Function TestConfigEndpoint_SecretsMasked

pkg/cortex/modules_test.go:256–287

(t *testing.T)

}

func TestConfigEndpoint_SecretsMasked(t *testing.T) {
	cfg := newDefaultConfig()

	// Use reflection to find every flagext.Secret field in the config and set
	// it to a sentinel value. This ensures newly added Secret fields are
	// automatically covered without updating this test.
	sentinel := "LEAKED_SECRET_VALUE"
	setAllSecrets(reflect.ValueOf(cfg), sentinel)

	cortex := &Cortex{
		Server: &server.Server{},
		Cfg:    *cfg,
	}
	cortex.Server.HTTP = mux.NewRouter()

	_, err := cortex.initAPI()
	require.NoError(t, err)

	req := httptest.NewRequest("GET", "/config", nil)
	resp := httptest.NewRecorder()
	cortex.Server.HTTP.ServeHTTP(resp, req)

	require.Equal(t, 200, resp.Code)

	body := resp.Body.String()

	// Verify the sentinel never appears in cleartext.
	assert.NotContains(t, body, sentinel, "a flagext.Secret value was leaked in /config output")

	// Verify at least one masked value is present (sanity check).
	assert.Contains(t, body, "********", "expected masked secrets in /config output")
}

// TestConfig_SensitiveFieldTypes verifies that every struct field in Config
// whose YAML tag name suggests a credential uses flagext.Secret, not string.