MONGOID-5937 redact credentials from client config error messages

[comandeo-mongo]

Description

Connection-config validation errors leaked credentials into their messages.
NoClientDatabase, NoClientHosts, and MixedClientConfiguration passed
the raw client configuration hash to compose_message, which the locale
YAML interpolates verbatim via %{config}.

When mongoid.yml contains a uri: with embedded userinfo, a top-level
password:, or options.auto_encryption_options.kms_providers
(AWS access keys, GCP private keys, raw 96-byte local master keys), those
secrets ended up in the exception message. MixedClientConfiguration is
not rescued in the Railtie, so it propagates to Rails' error reporter and
from there to Sentry, Bugsnag, Datadog, and similar trackers.

Fix

Add Mongoid::Errors::ConfigRedactor.redact, which returns a copy of the
config hash with:

• :password and :auto_encryption_options (string or symbol keys, at any nesting depth) replaced with [REDACTED].
• The userinfo of any string :uri value stripped (e.g. mongodb://admin:s3cr3t@host becomes mongodb://[REDACTED]@host). Also handles mongodb+srv://.

The three error classes call the redactor before passing the hash to
compose_message. The original config hash is not mutated.

Notes

• The ticket description originally suggested Mongo::URI#sanitized, but that method does not exist in the driver. The URI in mongoid.yml is a raw string at this point, so redaction is implemented locally.
• NoClientDatabase and NoClientHosts only fire when no :uri is present (no_database_or_uri? / no_hosts_or_uri?), so a URI with embedded credentials cannot leak via those two paths. They still leak :password and :auto_encryption_options, both of which are now redacted.

Test plan

• Unit tests for ConfigRedactor covering URI sanitization, :password and :auto_encryption_options redaction (string and symbol keys, nested), non-mutation of input
• Per-error tests asserting s3cr3t, kms_providers, AKIA…, and 96-byte master key material no longer appear in exception messages
• Existing Validators::Client integration tests in spec/mongoid/config_spec.rb still pass
• bundle exec rubocop clean on all changed files

[Copilot]

Pull request overview

This PR prevents sensitive credentials from leaking into Mongoid client configuration validation error messages by redacting secrets before interpolating the config hash into i18n error templates.

Changes:

• Introduces Mongoid::Errors::ConfigRedactor.redact to copy-and-redact client config hashes (passwords, auto-encryption options, and URI userinfo).
• Updates NoClientDatabase, NoClientHosts, and MixedClientConfiguration to pass redacted configs to compose_message.
• Adds unit and regression specs to ensure secrets (passwords, KMS provider material, and URI credentials) do not appear in exception messages.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
lib/mongoid/errors/config_redactor.rb	Adds redaction utility for sensitive config fields and URI userinfo.
lib/mongoid/errors/no_client_hosts.rb	Uses redacted config when composing error message.
lib/mongoid/errors/no_client_database.rb	Uses redacted config when composing error message.
lib/mongoid/errors/mixed_client_configuration.rb	Uses redacted config when composing error message.
lib/mongoid/errors.rb	Requires the new redactor module.
spec/mongoid/errors/config_redactor_spec.rb	Adds unit coverage for redaction behavior and non-mutation.
spec/mongoid/errors/no_client_hosts_spec.rb	Adds regression expectations for redaction in error messages.
spec/mongoid/errors/no_client_database_spec.rb	Adds regression expectations for redaction in error messages.
spec/mongoid/errors/mixed_client_configuration_spec.rb	Adds regression expectations for URI/userinfo and other secret redaction.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.