SK-3015-gitleaks-detection-fix

Author: skyflow-himanshupal

common/src/main/java/com/skyflow/utils/BaseConstants.java

@@ -14,7 +14,7 @@ public class BaseConstants {
     public static final String STAGE_DOMAIN = "skyflowapis.tech";
     public static final String SANDBOX_DOMAIN = "skyflowapis-preview.com";
     public static final String PROD_DOMAIN = "skyflowapis.com";
-    public static final String PKCS8_PRIVATE_HEADER = "-----BEGIN PRIVATE KEY-----";
+    public static final String PKCS8_PRIVATE_HEADER = "-----BEGIN PRIVATE KEY-----"; // gitleaks:allow
     public static final String PKCS8_PRIVATE_FOOTER = "-----END PRIVATE KEY-----";
     public static final String GRANT_TYPE = "urn:ietf:params:oauth:grant-type:jwt-bearer";
     public static final String SIGNED_DATA_TOKEN_PREFIX = "signed_token_";

common/src/test/java/com/skyflow/BaseVaultClientTests.java

@@ -280,7 +280,7 @@ public void testWrapApiException_carriesStatusCodeAndJsonResponseBody() {
 
     /**
      * Covers setBearerToken's "token present but expired -> regenerate" branch. A hand-crafted
-     * always-expired JWT ("x.eyJleHAiOjF9.y", exp=1 => 1970) is seeded directly into the token
+     * always-expired JWT ("<TOKEN_1>", exp=1 => 1970) is seeded directly into the token
      * field, bypassing setBearerToken. The very same credentials instance used to seed
      * finalCredentials is then reused when calling setBearerToken, so prioritiseCredentials does
      * NOT treat this as a credential change (that branch is covered by
@@ -294,11 +294,11 @@ public void testSetBearerToken_expiredToken_regeneratesToken() throws SkyflowExc
         BaseVaultClient<BaseVaultConfig> client = newClient(null);
 
         client.prioritiseCredentials(creds);
-        client.token = "x.eyJleHAiOjF9.y"; // exp=1 (1970) -> always expired, seeded directly
+        client.token = "<TOKEN_1>"; // exp=1 (1970) -> always expired, seeded directly
 
         client.setBearerToken(creds);
 
         Assert.assertEquals("x.eyJleHAiOjk5OTk5OTk5OTl9.y", client.token);
-        Assert.assertNotEquals("x.eyJleHAiOjF9.y", client.token);
+        Assert.assertNotEquals("<TOKEN_1>", client.token);
     }
 }

flowvault/src/test/java/com/skyflow/AuthInterceptorTests.java

@@ -24,7 +24,7 @@
  */
 public class AuthInterceptorTests {
 
-    private static final String API_KEY = "sky-ab123-abcd1234cdef1234abcd4321cdef4321";
+    private static final String API_KEY = "<API_KEY>";
 
     private static VaultConfig config() {
         VaultConfig config = new VaultConfig();

skyvault/src/test/java/com/skyflow/ConnectionClientTests.java

@@ -59,7 +59,7 @@ public void testSetBearerToken() {
         try {
             // Self-contained fake JWT (exp=9999999999, far future) instead of relying on a
             // local .env fixture, which may not exist (e.g. in CI/sandbox environments).
-            String bearerToken = "x.eyJleHAiOjk5OTk5OTk5OTl9.y";
+            String bearerToken = "<BEARER_TOKEN>";
             Credentials credentials = new Credentials();
             credentials.setToken(bearerToken);
             connectionConfig.setCredentials(credentials);
@@ -144,7 +144,7 @@ public void testSetBearerToken_withValidNonExpiredToken_reusesBearerToken() {
         try {
             // far-future JWT: base64({"exp":9999999999}) = eyJleHAiOjk5OTk5OTk5OTl9 — never expires
             Credentials creds = new Credentials();
-            creds.setToken("x.eyJleHAiOjk5OTk5OTk5OTl9.y");
+            creds.setToken("<BEARER_TOKEN>");
             ConnectionConfig config = new ConnectionConfig();
             config.setConnectionId("isolated-token-1");
             config.setConnectionUrl("https://test.isolated.url");
@@ -153,11 +153,11 @@ public void testSetBearerToken_withValidNonExpiredToken_reusesBearerToken() {
 
             // First call: this.token == null → Token.isExpired(null)=true → generates token from creds.getToken()
             client.setBearerToken();
-            Assert.assertEquals("x.eyJleHAiOjk5OTk5OTk5OTl9.y", client.token);
+            Assert.assertEquals("<BEARER_TOKEN>", client.token);
 
             // Second call: token not null, not empty, not expired → REUSE_BEARER_TOKEN else branch (line 52)
             client.setBearerToken();
-            Assert.assertEquals("x.eyJleHAiOjk5OTk5OTk5OTl9.y", client.token);
+            Assert.assertEquals("<BEARER_TOKEN>", client.token);
         } catch (Exception e) {
             Assert.fail(INVALID_EXCEPTION_THROWN);
         }
@@ -167,7 +167,7 @@ public void testSetBearerToken_withValidNonExpiredToken_reusesBearerToken() {
     public void testPrioritiseCredentials_credentialChange_resetsToken() {
         try {
             Credentials credentialsA = new Credentials();
-            credentialsA.setToken("x.eyJleHAiOjk5OTk5OTk5OTl9.y");
+            credentialsA.setToken("<BEARER_TOKEN>");
             ConnectionConfig config = new ConnectionConfig();
             config.setConnectionId("isolated-change-1");
             config.setConnectionUrl("https://test.isolated.url");