GeezerVison

Connection URLs and deserializer messages can include credentials. Give
callers helpers that remove URL userinfo, query strings and fragments,
and describe configuration failures without copying rejected values or
map keys. The latter keeps the error category and the schema-defined
parts of serde's message, such as the expected values; callers supply
endpoint identity and source positions separately.

Test URL credentials, repeated URLs, rejected scalars and fields, and
custom deserializer errors. The following commits use these helpers at
the emission sites.

Related: feldera/cloud#2136

Signed-off-by: Xavier Bestel <[email protected]>

The Postgres input connector put the resolved connection URI into its
connect error and into two log lines. The URI holds the password, also
when the user supplied it as a Kubernetes Secret reference, because the
connector sees the resolved value. The error reached the pipeline log,
deployment_error, the monitor events and the support bundle, where any
user with read access to the pipeline could read the password.

Show the hosts, ports and database instead, parsed with
tokio_postgres::Config, and nothing when the URI does not parse. The
endpoint name in the error already identifies the connector.

Part of feldera/cloud#2136.

Signed-off-by: Xavier Bestel <[email protected]>

The pipeline printed its whole configuration on startup, before it
resolved secret references and before the logger was up. Inline
connector options such as sasl.password, environment values and storage
sync keys went to the pipeline log and from there to the support bundle.

Print one line per endpoint with its stream, transport and format names,
a reviewed list of runtime fields, the storage backend name and the
environment variable names. A field that is not on the list stays out,
so a new field that holds a secret is safe by default.

Part of feldera/cloud#2136.

Signed-off-by: Xavier Bestel <[email protected]>

A malformed connectors property was copied into the compile error.
Deserializer reasons could also echo a rejected scalar containing an
inline credential, even after the whole property was omitted.

Preserve the relation, property, source position, and JSON line/column.
Replace the property value with [REDACTED] and report a safe error
category and corrective action. Test malformed JSON and rejected
scalars in both displayed and serialized errors.

Related: feldera/cloud#2136

Signed-off-by: Xavier Bestel <[email protected]>

The Delta input connector put the table URI into its errors. A URI can
carry credentials in its userinfo or a signed-URL token in its query
string.

Strip both before formatting. A local path shows as is; a string that
does not parse and holds either part shows as [REDACTED].

Part of feldera/cloud#2136.

Signed-off-by: Xavier Bestel <[email protected]>

When librdkafka rejects a client option, rdkafka's error carries the
option's value and repeats it in the description. The connectors turned
that error into text with {e}, so a rejected sasl.password, inline or
resolved from a Secret reference, went to the pipeline log and to
deployment_error.

Map the error at every client construction: name the option, keep the
description with the value masked, drop the value.

Part of feldera/cloud#2136.

Signed-off-by: Xavier Bestel <[email protected]>

Format configurations can contain resolved secret values. Both the
configuration dump and serde's rejected scalar or map key exposed those
values through initialization errors. Short secrets also bypass the
runtime registry, so the source must be safe independently.

Keep the endpoint identity, error code, and serialized field types.
Replace the configuration with [REDACTED] and describe the failure using
a fixed category and corrective action. Test parser and encoder errors
with rejected scalar values, fields, and enum variants.

Related: feldera/cloud#2136

Signed-off-by: Xavier Bestel <[email protected]>

The Kafka input and output connectors, the Avro encoder and the
controller printed a connector's complete config with {:?} at debug
level. For Kafka and Avro this is the resolved config, so a password
supplied as a Kubernetes Secret reference was in the log as soon as a
pipeline author set runtime_config.logging to debug.

Print the endpoint, topic and transport names instead. Give the Kafka
configs and the Avro schema registry config a Debug implementation that
names the options and headers and hides their values, so a later {:?}
of these types stays safe.

Part of feldera/cloud#2136.

Signed-off-by: Xavier Bestel <[email protected]>

The pipeline reports a configuration file that does not deserialize with
serde's message, which quotes the rejected token. A credential in a
wrong-shaped field, such as a NATS `credentials` given as a plain string,
is rejected here before any redaction can run, so the value reached the
startup error and `deployment_error`.

Keep the error category, the expected values and the line and column,
and drop the token, with the helper the other configuration errors use.

Related: feldera/cloud#2136
Signed-off-by: Xavier Bestel <[email protected]>

Jackson quotes an unrecognized token in full: a 'connectors' value
like "password": hunter2 gave "Unrecognized token 'hunter2'". The
token can be an inline credential, and the message is stored in the
program error, so the value also reached the support bundle. A bundle
collected without source code drops the SQL excerpt, but it kept this
message.

Drop the quoted token from the message. The source position and the
excerpt still point at the bad text.

Related: feldera/cloud#2136
Signed-off-by: Xavier Bestel <[email protected]>