oxy config never prints a secret whole 8e9c64d16ded

/// Whether a configuration key holds a secret, never to be printed.

fn secret_key(key: &str) -> bool {

    let k = key.to_ascii_lowercase();

    k.ends_with(".token") || k.contains("secret") || k.contains("password")

}

/// A secret as a confirmation may show it (oxygen#113): enough of its start

/// to tell which one it is, never the rest.

fn mask(value: &str) -> String {

    let shown: String = value.chars().take(10).collect();

    let rest = value.chars().count().saturating_sub(10);

    if rest == 0 {

        "…".to_string()

    } else {

        format!("{shown}…({rest} more)")

    }

}

    // `-` reads the value from standard input, so a token never sits in

    // the shell's history (oxygen#113).

    let read;

    let value = if unset {

        ""

    } else if value == "-" {

        let mut line = String::new();

        std::io::stdin().read_line(&mut line)?;

        read = line.trim().to_string();

        read.as_str()

    } else {

        value

    };

    } else if secret_key(key) {

        format!("{} {key} = {}", ui::done("Set"), mask(value))

}

#[cfg(test)]

mod tests {

    #[test]

    fn secrets_are_never_printed_whole() {

        assert!(

            super::secret_key("remote.earth.token")

                && super::secret_key("auth.secret")

                && !super::secret_key("remote.earth.url")

        );

        assert_eq!(

            super::mask("oxyhub_6b7dce13409b634d"),

            "oxyhub_6b7…(13 more)"

        );

        assert_eq!(super::mask("short"), "…");

    }

        /// The value to set (none with --unset); `-` reads it from standard input, out of the shell's history