fix: redact the rate-limit header from Playwright traces

Sending the header from the browser puts it somewhere it was never
exposed before. Traces capture complete request headers — the same
property that made them useful for diagnosing the 429 — and CI uploads
them as a build artifact of a public repository. GitHub masks secrets
in workflow logs but not inside artifacts, so without this the change
would have published the token that exempts CI from Ory Network's rate
limits.

Playwright has no redaction option: TracingStartOptions carries only
name, title, screenshots, snapshots, live and sources. The archive is
therefore rewritten once Tracing().Stop() has written it, replacing the
value in every entry. The JSON-escaped spelling is replaced too, since
the trace stores headers as JSON string values and a token containing a
quote or backslash would otherwise sit there in a form a raw byte
comparison misses.

If the archive cannot be rewritten it is deleted rather than left in
place. Losing one diagnostic is the far cheaper failure.

Verified end to end: a login run with a dummy ORY_RATE_LIMIT_HEADER
produces a trace holding 131 occurrences of the header name — which is
also the first direct confirmation that the browser now sends it — zero
occurrences of the value, and 139 placeholders. TestRedactInZip covers
the rewriting itself, including the escaped spelling and the unreadable
archive, and needs no network.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Tg5VWFUb7824qkrooUdvBA

Author: alnr

cmd/cloudx/testhelpers/redact_test.go

@@ -0,0 +1,106 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package testhelpers
+
+import (
+	"archive/zip"
+	"encoding/json"
+	"io"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestRedactInZip pins the guarantee the Playwright traces depend on: this
+// repository is public and CI uploads the traces as an artifact, so the
+// rate-limit header value must not survive anywhere inside one.
+func TestRedactInZip(t *testing.T) {
+	const secret = `s3cret"value\with-escapes`
+
+	writeArchive := func(t *testing.T, entries map[string]string) string {
+		path := filepath.Join(t.TempDir(), "trace.zip")
+		f, err := os.Create(path)
+		require.NoError(t, err)
+		defer f.Close()
+
+		w := zip.NewWriter(f)
+		for name, content := range entries {
+			e, err := w.Create(name)
+			require.NoError(t, err)
+			_, err = e.Write([]byte(content))
+			require.NoError(t, err)
+		}
+		require.NoError(t, w.Close())
+		return path
+	}
+
+	readArchive := func(t *testing.T, path string) map[string]string {
+		r, err := zip.OpenReader(path)
+		require.NoError(t, err)
+		defer r.Close()
+
+		out := make(map[string]string, len(r.File))
+		for _, f := range r.File {
+			src, err := f.Open()
+			require.NoError(t, err)
+			content, err := io.ReadAll(src)
+			require.NoError(t, err)
+			require.NoError(t, src.Close())
+			out[f.Name] = string(content)
+		}
+		return out
+	}
+
+	// The trace stores headers as JSON string values, so the secret appears in
+	// its escaped spelling rather than verbatim.
+	escaped, err := json.Marshal(secret)
+	require.NoError(t, err)
+	jsonEncoded := string(escaped)
+
+	t.Run("case=removes the secret in both spellings", func(t *testing.T) {
+		path := writeArchive(t, map[string]string{
+			"trace.network": `{"headers":[{"name":"Ory-RateLimit-Action","value":` + jsonEncoded + `}]}`,
+			"trace.trace":   "prefix " + secret + " suffix",
+			"resources/1":   "a response body mentioning nothing",
+		})
+
+		require.NoError(t, redactInZip(path, secret))
+
+		for name, content := range readArchive(t, path) {
+			assert.NotContains(t, content, secret, "%s still holds the raw secret", name)
+			assert.NotContains(t, content, jsonEncoded[1:len(jsonEncoded)-1], "%s still holds the escaped secret", name)
+		}
+	})
+
+	t.Run("case=leaves the rest of the trace intact", func(t *testing.T) {
+		path := writeArchive(t, map[string]string{
+			"trace.trace": "keep me " + secret + " keep me too",
+			"resources/1": "untouched",
+		})
+
+		require.NoError(t, redactInZip(path, secret))
+
+		got := readArchive(t, path)
+		assert.Equal(t, "keep me "+redactedPlaceholder+" keep me too", got["trace.trace"])
+		assert.Equal(t, "untouched", got["resources/1"])
+	})
+
+	t.Run("case=no configured secret leaves the archive alone", func(t *testing.T) {
+		path := writeArchive(t, map[string]string{"trace.trace": "verbatim"})
+
+		require.NoError(t, redactInZip(path, ""))
+
+		assert.Equal(t, "verbatim", readArchive(t, path)["trace.trace"])
+	})
+
+	t.Run("case=an unreadable archive is an error, so the caller can delete it", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "not-a-zip.zip")
+		require.NoError(t, os.WriteFile(path, []byte("definitely not a zip"), 0o600))
+
+		assert.Error(t, redactInZip(path, secret))
+	})
+}

