fixes for storage managament

internal/procctl/env_sensitive_test.go

@@ -0,0 +1,46 @@
+package procctl
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// TestReadEnvGroupsSensitiveFlag guards against sensitiveKeyRe false-positive
+// matches on the word "SECRET" in a name that means Telegram's secret-chat
+// feature, not a credential (e.g. TELESRV_SECRET_CHAT_DELETE_FILE_AFTER_DOWNLOAD),
+// while still flagging real credential-shaped names as sensitive.
+func TestReadEnvGroupsSensitiveFlag(t *testing.T) {
+	root := t.TempDir()
+	tmpl := "## Storage & Media -- test group\n" +
+		"# desc\n" +
+		"TELESRV_SECRET_CHAT_DELETE_FILE_AFTER_DOWNLOAD=true\n" +
+		"# desc\n" +
+		"TELESRV_ADMIN_PASSWORD=\n" +
+		"# desc\n" +
+		"TELESRV_BOT_API_KEY=\n"
+	if err := os.WriteFile(filepath.Join(root, ".env.example"), []byte(tmpl), 0o644); err != nil {
+		t.Fatalf("write .env.example: %v", err)
+	}
+
+	groups, err := NewManager(root).ReadEnvGroups()
+	if err != nil {
+		t.Fatalf("ReadEnvGroups: %v", err)
+	}
+	got := map[string]bool{}
+	for _, g := range groups {
+		for _, f := range g.Fields {
+			got[f.Key] = f.Sensitive
+		}
+	}
+
+	if got["TELESRV_SECRET_CHAT_DELETE_FILE_AFTER_DOWNLOAD"] {
+		t.Errorf("TELESRV_SECRET_CHAT_DELETE_FILE_AFTER_DOWNLOAD marked sensitive, want not (it's a boolean toggle, not a credential)")
+	}
+	if !got["TELESRV_ADMIN_PASSWORD"] {
+		t.Errorf("TELESRV_ADMIN_PASSWORD not marked sensitive, want sensitive")
+	}
+	if !got["TELESRV_BOT_API_KEY"] {
+		t.Errorf("TELESRV_BOT_API_KEY not marked sensitive, want sensitive")
+	}
+}

internal/procctl/procctl.go

@@ -490,6 +490,11 @@ var (
 	activeFieldRe    = regexp.MustCompile(`^(TELESRV_[A-Z0-9_]+)=(.*)$`)
 	commentedFieldRe = regexp.MustCompile(`^#\s*(TELESRV_[A-Z0-9_]+)=(.*)$`)
 	sensitiveKeyRe   = regexp.MustCompile(`(PASSWORD|SECRET|_TOKEN|API_KEY)`)
+	// sensitiveKeyExceptRe excludes names that trip sensitiveKeyRe on the
+	// word "SECRET" while meaning Telegram's secret-chat feature, not a
+	// credential (e.g. TELESRV_SECRET_CHAT_DELETE_FILE_AFTER_DOWNLOAD) --
+	// there's nothing to mask there, it's a plain boolean toggle.
+	sensitiveKeyExceptRe = regexp.MustCompile(`SECRET_CHAT`)
 	groupHeaderRe    = regexp.MustCompile(`^##\s*(.+?)\s*--\s*(.+)$`)
 	sectionBreakRe   = regexp.MustCompile(`^#\s*={10,}\s*$`)
 )
@@ -554,7 +559,7 @@ func (m *Manager) ReadEnvGroups() ([]EnvGroup, error) {
 			DefaultValue:     defaultValue,
 			Description:      description,
 			EnabledByDefault: enabledByDefault,
-			Sensitive:        sensitiveKeyRe.MatchString(key),
+			Sensitive:        sensitiveKeyRe.MatchString(key) && !sensitiveKeyExceptRe.MatchString(key),
 			Value:            value,
 		})
 	}