Redact sensitive connection diagnostics

app/src/main/java/shop/whitedns/client/ui/SensitiveText.kt

@@ -0,0 +1,11 @@
+package shop.whitedns.client.ui
+
+internal const val RedactedSecretLabel = "<redacted>"
+
+internal fun maskSecretForDisplay(value: String): String {
+    return if (value.isBlank()) "" else "********"
+}
+
+internal fun redactSecretForDiagnostics(value: String): String {
+    return if (value.isBlank()) "not configured" else RedactedSecretLabel
+}

app/src/main/java/shop/whitedns/client/ui/WhiteDnsScreen.kt

@@ -8100,7 +8100,7 @@ private fun ConnectionInfoCard(
             InfoRow(label = WhiteDnsL10n.infoLabelAuth, value = if (socksAuthEnabled) WhiteDnsL10n.infoLabelAuthOn else WhiteDnsL10n.infoLabelAuthOff)
             if (socksAuthEnabled) {
                 InfoRow(label = WhiteDnsL10n.infoLabelUser, value = username)
-                InfoRow(label = WhiteDnsL10n.infoLabelPass, value = password)
+                InfoRow(label = WhiteDnsL10n.infoLabelPass, value = maskSecretForDisplay(password))
             }
         } else {
             ProtocolRow(protocol = protocol, showDivider = true)
@@ -8665,7 +8665,7 @@ private fun ConnectionLogsBlock(
                             context = context,
                             label = diagnosticsClipboardLabel,
                             text = buildDiagnosticsText(context, uiState),
-                            sensitive = false,
+                            sensitive = true,
                         )
                     },
                 )
@@ -8973,7 +8973,7 @@ private fun buildDiagnosticsText(
         appendLine("Mode: ${WhiteDnsOptions.connectionModeLabel(resolvedSettings.connectionMode)}")
         appendLine("Profile: ${selectedProfile.name.ifBlank { selectedProfile.id }}")
         appendLine("Server: ${selectedProfile.customServerDomain.ifBlank { "not configured" }}")
-        appendLine("Encryption key: ${selectedProfile.customServerEncryptionKey.ifBlank { "not configured" }}")
+        appendLine("Encryption key: ${redactSecretForDiagnostics(selectedProfile.customServerEncryptionKey)}")
         appendLine("Resolver profile: ${resolverProfile?.name ?: "Manual resolvers"}")
         appendLine("Resolvers: ${resolvedSettings.resolverEntries.size}")
         appendLine("Split tunnel: ${WhiteDnsOptions.splitTunnelModeLabel(resolvedSettings.splitTunnelMode)}")

app/src/test/java/shop/whitedns/client/ui/SensitiveTextTest.kt

@@ -0,0 +1,28 @@
+package shop.whitedns.client.ui
+
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class SensitiveTextTest {
+    @Test
+    fun maskSecretForDisplayHidesConfiguredSecrets() {
+        assertEquals("********", maskSecretForDisplay("secret-password"))
+    }
+
+    @Test
+    fun maskSecretForDisplayKeepsBlankSecretsBlank() {
+        assertEquals("", maskSecretForDisplay(""))
+        assertEquals("", maskSecretForDisplay("   "))
+    }
+
+    @Test
+    fun redactSecretForDiagnosticsDoesNotExposeConfiguredSecrets() {
+        assertEquals(RedactedSecretLabel, redactSecretForDiagnostics("server-key"))
+    }
+
+    @Test
+    fun redactSecretForDiagnosticsKeepsMissingStateUseful() {
+        assertEquals("not configured", redactSecretForDiagnostics(""))
+        assertEquals("not configured", redactSecretForDiagnostics("   "))
+    }
+}