[SC-???] [WIP] Do not request sensitive information unless it's going to be displayed

Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    aptible-cli (0.26.3)
+    aptible-cli (0.26.4)
       activesupport (>= 4.0, < 6.0)
       aptible-api (~> 1.12)
       aptible-auth (~> 1.4)

lib/aptible/cli.rb

@@ -7,6 +7,16 @@
 require 'aptible/cli/renderer'
 require 'aptible/cli/resource_formatter'
 
+# Set no_sensitive_extras=true as the default for all API resources.
+# This avoids returning sensitive embedded data unless explicitly requested.
+Aptible::Api::Resource.headers =
+  { 'Prefer' => 'no_sensitive_extras=true' }
+
+def with_sensitive(resource)
+  resource.headers['Prefer'] = 'no_sensitive_extras=false'
+  resource.find_by_url(resource.href)
+end
+
 module Aptible
   module CLI
     class TtyLogFormatter

lib/aptible/cli/agent.rb

@@ -92,10 +92,13 @@ def initialize(*)
           level = Logger::WARN
           debug_level = ENV['APTIBLE_DEBUG']
           level = debug_level if debug_level
-          require 'httplog' if ENV['BUNDLER_VERSION'] && \
-                               ENV['APTIBLE_LOG_HTTP_REQUEST_RESPONSE'] && \
-                               !ENV['APTIBLE_LOG_HTTP_REQUEST_RESPONSE'] \
-                               .downcase.start_with?('f')
+          if ENV['BUNDLER_VERSION'] && \
+             ENV['APTIBLE_LOG_HTTP_REQUEST_RESPONSE'] && \
+             !ENV['APTIBLE_LOG_HTTP_REQUEST_RESPONSE'] \
+             .downcase.start_with?('f')
+            require 'httplog'
+            HttpLog.configure { |c| c.log_headers = true }
+          end
           conf.logger.tap { |l| l.level = level }
         end
         warn_sso_enforcement

lib/aptible/cli/helpers/database.rb

@@ -314,6 +314,9 @@ def find_credential(database, type = nil)
             raise Thor::Error, "Database #{database.handle} is not provisioned"
           end
 
+          # Maybe reload with senstive data
+          database = with_sensitive(database) if database.objects[:database_credentials].nil?
+
           finder = proc { |c| c.default }
           finder = proc { |c| c.type == type } if type
           credential = database.database_credentials.find(&finder)
@@ -322,14 +325,6 @@ def find_credential(database, type = nil)
 
           types = database.database_credentials.map(&:type)
 
-          # On v1, we fallback to the DB. We make sure to make --type work, to
-          # avoid a confusing experience for customers.
-          if database.account.stack.version == 'v1'
-            types << database.type
-            types.uniq!
-            return database if type.nil? || type == database.type
-          end
-
           valid = types.join(', ')
 
           err = 'No default credential for database'
@@ -365,6 +360,8 @@ def validate_image_type(type)
         end
 
         def render_database(database, account)
+          # Maybe reload with senstive data
+          database = with_sensitive(database) if database.connection_url.nil?
           Formatter.render(Renderer.current) do |root|
             root.keyed_object('connection_url') do |node|
               ResourceFormatter.inject_database(node, database, account)

lib/aptible/cli/helpers/log_drain.rb

@@ -65,7 +65,8 @@ def ensure_url(options, url_format_msg: nil)
         end
 
         def ensure_log_drain(account, handle)
-          drains = account.reload.log_drains.select { |d| d.handle == handle }
+          account = with_sensitive(account)
+          drains = account.log_drains.select { |d| d.handle == handle }
 
           if drains.empty?
             raise Thor::Error, "No drain found with handle #{handle}"

lib/aptible/cli/helpers/metric_drain.rb

@@ -19,6 +19,7 @@ def create_metric_drain(account, drain_opts)
         end
 
         def ensure_metric_drain(account, handle)
+          account = with_sensitive(account)
           drains = account.metric_drains.select { |d| d.handle == handle }
 
           if drains.empty?

lib/aptible/cli/subcommands/db.rb

@@ -481,6 +481,7 @@ def self.included(thor)
               telemetry(__method__, options.merge(handle: handle))
 
               database = ensure_database(options.merge(db: handle))
+
               credential = find_credential(database, options[:type])
 
               Formatter.render(Renderer.current) do |root|

lib/aptible/cli/version.rb

@@ -1,5 +1,5 @@
 module Aptible
   module CLI
-    VERSION = '0.26.3'.freeze
+    VERSION = '0.26.4'.freeze
   end
 end