22 lines
767 B
Go
22 lines
767 B
Go
|
package service
|
||
|
|
|
||
|
|
// SanitizeStoredCredentials strips secrets that must never be persisted on the
|
||
|
|
// account credentials map after conversion to OAuth tokens (Grok Web SSO / password).
|
||
|
|
// Call from admin create/update/import/apply-oauth paths.
|
||
|
|
//
|
||
|
|
// Cookie is always stripped: bulk paths may pass an empty platform label, and
|
||
|
|
// session-jar residue must never sit next to OAuth tokens on any platform.
|
||
|
|
// The platform argument is retained for call-site clarity / future scrubbing.
|
||
|
|
func SanitizeStoredCredentials(platform string, creds map[string]any) map[string]any {
|
||
|
|
if creds == nil {
|
||
|
|
return nil
|
||
|
|
}
|
||
|
|
_ = platform
|
||
|
|
for _, key := range []string{
|
||
|
|
"password", "sso_token", "sso", "sso-rw", "clearTextPassword", "cookie",
|
||
|
|
} {
|
||
|
|
delete(creds, key)
|
||
|
|
}
|
||
|
|
return creds
|
||
|
|
}
|