mirror of
https://github.com/rommapp/romm.git
synced 2026-10-12 02:21:58 +00:00
Sam DornanandClaude Opus 5.5
3399c736e7
* fix(tests): scrub ScreenScraper dev credentials from VCR cassettes ScreenScraper echoes the full request URL, credentials included, back in its JSON (the header's commandRequested and every media URL). The VCR config had no filters, so four cassettes carried the real devid and devpassword in plain text. vcr_config now masks every key in SENSITIVE_KEYS: filter_query_parameters for request URIs and a before_record_response hook for response bodies. The existing cassettes are scrubbed with the same 30-x placeholder the ssid/sspassword and OAuth cassettes already use, and a guard test fails if any cassette still holds a credential. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(tests): give the VCR scrub helper a typed return for strict mypy Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(tests): redact credential headers when recording VCR cassettes vcr_config now also passes SENSITIVE_KEYS to filter_headers, so a re-record with a real IGDB or SteamGridDB key no longer commits its Authorization or Client-ID header. The existing Authorization values were fake test tokens; they now hold the shared placeholder, and a guard test checks every cassette's request headers. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(tests): match credential keys in VCR bodies case-insensitively SENSITIVE_KEYS_REGEX and strip_sensitive_query_params already ignore case; the body scrubber now does too, so an echoed SSID= or DEVPASSWORD= is masked. Co-Authored-By: Claude Opus 5.5 <[email protected]> --------- Co-authored-by: Claude Opus 5.5 <[email protected]>