Merge pull request #254 from githubnext/copilot/sub-pr-253

Author: pelikhan

internal/auth/header.go

@@ -29,6 +29,18 @@ var (
 	ErrInvalidAuthHeader = errors.New("invalid Authorization header format")
 )
 
+// sanitizeForLogging returns a sanitized version of the input string for safe logging.
+// It shows only the first 4 characters followed by "..." to prevent exposing sensitive data.
+// For strings with 4 or fewer characters, it returns only "...".
+func sanitizeForLogging(input string) string {
+	if len(input) > 4 {
+		return input[:4] + "..."
+	} else if len(input) > 0 {
+		return "..."
+	}
+	return ""
+}
+
 // ParseAuthHeader parses the Authorization header and extracts the API key and agent ID.
 // Per MCP spec 7.1, the Authorization header should contain the API key directly
 // without any Bearer prefix or other scheme.
@@ -42,14 +54,7 @@ var (
 //   - agentID: The extracted agent/session identifier
 //   - error: ErrMissingAuthHeader if header is empty, nil otherwise
 func ParseAuthHeader(authHeader string) (apiKey string, agentID string, error error) {
-	// Sanitize header for logging (show only first 4 chars)
-	sanitized := ""
-	if len(authHeader) > 4 {
-		sanitized = authHeader[:4] + "..."
-	} else if len(authHeader) > 0 {
-		sanitized = "..."
-	}
-	log.Printf("Parsing auth header: sanitized=%s, length=%d", sanitized, len(authHeader))
+	log.Printf("Parsing auth header: sanitized=%s, length=%d", sanitizeForLogging(authHeader), len(authHeader))
 
 	if authHeader == "" {
 		log.Print("Auth header missing, returning error")

internal/auth/header_test.go

@@ -4,6 +4,53 @@ import (
 	"testing"
 )
 
+func TestSanitizeForLogging(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  string
+	}{
+		{
+			name:  "Empty string",
+			input: "",
+			want:  "",
+		},
+		{
+			name:  "Single character",
+			input: "a",
+			want:  "...",
+		},
+		{
+			name:  "Four characters",
+			input: "abcd",
+			want:  "...",
+		},
+		{
+			name:  "Five characters",
+			input: "abcde",
+			want:  "abcd...",
+		},
+		{
+			name:  "Long string",
+			input: "my-secret-api-key-12345",
+			want:  "my-s...",
+		},
+		{
+			name:  "API key with Bearer prefix",
+			input: "Bearer my-token-123",
+			want:  "Bear...",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := sanitizeForLogging(tt.input); got != tt.want {
+				t.Errorf("sanitizeForLogging() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
 func TestParseAuthHeader(t *testing.T) {
 	tests := []struct {
 		name        string