Review only: HOUSE-79 upstream v8.0.44, part 13 of 13: everything else

internal/util/github.go

@@ -1,25 +1,12 @@
 package util
 
-import (
-	"os"
-	"strings"
-)
+import "github.com/router-for-me/CLIProxyAPI/v8/internal/githubauth"
 
-// ResolveGitHubToken returns the configured GitHub API token in priority order:
-// 1. GITHUB_TOKEN
-// 2. github_token
-// 3. GITSTORE_GIT_TOKEN (only if GITSTORE_GIT_URL points to github.com)
+// ResolveGitHubToken returns the GitHub API token in priority order:
+// 1. server.github-token
+// 2. GITHUB_TOKEN
+// 3. github_token
+// 4. GITSTORE_GIT_TOKEN (only if GITSTORE_GIT_URL points to github.com)
 func ResolveGitHubToken() string {
-	for _, name := range []string{"GITHUB_TOKEN", "github_token"} {
-		if token := strings.TrimSpace(os.Getenv(name)); token != "" {
-			return token
-		}
-	}
-
-	gitURL := strings.ToLower(strings.TrimSpace(os.Getenv("GITSTORE_GIT_URL")))
-	if !strings.Contains(gitURL, "github.com") {
-		return ""
-	}
-
-	return strings.TrimSpace(os.Getenv("GITSTORE_GIT_TOKEN"))
+	return githubauth.ResolveToken()
 }

internal/util/header_helpers.go

@@ -43,6 +43,24 @@ func HasExplicitSessionID(ctx context.Context) bool {
 // SessionIDResolver is a pluggable resolver for extracting the internal session ID.
 var SessionIDResolver func(ctx context.Context, clientHeaders http.Header) string
 
+// ResolveClientHeaders returns the client request headers from the provided slice
+// or falls back to the Gin request headers in r.Context() when available.
+func ResolveClientHeaders(r *http.Request, clientHeaders ...http.Header) http.Header {
+	if len(clientHeaders) > 0 && clientHeaders[0] != nil {
+		return clientHeaders[0]
+	}
+	if r != nil && r.Context() != nil {
+		ctx := r.Context()
+		if ginCtx, ok := ctx.Value("gin").(*gin.Context); ok && ginCtx != nil && ginCtx.Request != nil {
+			return ginCtx.Request.Header
+		}
+		if ginCtx, ok := ctx.(*gin.Context); ok && ginCtx != nil && ginCtx.Request != nil {
+			return ginCtx.Request.Header
+		}
+	}
+	return nil
+}
+
 // ApplyCustomHeadersFromAttrs applies user-defined headers stored in the provided attributes map.
 // Custom headers override built-in defaults when conflicts occur.
 // If clientHeaders is provided (or if the request context carries a Gin context), any custom header
@@ -55,20 +73,11 @@ func ApplyCustomHeadersFromAttrs(r *http.Request, attrs map[string]string, clien
 	if r == nil {
 		return
 	}
-	var ch http.Header
 	var ctx context.Context
 	if r.Context() != nil {
 		ctx = r.Context()
 	}
-	if len(clientHeaders) > 0 && clientHeaders[0] != nil {
-		ch = clientHeaders[0]
-	} else if ctx != nil {
-		if ginCtx, ok := ctx.Value("gin").(*gin.Context); ok && ginCtx != nil && ginCtx.Request != nil {
-			ch = ginCtx.Request.Header
-		} else if ginCtx, ok := ctx.(*gin.Context); ok && ginCtx != nil && ginCtx.Request != nil {
-			ch = ginCtx.Request.Header
-		}
-	}
+	ch := ResolveClientHeaders(r, clientHeaders...)
 	applyCustomHeaders(r, extractCustomHeaders(attrs, ch, ctx))
 }
 

internal/util/provider.go

@@ -283,7 +283,9 @@ func shouldMaskQueryParam(key string) bool {
 		return false
 	}
 	key = strings.TrimSuffix(key, "[]")
-	if key == "key" || strings.Contains(key, "api-key") || strings.Contains(key, "apikey") || strings.Contains(key, "api_key") {
+	// The management API deletes a client API key by ?value=<key>, so a plain
+	// "value" parameter can carry a full secret into the request log.
+	if key == "key" || key == "value" || strings.Contains(key, "api-key") || strings.Contains(key, "apikey") || strings.Contains(key, "api_key") {
 		return true
 	}
 	if strings.Contains(key, "token") || strings.Contains(key, "secret") {