From cbc2dc7ec5b3095017ab9757336b94dbe52f52aa Mon Sep 17 00:00:00 2001
From: KremeCN <3265494849@qq.com>
Date: Sat, 22 Aug 2026 22:14:47 +0800
Subject: [PATCH] fix: redact passwords from credential strings

---
 .../com/flagship/abox/manager/domain/Models.kt       |  4 +++-
 .../flagship/abox/manager/domain/DomainResultTest.kt | 12 ++++++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/domain/src/main/kotlin/com/flagship/abox/manager/domain/Models.kt b/domain/src/main/kotlin/com/flagship/abox/manager/domain/Models.kt
index 3a6db52..bbf62e1 100644
--- a/domain/src/main/kotlin/com/flagship/abox/manager/domain/Models.kt
+++ b/domain/src/main/kotlin/com/flagship/abox/manager/domain/Models.kt
@@ -13,7 +13,9 @@ value class DeviceName(val value: String)
 value class Username(val value: String)
 
 @JvmInline
-value class Password(val value: String)
+value class Password(val value: String) {
+    override fun toString(): String = "Password(***)"
+}
 
 enum class ProviderType {
     ABOX,
diff --git a/domain/src/test/kotlin/com/flagship/abox/manager/domain/DomainResultTest.kt b/domain/src/test/kotlin/com/flagship/abox/manager/domain/DomainResultTest.kt
index 9f7db8f..d63565b 100644
--- a/domain/src/test/kotlin/com/flagship/abox/manager/domain/DomainResultTest.kt
+++ b/domain/src/test/kotlin/com/flagship/abox/manager/domain/DomainResultTest.kt
@@ -1,6 +1,7 @@
 package com.flagship.abox.manager.domain
 
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
 import org.junit.Assert.assertTrue
 import org.junit.Test
 
@@ -20,4 +21,15 @@ class DomainResultTest {
         assertTrue(result is DomainResult.Failure)
         assertEquals("20504", (result as DomainResult.Failure).error.externalCode)
     }
+
+    @Test
+    fun credentialStringsDoNotExposePassword() {
+        val plaintext = "secret-password"
+        val password = Password(plaintext)
+        val credentials = LoginCredentials(Username("demo"), password)
+
+        assertFalse(password.toString().contains(plaintext))
+        assertFalse(credentials.toString().contains(plaintext))
+        assertTrue(credentials.toString().contains("Password(***)"))
+    }
 }