quotation service fixed

api/pkg/messaging/internal/natsb/broker.go

@@ -34,40 +34,108 @@ type envConfig struct {
 }
 
 const defaultConsumerBufferSize = 1024
+const redactedNATSPassword = "xxxxx"
 
-func sanitizeNATSURL(rawURL string) string {
+func buildSafePublishableNATSURL(rawURL string) string {
 	if rawURL == "" {
 		return rawURL
 	}
 
 	parts := strings.Split(rawURL, ",")
-	sanitized := make([]string, 0, len(parts))
+	safe := make([]string, 0, len(parts))
 	for _, part := range parts {
 		trimmed := strings.TrimSpace(part)
 		if trimmed == "" {
 			continue
 		}
-		if !strings.Contains(trimmed, "://") {
-			sanitized = append(sanitized, trimmed)
+		built, ok := buildSafePublishableNATSEntry(trimmed)
+		if !ok {
+			safe = append(safe, trimmed)
 			continue
 		}
-
-		parsed, err := url.Parse(trimmed)
-		if err != nil {
-			sanitized = append(sanitized, trimmed)
-			continue
-		}
-		if parsed.User == nil {
-			sanitized = append(sanitized, trimmed)
-			continue
-		}
-		sanitized = append(sanitized, parsed.Redacted())
+		safe = append(safe, built)
 	}
 
-	if len(sanitized) == 0 {
+	if len(safe) == 0 {
 		return strings.TrimSpace(rawURL)
 	}
-	return strings.Join(sanitized, ",")
+	return strings.Join(safe, ",")
+}
+
+func buildSafePublishableNATSEntry(raw string) (string, bool) {
+	parsed, err := url.Parse(raw)
+	if err == nil && parsed.Host != "" {
+		safe := &url.URL{
+			Scheme:   parsed.Scheme,
+			Host:     parsed.Host,
+			Path:     parsed.Path,
+			RawPath:  parsed.RawPath,
+			RawQuery: parsed.RawQuery,
+			Fragment: parsed.Fragment,
+		}
+		if safe.Scheme == "" {
+			safe.Scheme = "nats"
+		}
+		if parsed.User != nil {
+			username := parsed.User.Username()
+			if username == "" {
+				username = redactedNATSPassword
+			}
+			safe.User = url.UserPassword(username, redactedNATSPassword)
+		}
+		return safe.String(), true
+	}
+
+	return buildSafePublishableFromAuthority(raw)
+}
+
+func buildSafePublishableFromAuthority(raw string) (string, bool) {
+	scheme := "nats"
+	authorityAndSuffix := raw
+	if schemeIndex := strings.Index(raw, "://"); schemeIndex >= 0 {
+		if candidate := strings.TrimSpace(raw[:schemeIndex]); candidate != "" {
+			scheme = candidate
+		}
+		authorityAndSuffix = raw[schemeIndex+3:]
+	}
+
+	authorityEnd := strings.IndexAny(authorityAndSuffix, "/?#")
+	if authorityEnd < 0 {
+		authorityEnd = len(authorityAndSuffix)
+	}
+
+	authority := authorityAndSuffix[:authorityEnd]
+	suffix := authorityAndSuffix[authorityEnd:]
+	atIndex := strings.LastIndex(authority, "@")
+	hostPort := authority
+	username := ""
+	if atIndex >= 0 {
+		userInfo := authority[:atIndex]
+		hostPort = authority[atIndex+1:]
+		if hostPort == "" {
+			return "", false
+		}
+		username = userInfo
+		if colonIndex := strings.Index(userInfo, ":"); colonIndex >= 0 {
+			username = userInfo[:colonIndex]
+		}
+		if username == "" {
+			username = redactedNATSPassword
+		}
+	}
+
+	if hostPort == "" || strings.ContainsAny(hostPort, " \t\r\n") {
+		return "", false
+	}
+
+	safe := &url.URL{
+		Scheme: scheme,
+		Host:   hostPort,
+	}
+	if username != "" {
+		safe.User = url.UserPassword(username, redactedNATSPassword)
+	}
+	return safe.String() + suffix, true
 }
 
 // loadEnv gathers and validates connection details from environment variables
@@ -144,7 +212,7 @@ func NewNatsBroker(logger mlogger.Logger, settings *nc.Settings) (*NatsBroker, e
 		}
 		natsURL = u.String()
 	}
-	sanitizedNATSURL := sanitizeNATSURL(natsURL)
+	publishableNATSURL := buildSafePublishableNATSURL(natsURL)
 
 	opts := []nats.Option{
 		nats.Name(settings.NATSName),
@@ -156,7 +224,7 @@ func NewNatsBroker(logger mlogger.Logger, settings *nc.Settings) (*NatsBroker, e
 				zap.String("broker", settings.NATSName),
 			}
 			if conn != nil {
-				fields = append(fields, zap.String("connected_url", sanitizeNATSURL(conn.ConnectedUrl())))
+				fields = append(fields, zap.String("connected_url", buildSafePublishableNATSURL(conn.ConnectedUrl())))
 			}
 			if err != nil {
 				fields = append(fields, zap.Error(err))
@@ -168,7 +236,7 @@ func NewNatsBroker(logger mlogger.Logger, settings *nc.Settings) (*NatsBroker, e
 				zap.String("broker", settings.NATSName),
 			}
 			if conn != nil {
-				fields = append(fields, zap.String("connected_url", sanitizeNATSURL(conn.ConnectedUrl())))
+				fields = append(fields, zap.String("connected_url", buildSafePublishableNATSURL(conn.ConnectedUrl())))
 			}
 			l.Info("Reconnected to NATS", fields...)
 		}),
@@ -178,7 +246,7 @@ func NewNatsBroker(logger mlogger.Logger, settings *nc.Settings) (*NatsBroker, e
 			}
 			if conn != nil {
 				if url := conn.ConnectedUrl(); url != "" {
-					fields = append(fields, zap.String("connected_url", sanitizeNATSURL(url)))
+					fields = append(fields, zap.String("connected_url", buildSafePublishableNATSURL(url)))
 				}
 				if err := conn.LastError(); err != nil {
 					fields = append(fields, zap.Error(err))
@@ -208,7 +276,7 @@ func NewNatsBroker(logger mlogger.Logger, settings *nc.Settings) (*NatsBroker, e
 	}
 
 	if res.nc, err = nats.Connect(natsURL, opts...); err != nil {
-		l.Error("Failed to connect to NATS", zap.String("url", sanitizedNATSURL), zap.Error(err))
+		l.Error("Failed to connect to NATS", zap.String("url", publishableNATSURL), zap.Error(err))
 		return nil, err
 	}
 	if res.js, err = res.nc.JetStream(); err != nil {
@@ -216,7 +284,7 @@ func NewNatsBroker(logger mlogger.Logger, settings *nc.Settings) (*NatsBroker, e
 	}
 
 	logger.Info("Connected to NATS", zap.String("broker", settings.NATSName),
-		zap.String("url", sanitizedNATSURL))
+		zap.String("url", publishableNATSURL))
 	return res, nil
 }