fix: harden token redaction in GitLab logger and session error handling

- Widen Bearer token regex from [a-zA-Z0-9_-]+ to \S+ to cover JWTs
  (containing dots) and base64 tokens (containing = padding)
- Wrap GitHub token fetch error in sessions.go with gitlab.SanitizeErrorMessage()
  to prevent upstream errors from leaking token material
- Add tests for JWT, base64, and error message redaction

Closes #1668

Author: jeremyeder

components/backend/gitlab/logger.go

@@ -21,7 +21,7 @@ func RedactToken(s string) string {
 	s = gitlabCIPattern.ReplaceAllString(s, "gitlab-ci-token: "+TokenRedactionPlaceholder)
 
 	// Bearer tokens in Authorization headers
-	bearerPattern := regexp.MustCompile(`Bearer\s+[a-zA-Z0-9_-]+`)
+	bearerPattern := regexp.MustCompile(`Bearer\s+\S+`)
 	s = bearerPattern.ReplaceAllString(s, "Bearer "+TokenRedactionPlaceholder)
 
 	// OAuth2 tokens in URLs: oauth2:TOKEN@

components/backend/gitlab/logger_test.go

@@ -0,0 +1,55 @@
+package gitlab
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+)
+
+func TestRedactToken_BearerJWT(t *testing.T) {
+	jwt := "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.SflKxwRJSMeKKF2QT4fwpM"
+	input := "Authorization: Bearer " + jwt
+	result := RedactToken(input)
+	if strings.Contains(result, jwt) {
+		t.Errorf("JWT token was not fully redacted: %s", result)
+	}
+	if !strings.Contains(result, "Bearer "+TokenRedactionPlaceholder) {
+		t.Errorf("expected Bearer [REDACTED], got: %s", result)
+	}
+}
+
+func TestRedactToken_BearerBase64(t *testing.T) {
+	base64Token := "dGhpcyBpcyBhIHRva2VuIHdpdGggcGFkZGluZw=="
+	input := "Authorization: Bearer " + base64Token
+	result := RedactToken(input)
+	if strings.Contains(result, base64Token) {
+		t.Errorf("base64 token was not fully redacted: %s", result)
+	}
+	if !strings.Contains(result, "Bearer "+TokenRedactionPlaceholder) {
+		t.Errorf("expected Bearer [REDACTED], got: %s", result)
+	}
+}
+
+func TestRedactToken_BearerSimple(t *testing.T) {
+	input := "Authorization: Bearer ghp_abc123def456"
+	result := RedactToken(input)
+	if strings.Contains(result, "ghp_abc123def456") {
+		t.Errorf("simple token was not redacted: %s", result)
+	}
+}
+
+func TestSanitizeErrorMessage_RedactsTokenInError(t *testing.T) {
+	token := "ghp_secrettoken123"
+	err := fmt.Errorf("failed to fetch: Bearer %s was rejected", token)
+	result := SanitizeErrorMessage(err)
+	if strings.Contains(result, token) {
+		t.Errorf("token leaked in sanitized error message: %s", result)
+	}
+}
+
+func TestSanitizeErrorMessage_NilError(t *testing.T) {
+	result := SanitizeErrorMessage(nil)
+	if result != "" {
+		t.Errorf("expected empty string for nil error, got: %s", result)
+	}
+}

components/backend/handlers/sessions.go

@@ -21,6 +21,7 @@ import (
 	"unicode/utf8"
 
 	"ambient-code-backend/git"
+	"ambient-code-backend/gitlab"
 	"ambient-code-backend/pathutil"
 	"ambient-code-backend/types"
 
@@ -1368,7 +1369,7 @@ func MintSessionGitHubToken(c *gin.Context) {
 	// Get GitHub token (GitHub App or PAT fallback via project runner secret)
 	tokenStr, err := GetGitHubToken(c.Request.Context(), K8sClient, DynamicClient, project, userID)
 	if err != nil {
-		log.Printf("Failed to get GitHub token for project %s: %v", project, err)
+		log.Printf("Failed to get GitHub token for project %s: %s", project, gitlab.SanitizeErrorMessage(err))
 		c.JSON(http.StatusBadGateway, gin.H{"error": "Failed to retrieve GitHub token"})
 		return
 	}