fix(connector): bound compact sensitive key matching

Author: Saga4

crates/locality-connector/src/manifest.rs

@@ -861,22 +861,42 @@ fn is_sensitive_setting_key(key: &str) -> bool {
     }) {
         return true;
     }
-    if segments
-        .windows(2)
-        .any(|pair| matches!(pair, ["api" | "private", "key"]))
-    {
+    if segments.windows(2).any(|pair| {
+        matches!(
+            pair,
+            ["api", "key"]
+                | ["private", "key"]
+                | ["access", "token"]
+                | ["client", "secret"]
+                | ["bearer", "token"]
+        )
+    }) {
         return true;
     }
 
-    let compact = segments.concat();
-    compact.ends_with("token")
-        || compact.ends_with("secret")
-        || compact.ends_with("password")
-        || compact.ends_with("credential")
-        || compact.ends_with("credentials")
-        || compact.ends_with("authorization")
-        || compact.starts_with("bearer")
-        || ["apikey", "privatekey", "secretkey"]
-            .iter()
-            .any(|marker| compact.contains(marker))
+    let [compact] = segments.as_slice() else {
+        return false;
+    };
+    const SENSITIVE_COMPOUNDS: &[&str] = &[
+        "apikey",
+        "privatekey",
+        "accesstoken",
+        "clientsecret",
+        "bearertoken",
+    ];
+    const METADATA_SUFFIXES: &[&str] = &[
+        "value",
+        "id",
+        "ref",
+        "reference",
+        "handle",
+        "path",
+        "file",
+        "name",
+    ];
+    SENSITIVE_COMPOUNDS.iter().any(|compound| {
+        compact
+            .strip_prefix(compound)
+            .is_some_and(|suffix| suffix.is_empty() || METADATA_SUFFIXES.contains(&suffix))
+    })
 }

crates/locality-connector/tests/manifest_contract.rs

@@ -180,20 +180,18 @@ fn sensitive_setting_keys_are_rejected_across_common_naming_styles() {
         "authorizationHeader",
         "credentials",
         "apikey",
-        "serviceapikey",
         "PRIVATEKEY",
-        "privatekeypem",
         "accesstoken",
-        "RefreshTOKEN",
-        "sessiontoken",
         "clientsecret",
-        "SIGNINGSECRET",
-        "databasepassword",
-        "servicecredential",
-        "customauthorization",
-        "bearerheader",
-        "BEARERCREDENTIAL",
-        "secretkey",
+        "bearertoken",
+        "accesstokenvalue",
+        "ACCESSTOKENVALUE",
+        "apikeyid",
+        "privatekeypath",
+        "clientsecrethandle",
+        "bearertokenreference",
+        "access_token_value",
+        "AccessTokenValue",
     ] {
         let mut invalid = registry_value();
         invalid["connectors"][0]["mount"]["default_settings"] = json!({key: "sentinel"});
@@ -218,6 +216,16 @@ fn sensitive_setting_keys_are_rejected_across_common_naming_styles() {
         "accessibility",
         "private_mode",
         "api_latency",
+        "api_keyboard_layout",
+        "private_keynote",
+        "privatekeynote",
+        "PrivateKeynote",
+        "apikeyboard",
+        "accesstokenizer",
+        "clientsecretary",
+        "serviceapikey",
+        "sessiontoken",
+        "databasepassword",
     ] {
         let mut valid = registry_value();
         valid["connectors"][0]["mount"]["default_settings"] = json!({key: true});