fix(cli): Redact passwords in docker compose config CLI printout (#1323)

Redacts any value marked as confidential in the configuration options
from the config.

I've also removed the version from the docker compose files as it is
deprecated and shows warnings any time we use them - I'd also collapse
them in one as @alco did but it can wait until
#1299 is merged

.changeset/flat-terms-shake.md

@@ -0,0 +1,5 @@
+---
+"electric-sql": patch
+---
+
+Redact secrets from CLI Docker configuration printout.

clients/typescript/src/cli/config-options.ts

@@ -142,6 +142,7 @@ export const configOptions: Record<string, any> = {
     valueType: String,
     inferVal: (options: ConfigMap) => inferDbUrlPart('password', options),
     defaultVal: 'db_password',
+    secret: true,
     groups: ['database'],
   },
   DATABASE_NAME: {
@@ -249,6 +250,7 @@ export const configOptions: Record<string, any> = {
       Password to use when connecting to the Postgres proxy via psql or any other 
       Postgres client.
     `,
+    secret: true,
     groups: ['electric', 'client', 'proxy'],
   },
   AUTH_MODE: {

clients/typescript/src/cli/config.ts

@@ -16,6 +16,7 @@ export interface AnyConfigOption {
     | boolean
     | ((options: ConfigMap) => string | number | boolean)
   constructedDefault?: string
+  secret?: true
   groups?: Readonly<string[]>
 }
 
@@ -183,6 +184,34 @@ export function envFromConfig(config: Config) {
   )
 }
 
+/**
+ * Redacts the given `stringToRedact` from the `config` _in place_,
+ * replacing any mention of the string with `******`.
+ */
+function redactConfigValue(config: Config, stringToRedact: string): void {
+  Object.entries(config).forEach(([key, value]) => {
+    if (typeof value === 'string' && value.includes(stringToRedact)) {
+      config[key] = value.replaceAll(stringToRedact, '******')
+    }
+  })
+}
+
+/**
+ * Redacts sensitive information like secrets and passwords from the
+ * config and returns a separate, redacted version.
+ *
+ * Redaction is done based on the `secret` property of the
+ * configuration option.
+ */
+export function redactConfigSecrets(config: Config): Config {
+  const valuesToRedact = Object.keys(config)
+    .filter((k) => configOptions[k].secret)
+    .map((k) => config[k])
+  const redactedConfig = { ...config }
+  valuesToRedact.forEach((v) => redactConfigValue(redactedConfig, v))
+  return redactedConfig
+}
+
 function snakeToCamel(s: string) {
   return s
     .toLocaleLowerCase()

clients/typescript/src/cli/docker-commands/command-start.ts

@@ -1,6 +1,11 @@
 import { Command } from 'commander'
 import { dedent, parsePgProxyPort } from '../util'
-import { addOptionGroupToCommand, getConfig, Config } from '../config'
+import {
+  addOptionGroupToCommand,
+  getConfig,
+  Config,
+  redactConfigSecrets,
+} from '../config'
 import { dockerCompose } from './docker-utils'
 
 export function makeStartCommand() {
@@ -77,7 +82,7 @@ export function start(options: StartSettings) {
           }
         : {}),
     }
-    console.log('Docker compose config:', dockerConfig)
+    console.log('Docker compose config:', redactConfigSecrets(dockerConfig))
 
     const proc = dockerCompose(
       'up',

clients/typescript/src/cli/docker-commands/docker/compose-with-postgres.yaml

@@ -1,5 +1,3 @@
-version: '3.8'
-
 configs:
   postgres_config:
     file: './postgres.conf'

clients/typescript/src/cli/docker-commands/docker/compose.yaml

@@ -1,5 +1,3 @@
-version: '3.8'
-
 configs:
   postgres_config:
     file: './postgres.conf'

clients/typescript/test/cli/config.test.ts

@@ -1,5 +1,5 @@
 import test from 'ava'
-import { getConfigValue } from '../../src/cli/config'
+import { getConfigValue, redactConfigSecrets } from '../../src/cli/config'
 
 test('getConfigValue can capture `ELECTRIC_` prefixed CLI opitons', async (t) => {
   const image = getConfigValue('ELECTRIC_IMAGE', { image: 'electric:test' })
@@ -10,3 +10,23 @@ test('getConfigValue can capture `ELECTRIC_` prefixed CLI opitons', async (t) =>
   t.is(image, 'electric:test')
   t.is(writeToPgMode, 'test')
 })
+
+test('redactConfigValue redacts value in all of the config', (t) => {
+  const config = {
+    ELECTRIC_IMAGE: 'electric:test',
+    PROXY:
+      'postgresql://postgres:proxy_password@localhost:65432/test?sslmode=disable',
+    PG_PROXY_PASSWORD: 'proxy_password',
+    ELECTRIC_WRITE_TO_PG_MODE: 'test',
+    DATABASE_URL: 'postgresql://postgres:db_password@postgres:5432/test',
+    DATABASE_PASSWORD: 'db_password',
+  }
+  t.deepEqual(redactConfigSecrets(config), {
+    ...config,
+
+    DATABASE_URL: 'postgresql://postgres:******@postgres:5432/test',
+    DATABASE_PASSWORD: '******',
+    PROXY: 'postgresql://postgres:******@localhost:65432/test?sslmode=disable',
+    PG_PROXY_PASSWORD: '******',
+  })
+})