[fix][core] do not keep the request's credentials in stored documents (24.05)

[ar2rsawseen]

Why

api_key and auth_token are accepted as request parameters (api/utils/rights.js). Any handler that keeps input it does not recognise therefore persists the caller's own credential into the document, and a read that returns the document hands that credential to everyone allowed to read it. That is exactly how a date preset came to disclose its owner's api key.

Four subsystems store a parsed client payload without declaring their own field set:

Handler	Write paths	Read
remote-config parameters and conditions	4	dashboard list, unprojected
alerts	1	/o/alert/list, unprojected
hooks	1	/o/hook/list, unprojected
ab-testing experiments	2	dashboard, unprojected

What this does, and what it does not

common.stripRequestCredentials(doc) removes api_key and auth_token from an object about to be written. It is called on the parsed payload at each of those write paths.

This is the floor, not the fix. Only storing declared fields is the fix, and it needs a per-plugin survey of every writer plus the fields the UI round-trips through storage, which is a larger change with real regression risk for each plugin. This change is deliberately the part that needs no knowledge of the payload's shape: a handler that cannot enumerate itself can still refuse to keep a credential.

Top level only, deliberately. That is where a copy of the request puts them. A value the caller nested inside their own payload is their own to disclose, and descending to arbitrary depth would mean guessing at shapes. The test pins that boundary.

It sits next to common.reqInfo, which already keeps request api_key out of the logs for the same reason.

Notes on the branches

• release.24.05's hooks has two parse sites where master has one, the second being /i/hook/test, which runs a mock rather than storing. Stripped there as well, for consistency and at no cost.
• In countly-enterprise-plugins the two lines are written out rather than calling common, because ab-testing resolves common from the server tree at runtime and this way the change does not depend on which repo merges first.

Tests

test/unit-tests/api.utils.common.request-credentials.js, 4 cases: both parameters removed, everything else untouched including a nested api_key, the same object returned so it can be used inline, and non-objects tolerated.