cf80e1fcae
Same shape of bug as the refreshToken duplication: the regex that strips access_token / Bearer headers from logged HTTP bodies existed in three near-identical copies (HasSocialHttpClient trait, TokenRefreshClient, SocialPublishException), drifting subtly — SocialPublishException was missing the JSON "token" pattern. Extracts a TokenRedactor::redact(string) helper and routes all callers through it. Adding a new token format now means one regex in one file.
33 lines
896 B
PHP
33 lines
896 B
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Services\Social;
|
|
|
|
/**
|
|
* Strips OAuth tokens from raw HTTP bodies before they hit logs or
|
|
* exception messages. Centralizes the regex patterns so they evolve in
|
|
* one place — adding a new token format (e.g. provider-specific) means
|
|
* extending this list, not hunting through the codebase.
|
|
*/
|
|
class TokenRedactor
|
|
{
|
|
public static function redact(string $body): string
|
|
{
|
|
return preg_replace(
|
|
[
|
|
'/access_token=([^&"\s]+)/',
|
|
'/"access_token"\s*:\s*"([^"]+)"/',
|
|
'/Bearer\s+\S+/',
|
|
'/"token"\s*:\s*"([^"]+)"/',
|
|
],
|
|
[
|
|
'access_token=[REDACTED]',
|
|
'"access_token":"[REDACTED]"',
|
|
'Bearer [REDACTED]',
|
|
'"token":"[REDACTED]"',
|
|
],
|
|
$body
|
|
);
|
|
}
|
|
}
|