cached gateway routing

api/pkg/messaging/internal/natsb/broker.go

@@ -35,6 +35,41 @@ type envConfig struct {
 
 const defaultConsumerBufferSize = 1024
 
+func sanitizeNATSURL(rawURL string) string {
+	if rawURL == "" {
+		return rawURL
+	}
+
+	parts := strings.Split(rawURL, ",")
+	sanitized := make([]string, 0, len(parts))
+	for _, part := range parts {
+		trimmed := strings.TrimSpace(part)
+		if trimmed == "" {
+			continue
+		}
+		if !strings.Contains(trimmed, "://") {
+			sanitized = append(sanitized, trimmed)
+			continue
+		}
+
+		parsed, err := url.Parse(trimmed)
+		if err != nil {
+			sanitized = append(sanitized, trimmed)
+			continue
+		}
+		if parsed.User == nil {
+			sanitized = append(sanitized, trimmed)
+			continue
+		}
+		sanitized = append(sanitized, parsed.Redacted())
+	}
+
+	if len(sanitized) == 0 {
+		return strings.TrimSpace(rawURL)
+	}
+	return strings.Join(sanitized, ",")
+}
+
 // loadEnv gathers and validates connection details from environment variables
 // listed in the Settings struct. Invalid or missing values surface as a typed
 // InvalidArgument error so callers can decide how to handle them.
@@ -109,6 +144,7 @@ func NewNatsBroker(logger mlogger.Logger, settings *nc.Settings) (*NatsBroker, e
 		}
 		natsURL = u.String()
 	}
+	sanitizedNATSURL := sanitizeNATSURL(natsURL)
 
 	opts := []nats.Option{
 		nats.Name(settings.NATSName),
@@ -120,7 +156,7 @@ func NewNatsBroker(logger mlogger.Logger, settings *nc.Settings) (*NatsBroker, e
 				zap.String("broker", settings.NATSName),
 			}
 			if conn != nil {
-				fields = append(fields, zap.String("connected_url", conn.ConnectedUrl()))
+				fields = append(fields, zap.String("connected_url", sanitizeNATSURL(conn.ConnectedUrl())))
 			}
 			if err != nil {
 				fields = append(fields, zap.Error(err))
@@ -132,7 +168,7 @@ func NewNatsBroker(logger mlogger.Logger, settings *nc.Settings) (*NatsBroker, e
 				zap.String("broker", settings.NATSName),
 			}
 			if conn != nil {
-				fields = append(fields, zap.String("connected_url", conn.ConnectedUrl()))
+				fields = append(fields, zap.String("connected_url", sanitizeNATSURL(conn.ConnectedUrl())))
 			}
 			l.Info("Reconnected to NATS", fields...)
 		}),
@@ -142,7 +178,7 @@ func NewNatsBroker(logger mlogger.Logger, settings *nc.Settings) (*NatsBroker, e
 			}
 			if conn != nil {
 				if url := conn.ConnectedUrl(); url != "" {
-					fields = append(fields, zap.String("connected_url", url))
+					fields = append(fields, zap.String("connected_url", sanitizeNATSURL(url)))
 				}
 				if err := conn.LastError(); err != nil {
 					fields = append(fields, zap.Error(err))
@@ -172,7 +208,7 @@ func NewNatsBroker(logger mlogger.Logger, settings *nc.Settings) (*NatsBroker, e
 	}
 
 	if res.nc, err = nats.Connect(natsURL, opts...); err != nil {
-		l.Error("Failed to connect to NATS", zap.String("url", natsURL), zap.Error(err))
+		l.Error("Failed to connect to NATS", zap.String("url", sanitizedNATSURL), zap.Error(err))
 		return nil, err
 	}
 	if res.js, err = res.nc.JetStream(); err != nil {
@@ -180,7 +216,7 @@ func NewNatsBroker(logger mlogger.Logger, settings *nc.Settings) (*NatsBroker, e
 	}
 
 	logger.Info("Connected to NATS", zap.String("broker", settings.NATSName),
-		zap.String("url", natsURL))
+		zap.String("url", sanitizedNATSURL))
 	return res, nil
 }