satellitedb/metabase: do not log password when connected

Passwords should never be printed out, even if debug level is used.

Change-Id: Ib6af301f442374a2bb3561c84fc8d7c1f66fba25

private/logging/redact.go

@@ -0,0 +1,18 @@
+// Copyright (C) 2024 Storj Labs, Inc.
+// See LICENSE for copying information.
+
+package logging
+
+import (
+	"fmt"
+	"net/url"
+)
+
+// Redacted removes the password from a URL string.
+func Redacted(source string) string {
+	parsed, err := url.Parse(source)
+	if err != nil {
+		return fmt.Sprintf("redacting password from URL was not possible: %s", err.Error())
+	}
+	return parsed.Redacted()
+}

private/logging/redact_test.go

@@ -0,0 +1,15 @@
+// Copyright (C) 2024 Storj Labs, Inc.
+// See LICENSE for copying information.
+
+package logging
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestRedacted(t *testing.T) {
+	require.Equal(t, "cockroach://root@localhost:26257/env1?sslmode=disable", Redacted("cockroach://root@localhost:26257/env1?sslmode=disable"))
+	require.Equal(t, "cockroach://root:xxxxx@localhost:26257/env1?sslmode=disable", Redacted("cockroach://root:mypassword@localhost:26257/env1?sslmode=disable"))
+}

satellite/metabase/db.go

@@ -20,6 +20,7 @@ import (
 	"storj.io/common/dbutil/pgutil"
 	"storj.io/common/memory"
 	"storj.io/common/tagsql"
+	"storj.io/storj/private/logging"
 	"storj.io/storj/private/migrate"
 )
 
@@ -91,7 +92,9 @@ func Open(ctx context.Context, log *zap.Logger, connstr string, config Config) (
 	}
 	db.aliasCache = NewNodeAliasCache(db)
 
-	log.Debug("Connected", zap.String("db source", connstr))
+	if log.Level() == zap.DebugLevel {
+		log.Debug("Connected", zap.String("db source", logging.Redacted(connstr)))
+	}
 
 	return db, nil
 }

satellite/satellitedb/database.go

@@ -14,6 +14,7 @@ import (
 	"storj.io/common/dbutil/pgutil"
 	"storj.io/common/lrucache"
 	"storj.io/common/tagsql"
+	"storj.io/storj/private/logging"
 	"storj.io/storj/private/migrate"
 	"storj.io/storj/satellite"
 	"storj.io/storj/satellite/accounting"
@@ -131,7 +132,10 @@ func open(ctx context.Context, log *zap.Logger, databaseURL string, opts Options
 		return nil, Error.New("failed opening database via DBX at %q: %v",
 			source, err)
 	}
-	log.Debug("Connected to:", zap.String("db source", source))
+
+	if log.Level() == zap.DebugLevel {
+		log.Debug("Connected to:", zap.String("db source", logging.Redacted(source)))
+	}
 
 	name := "satellitedb"
 	if override != "" {