Remediated test #1 results

PostFundManagement.ConsoleUI/src/utils/apiErrorParser.ts

@@ -75,12 +75,53 @@ function humanizeFieldName(field: string): string {
   return spaced.charAt(0).toUpperCase() + spaced.slice(1);
 }
 
+/**
+ * Checks if a string contains raw HTTP request/response headers or dump.
+ */
+export function isRawHttpOutput(text: string): boolean {
+  if (!text || typeof text !== 'string') return false;
+  // If it has multiple header-like lines or standard HTTP request/response signatures
+  const headerPatterns = [
+    /^(?:accept|authorization|content-type|content-length|origin|referer|user-agent|sec-ch-ua|sec-fetch|x-forwarded|x-real-ip|host):/im,
+    /(?:authorization:\s*bearer|content-type:\s*application\/)/i,
+    /HTTP\/\d(?:\.\d)?\s+\d{3}/i,
+  ];
+
+  let matches = 0;
+  const lines = text.split('\n');
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (/^[A-Za-z0-9-]+:\s*.+$/.test(trimmed)) {
+      if (headerPatterns.some((p) => p.test(trimmed))) {
+        matches++;
+      }
+    }
+  }
+  return matches >= 2 || (matches >= 1 && /(?:authorization:\s*bearer|content-type:\s*application)/i.test(text));
+}
+
+/**
+ * Redacts sensitive tokens and credentials from technical traces.
+ */
+export function sanitizeTechnicalDetails(text: string): string {
+  if (!text) return '';
+  return text
+    .replace(/(authorization:\s*bearer\s+)[a-zA-Z0-9._-]+/gi, '$1[REDACTED_TOKEN]')
+    .replace(/(bearer\s+)[a-zA-Z0-9._-]+/gi, '$1[REDACTED_TOKEN]')
+    .replace(/("?(?:token|access_token|password|secret|apiKey)"?\s*[:=]\s*)"[^"]+"/gi, '$1"[REDACTED]"');
+}
+
 /**
  * Cleans technical jargon, stack traces, and framework namespaces from text strings.
  */
 function cleanTechnicalJargon(text: string): string {
   if (!text) return '';
 
+  // If text is a raw HTTP dump, do not return it as clean user text
+  if (isRawHttpOutput(text)) {
+    return '';
+  }
+
   const cleaned = text
     .replace(/^AxiosError:\s*/i, '')
     .replace(/^Error:\s*/i, '')
@@ -205,23 +246,28 @@ export function parseFriendlyError(
         rawErrors = dataObj;
       }
     } else if (typeof rawResponseData === 'string') {
-      // Check if response data is stringified JSON containing ProblemDetails
-      try {
-        const parsed = JSON.parse(rawResponseData) as any;
-        if (isProblemDetailsObject(parsed)) {
-          isProblemDetails = true;
-          rawTitle = parsed.title || parsed.Title || undefined;
-          rawDetail = parsed.detail || parsed.Detail || undefined;
-          statusCode = parsed.status || parsed.Status || statusCode;
-          rawErrors = parsed.errors ?? parsed.Errors ?? parsed.errorList ?? parsed.ErrorList;
-        } else if (Array.isArray(parsed)) {
-          rawErrors = parsed;
-        } else {
-          rawDetail = cleanTechnicalJargon(rawResponseData);
-        }
-      } catch {
-        if (!rawResponseData.includes('<html')) {
-          rawDetail = cleanTechnicalJargon(rawResponseData);
+      if (isRawHttpOutput(rawResponseData)) {
+        technicalSummary = sanitizeTechnicalDetails(rawResponseData);
+        rawDetail = undefined;
+      } else {
+        // Check if response data is stringified JSON containing ProblemDetails
+        try {
+          const parsed = JSON.parse(rawResponseData) as any;
+          if (isProblemDetailsObject(parsed)) {
+            isProblemDetails = true;
+            rawTitle = parsed.title || parsed.Title || undefined;
+            rawDetail = parsed.detail || parsed.Detail || undefined;
+            statusCode = parsed.status || parsed.Status || statusCode;
+            rawErrors = parsed.errors ?? parsed.Errors ?? parsed.errorList ?? parsed.ErrorList;
+          } else if (Array.isArray(parsed)) {
+            rawErrors = parsed;
+          } else {
+            rawDetail = cleanTechnicalJargon(rawResponseData);
+          }
+        } catch {
+          if (!rawResponseData.includes('<html')) {
+            rawDetail = cleanTechnicalJargon(rawResponseData);
+          }
         }
       }
     }
@@ -481,6 +527,6 @@ export function parseFriendlyError(
     categoryLabel,
     fieldErrors: fieldErrors.length > 0 ? fieldErrors : undefined,
     errorsList: errorsList.length > 0 ? errorsList : undefined,
-    technicalDetails: technicalSummary || (statusCode ? `HTTP Status ${statusCode}` : undefined),
+    technicalDetails: technicalSummary ? sanitizeTechnicalDetails(technicalSummary) : (statusCode ? `HTTP Status ${statusCode}` : undefined),
   };
 }