Fix codeql error on potential credential leak in stack traces

Author: webstackdev

core/api.py

@@ -5,6 +5,7 @@
 generated schema consistent across similar viewsets.
 """
 
+import logging
 from typing import Any
 
 from drf_spectacular.utils import (
@@ -49,6 +50,8 @@
 SUMMARIZATION_SKILL_NAME = "summarization"
 RELATED_CONTENT_SKILL_NAME = "find_related"
 
+logger = logging.getLogger(__name__)
+
 PROJECT_ID_PARAMETER = OpenApiParameter(
     name="project_id",
     type=int,
@@ -630,15 +633,26 @@ def verify_bluesky_credentials(self, request, *args, **kwargs):
         try:
             BlueskySourcePlugin.verify_credentials(credentials)
         except Exception as exc:
-            raise serializers.ValidationError({"bluesky_credentials": str(exc)}) from exc
+            logger.exception(
+                "Bluesky credential verification failed for project id=%s",
+                project.id,
+            )
+            raise serializers.ValidationError(
+                {
+                    "bluesky_credentials": (
+                        "Credential verification failed. Please re-check the credentials "
+                        "and try again."
+                    )
+                }
+            ) from exc
 
         credentials.refresh_from_db()
         return Response(
             {
                 "status": "verified",
                 "handle": credentials.handle,
                 "last_verified_at": credentials.last_verified_at,
-                "last_error": credentials.last_error,
+                "last_error": "",
             }
         )
 

core/plugins/bluesky.py

@@ -244,4 +244,4 @@ def _record_credentials_status(
         if not error_message:
             credentials.last_verified_at = timezone.now()
             update_fields.append("last_verified_at")
-        credentials.save(update_fields=update_fields)
+        credentials.save(update_fields=update_fields)

core/tests/test_api.py

@@ -192,12 +192,16 @@ def test_verify_bluesky_credentials_verifies_project_account(self, verify_mock):
         self.assertEqual(verified_credentials.id, credentials.id)
         self.assertEqual(response.json()["status"], "verified")
         self.assertEqual(response.json()["handle"], "project.bsky.social")
+        self.assertEqual(response.json()["last_error"], "")
 
+    @patch("core.api.logger.exception")
     @patch(
         "core.plugins.bluesky.BlueskySourcePlugin.verify_credentials",
         side_effect=RuntimeError("bad login"),
     )
-    def test_verify_bluesky_credentials_surfaces_verification_errors(self, _verify_mock):
+    def test_verify_bluesky_credentials_surfaces_verification_errors(
+        self, _verify_mock, logger_exception_mock
+    ):
         credentials = BlueskyCredentials(project=self.owner_project, handle="project.bsky.social")
         credentials.set_app_password("app-password")
         credentials.save()
@@ -214,6 +218,11 @@ def test_verify_bluesky_credentials_surfaces_verification_errors(self, _verify_m
         self.assert_standardized_validation_error(
             response.json(), "bluesky_credentials"
         )
+        self.assertNotIn("bad login", str(response.json()))
+        logger_exception_mock.assert_called_once_with(
+            "Bluesky credential verification failed for project id=%s",
+            self.owner_project.id,
+        )
 
     def test_feedback_create_assigns_current_user(self):
         response = self.client.post(

core/tests/test_bluesky.py

@@ -267,4 +267,4 @@ def test_bluesky_verify_credentials_uses_authenticated_session_check(
     client.com.atproto.server.get_session.assert_called_once_with()
     credentials.refresh_from_db()
     assert credentials.last_error == ""
-    assert credentials.last_verified_at is not None
+    assert credentials.last_verified_at is not None