fix(audit): remove credentials from URLs before storing audit changes

2026-11-06 13:10:37 -04:00 · 2026-10-06 12:56:57 +02:00
parent 5d20f54f71
commit ecf969e35d
2 changed files with 70 additions and 0 deletions
@@ -0,0 +1,58 @@
+<?php
+
+use App\Models\Application;
+use App\Models\AuditEvent;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Once;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutDefer();
+
+    InstanceSettings::forceCreate(['id' => 0]);
+    Once::flush();
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+});
+
+test('audit changes do not store credentials embedded in the git repository url', function () {
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'git_repository' => 'https://oauth2:glpat-old@token@gitlab.com/org/old.git',
+    ]);
+    AuditEvent::query()->delete();
+
+    $application->update(['git_repository' => 'https://oauth2:glpat-new-token@gitlab.com/org/repo.git']);
+
+    $event = AuditEvent::query()->sole();
+
+    expect($event->changes['git_repository'])->toBe([
+        'old' => 'https://gitlab.com/org/old.git',
+        'new' => 'https://gitlab.com/org/repo.git',
+    ])
+        ->and(json_encode($event->changes))->not->toContain('glpat')
+        ->and(json_encode($event->metadata))->not->toContain('glpat');
+});
+
+test('audit changes keep git repository urls without credentials unchanged', function () {
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $application = Application::factory()->create(['environment_id' => $environment->id]);
+    AuditEvent::query()->delete();
+
+    $application->update(['git_repository' => 'git@github.com:org/repo.git']);
+
+    expect(AuditEvent::query()->sole()->changes['git_repository']['new'])->toBe('git@github.com:org/repo.git');
+});