category, e.SQLState)
	}
}

// A non-secret query is stored verbatim (redaction is a no-op) so triage keeps
// full fidelity for ordinary errors.