cmd/cloudx/testhelpers/testhelpers.go

@@ -4,6 +4,8 @@
 package testhelpers
 
 import (
+	"archive/zip"
+	"bytes"
 	"context"
 	"encoding/json"
 	"fmt"
@@ -307,6 +309,100 @@ func NewPage(t testing.TB, browser playwright.Browser) playwright.Page {
 	return page
 }
 
+// stopTracing writes the trace of the login flow and strips the rate-limit
+// header value out of it.
+//
+// A trace records complete request headers — this repository is public and CI
+// uploads the traces as a build artifact, where GitHub's secret masking does not
+// reach. The header that exempts CI from Ory Network's rate limits therefore
+// must not survive into one. Playwright offers no redaction option, so the
+// archive is rewritten after it has been written.
+//
+// If it cannot be rewritten the trace is deleted: losing a diagnostic is the
+// cheaper failure by far.
+func stopTracing(t testing.TB, page playwright.Page) {
+	path := filepath.Join(tracesDir, fmt.Sprintf("%s.zip", t.Name()))
+	if err := page.Context().Tracing().Stop(path); err != nil {
+		t.Logf("tracing stop error: %+v", err)
+		return
+	}
+
+	_, secret, ok := client.RateLimitHeader()
+	if !ok {
+		return
+	}
+	if err := redactInZip(path, secret); err != nil {
+		t.Logf("could not redact %s, removing it: %+v", path, err)
+		require.NoError(t, os.Remove(path))
+	}
+}
+
+const redactedPlaceholder = "[redacted]"
+
+// redactInZip rewrites every entry of the zip archive at path, replacing each
+// occurrence of secret with a placeholder.
+//
+// The JSON-escaped spelling is replaced as well, because the trace stores
+// headers as JSON string values and a secret containing a quote or backslash
+// would otherwise appear there in a form the raw comparison does not match.
+func redactInZip(path, secret string) error {
+	if secret == "" {
+		return nil
+	}
+
+	needles := [][]byte{[]byte(secret)}
+	if escaped, err := json.Marshal(secret); err == nil {
+		if inner := escaped[1 : len(escaped)-1]; !bytes.Equal(inner, []byte(secret)) {
+			needles = append(needles, inner)
+		}
+	}
+
+	r, err := zip.OpenReader(path)
+	if err != nil {
+		return err
+	}
+
+	tmp, err := os.CreateTemp(filepath.Dir(path), "trace-*.zip")
+	if err != nil {
+		_ = r.Close()
+		return err
+	}
+	defer os.Remove(tmp.Name()) // no-op once the rename below succeeded
+
+	err = func() error {
+		w := zip.NewWriter(tmp)
+		for _, f := range r.File {
+			src, err := f.Open()
+			if err != nil {
+				return err
+			}
+			content, err := io.ReadAll(src)
+			_ = src.Close()
+			if err != nil {
+				return err
+			}
+			for _, needle := range needles {
+				content = bytes.ReplaceAll(content, needle, []byte(redactedPlaceholder))
+			}
+			dst, err := w.Create(f.Name)
+			if err != nil {
+				return err
+			}
+			if _, err := dst.Write(content); err != nil {
+				return err
+			}
+		}
+		return w.Close()
+	}()
+	_ = r.Close()
+	_ = tmp.Close()
+	if err != nil {
+		return err
+	}
+
+	return os.Rename(tmp.Name(), path)
+}
+
 // submitPasswordForm submits the filled-in login form and fails immediately if
 // the server refused the request outright.
 //
@@ -353,7 +449,7 @@ func PlaywrightAcceptConsentBrowserHook(t testing.TB, page playwright.Page, emai
 		}))
 		defer func() {
 			r := recover()
-			_ = page.Context().Tracing().Stop(filepath.Join(tracesDir, fmt.Sprintf("%s.zip", t.Name())))
+			stopTracing(t, page)
 			if r != nil {
 				panic(r)
 			}