feat: redact auth tokens in logs and error messages

[Copilot]

Auth tokens were exposed in HTTP request/response logs and in error messages from failed HTTP operations (where Go's http library includes the full URL with query parameters).

Changes

• Added redactAuthToken() utility - Regex-based redaction replacing auth_token values with *** in URLs and form data. Regex patterns compiled once at package init for efficiency.

• Added redactError() helper - Wraps error objects to redact tokens before display.

• Updated logging functions - LogRequest() and LogResponse() now redact before writing to log files.

• Updated error printing - All error output in main.go (22 instances across all commands) now uses redactError() instead of direct %v formatting.

Example

Before:

Error: Get "https://api.beeminder.com/goals.json?auth_token=abc123": connection failed

After:

Error: Get "https://api.beeminder.com/goals.json?auth_token=***": connection failed

Tests added for redaction logic and logging behavior.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• invalid-hostname-that-does-not-exist.example.com
  • Triggering command: /tmp/go-build836282665/b001/exe/test_http_error /tmp/go-build836282665/b001/exe/test_http_error (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

When outputting error messages we need to make sure to redact the user's auth token

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

🚀 Pre-release Build Ready

Test builds are ready! Install directly using the bin command:

# Install the pre-release
bin install https://github.com/PinePeakDigital/buzz/releases/tag/pr-199-latest buzz-pr-199

# Run the pre-release
buzz-pr-199

# Uninstall the pre-release
bin remove buzz-pr-199

Direct Download Links

Or download binaries directly from the pre-release page:

• Linux AMD64
• Linux ARM64
• macOS Intel
• macOS Apple Silicon
• Windows AMD64
• Windows ARM64

💡 No GitHub login required for downloads!

🗑️ This pre-release will be automatically deleted when the PR is closed.

[Copilot]

Pull request overview

This PR implements comprehensive redaction of authentication tokens from logs and error messages to prevent accidental credential exposure. The implementation uses efficient pre-compiled regex patterns and has been thoroughly tested.

Key Changes

• Added regex-based redactAuthToken() utility function to replace auth_token values with *** in URLs and form data
• Updated all 22 error message outputs across commands to use redactError() wrapper
• Modified HTTP logging functions to redact tokens before writing to log files

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
utils.go	Added redactAuthToken() and redactError() functions with pre-compiled regex patterns for efficient token redaction
utils_test.go	Added comprehensive test coverage for redaction logic including edge cases like multiple occurrences, special characters, and error messages
config.go	Updated LogRequest() and LogResponse() to redact auth tokens from URLs before logging
config_test.go	Added integration tests verifying that auth tokens are properly redacted in log files
main.go	Updated all error output statements (22 instances) to use redactError() instead of direct error formatting