genichinandClaude Opus 4.7
3a78e5c138
- render_service_token_result no longer masks the token field; plaintext tokens are SHA-256 hashed in DB and irrecoverable once lost, so issue/ rotate must reveal them once at issuance (matches interface-contract.md) - Remove now-unused _mask_payload helper; keep mask_token_text for the auxiliary masked_token identifier line - Add one-time reveal warning to issue/rotate table output - 3 regression tests: JSON plaintext assertion, render unit test, table warning - Hotfix Exception Path record: docs/hotfixes/hotfix-001 - Total tests: 369 -> 371 passed Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
22 lines
805 B
Python
22 lines
805 B
Python
"""Output helpers dedicated to auth/bot CLI flows."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from typing import Any
|
|
|
|
from rich.console import Console
|
|
|
|
from app.cli.core.utils import render_output
|
|
from app.core.security import mask_secret
|
|
|
|
|
|
def mask_token_text(raw_token: str) -> str:
|
|
return mask_secret(raw_token, prefix=6, suffix=4)
|
|
|
|
|
|
def render_service_token_result(console: Console, output_format: str, payload: Any) -> None:
|
|
# 발급(issue/rotate) 결과는 평문 토큰을 1회 노출한다. 평문은 hash_token(SHA-256)으로만
|
|
# DB에 저장되어 이후 복구가 불가능하므로, 발급 렌더링 경로에서는 마스킹하지 않는다.
|
|
plain = payload.model_dump(mode="json") if hasattr(payload, "model_dump") else payload
|
|
render_output(console, output_format, plain)
|