go-pkgz / auth / 38119396078

87%

push

github

fix: keep the token out of the log in the later verify login error branches

the bad-handshake, avatar-save, token-id and set-token branches of
VerifyHandler.LoginHandler logged the request URL with the token in it. With a
confirmation store the token is used up by then, but a handler built with a nil
store logged a confirmation link that could still be redeemed.

all four pass the scrubbed request copy, in v1 and v2. The regression test drives
the three branches it can reach from outside; the token-id branch needs a failing
random source.

3 of 4 new or added lines in 1 file covered. (75.0%)

3309 of 3814 relevant lines covered (86.76%)

9.83 hits per line