fix(diagnostics): redact WriteSecuredBulk/WriteSecured2Bulk payloads (#193)

Adds both secured bulk kinds to GatewayLogRedactor's credential-bearing set, plus a contract cross-check test that walks every MxCommand payload descriptor and fails if a secured or password-bearing command kind is not redacted.
2026-11-06 15:45:50 -05:00
parent 5a235776b6
commit 9354d69bf9
3 changed files with 91 additions and 1 deletions
@@ -11,8 +11,11 @@ public static class GatewayLogRedactor
    private static readonly HashSet<string> SensitiveCommandMethods = new(StringComparer.OrdinalIgnoreCase)
    {
        "AuthenticateUser",
+        // Carry a credential-sensitive write value (single item and bulk).
        "WriteSecured",
        "WriteSecured2",
+        "WriteSecuredBulk",
+        "WriteSecured2Bulk",
        // Carry operator_password.
        "AcknowledgeAlarm",
        "AcknowledgeAlarmByName"