fix(keeper): redact upstream errors from keeper health responses (#276)

services/keeper/src/status-server.test.ts

@@ -180,6 +180,38 @@ test("GET /healthz returns 503 when drand is down", async () => {
       assert.equal(res.status, 503);
       const body = res.body as Record<string, unknown>;
       assert.equal(body.ok, false);
+      assert.equal(body.reason, "health check failed");
+      assert.doesNotMatch(JSON.stringify(body), /drand down/);
+    },
+  );
+});
+
+test("GET /healthz redacts secret-bearing upstream errors from the response body", async () => {
+  const secretRpc = "https://rpc.example.internal/secret-token-abc123";
+  await withServer(
+    makeSource({
+      reader: {
+        getRound: async () => {
+          throw new Error(`connection refused to ${secretRpc}`);
+        },
+        getBidState: async () => ({ revealed_value: null }) as never,
+      },
+      drand: {
+        chain: () => ({
+          info: async () => {
+            throw new Error(`connection refused to ${secretRpc}`);
+          },
+        }),
+      } as never,
+    }),
+    async (server) => {
+      const res = await get(server, "/healthz");
+      assert.equal(res.status, 503);
+      const body = res.body as Record<string, unknown>;
+      assert.equal(body.reason, "health check failed");
+      const serialized = JSON.stringify(body);
+      assert.doesNotMatch(serialized, /secret-token-abc123/);
+      assert.doesNotMatch(serialized, /rpc\.example\.internal/);
     },
   );
 });

services/keeper/src/status-server.ts

@@ -140,11 +140,13 @@ function healthzHandler(
         },
       };
     } catch (e) {
+      const detail = e instanceof Error ? e.message : String(e);
+      console.error("[keeper-healthz] health check failed:", detail);
       return {
         status: 503,
         body: {
           ok: false,
-          reason: e instanceof Error ? e.message : String(e),
+          reason: "health check failed",
           now: clock.toISOString(),
         },
       };

services/keeper/src/status.test.ts

@@ -282,6 +282,31 @@ describe("buildKeeperStatus — upstream failure", () => {
     assert.match(String(health.reason ?? ""), /drand/);
   });
 
+  it("redacts upstream error details from health reason", async () => {
+    const secretUrl = "https://rpc.internal.example/secret-key-xyz";
+    const reader = {
+      getRound: async () => {
+        throw new Error(`connection refused: ${secretUrl}`);
+      },
+      getBidState: async () => ({ revealed_value: null }) as never,
+    };
+    const drand = {
+      chain: () => ({
+        info: async () => {
+          throw new Error(`timeout contacting ${secretUrl}`);
+        },
+      }),
+    } as never;
+
+    const health = await checkHealth(reader, drand);
+    assert.equal(health.rpc, "down");
+    assert.equal(health.drand, "down");
+    assert.equal(health.reason, "rpc: unavailable; drand: unavailable");
+    const serialized = JSON.stringify(health);
+    assert.doesNotMatch(serialized, /secret-key-xyz/);
+    assert.doesNotMatch(serialized, /rpc\.internal\.example/);
+  });
+
   it("does not crash when a tracked round is missing on-chain", async () => {
     const source = makeSource({
       reader: readerNotFound(),

services/keeper/src/status.ts

@@ -293,15 +293,18 @@ export async function checkHealth(
       // healthy-enough: reachable
     } else {
       rpc = "down";
-      reasons.push(`rpc: ${msg}`);
+      console.error("[keeper-health] rpc probe failed:", msg);
+      reasons.push("rpc: unavailable");
     }
   }
 
   try {
     await drand.chain().info();
   } catch (e) {
     drandStatus = "down";
-    reasons.push(`drand: ${e instanceof Error ? e.message : String(e)}`);
+    const msg = e instanceof Error ? e.message : String(e);
+    console.error("[keeper-health] drand probe failed:", msg);
+    reasons.push("drand: unavailable");
   }
 
   const worst = rpc === "down" || drandStatus === "down" ? "down" : "ok";