From 5040e42c6cda4296153cfd5f9178cded27535b8f Mon Sep 17 00:00:00 2001
From: Salman Chishti <salmanmkc@GitHub.com>
Date: Fri, 7 Mar 2025 06:01:25 -0800
Subject: [PATCH] Instead of using utility method in core lib, use method in
 both twirp clients

---
 __tests__/artifactTwirpClient.test.ts        | 28 ++++++++++++++------
 src/internal/shared/artifact-twirp-client.ts | 19 ++++++++++---
 2 files changed, 36 insertions(+), 11 deletions(-)

diff --git a/__tests__/artifactTwirpClient.test.ts b/__tests__/artifactTwirpClient.test.ts
index 035031e..882c7ef 100644
--- a/__tests__/artifactTwirpClient.test.ts
+++ b/__tests__/artifactTwirpClient.test.ts
@@ -30,24 +30,30 @@ describe('ArtifactHttpClient', () => {
     it('should mask signed_upload_url', () => {
       const response: CreateArtifactResponse = {
         ok: true,
-        signedUploadUrl: 'https://example.com/upload?se=2025-03-05T16%3A47%3A23Z&sig=secret-token'
+        signedUploadUrl:
+          'https://example.com/upload?se=2025-03-05T16%3A47%3A23Z&sig=secret-token'
       }
 
       client.maskSecretUrls(response)
 
       expect(setSecret).toHaveBeenCalledWith('secret-token')
-      expect(debug).toHaveBeenCalledWith('Masked signed_upload_url: https://example.com/upload?se=2025-03-05T16%3A47%3A23Z&sig=***')
+      expect(debug).toHaveBeenCalledWith(
+        'Masked signed_upload_url: https://example.com/upload?se=2025-03-05T16%3A47%3A23Z&sig=***'
+      )
     })
 
     it('should mask signed_download_url', () => {
       const response: GetSignedArtifactURLResponse = {
-        signedUrl: 'https://example.com/download?se=2025-03-05T16%3A47%3A23Z&sig=secret-token'
+        signedUrl:
+          'https://example.com/download?se=2025-03-05T16%3A47%3A23Z&sig=secret-token'
       }
 
       client.maskSecretUrls(response)
 
       expect(setSecret).toHaveBeenCalledWith('secret-token')
-      expect(debug).toHaveBeenCalledWith('Masked signed_download_url: https://example.com/download?se=2025-03-05T16%3A47%3A23Z&sig=***')
+      expect(debug).toHaveBeenCalledWith(
+        'Masked signed_url: https://example.com/download?se=2025-03-05T16%3A47%3A23Z&sig=***'
+      )
     })
 
     it('should not call setSecret if URLs are missing', () => {
@@ -61,24 +67,30 @@ describe('ArtifactHttpClient', () => {
     it('should mask only the sensitive token part of signed_upload_url', () => {
       const response: CreateArtifactResponse = {
         ok: true,
-        signedUploadUrl: 'https://example.com/upload?se=2025-03-05T16%3A47%3A23Z&sig=secret-token'
+        signedUploadUrl:
+          'https://example.com/upload?se=2025-03-05T16%3A47%3A23Z&sig=secret-token'
       }
 
       client.maskSecretUrls(response)
 
       expect(setSecret).toHaveBeenCalledWith('secret-token')
-      expect(debug).toHaveBeenCalledWith('Masked signed_upload_url: https://example.com/upload?se=2025-03-05T16%3A47%3A23Z&sig=***')
+      expect(debug).toHaveBeenCalledWith(
+        'Masked signed_upload_url: https://example.com/upload?se=2025-03-05T16%3A47%3A23Z&sig=***'
+      )
     })
 
     it('should mask only the sensitive token part of signed_download_url', () => {
       const response: GetSignedArtifactURLResponse = {
-        signedUrl: 'https://example.com/download?se=2025-03-05T16%3A47%3A23Z&sig=secret-token'
+        signedUrl:
+          'https://example.com/download?se=2025-03-05T16%3A47%3A23Z&sig=secret-token'
       }
 
       client.maskSecretUrls(response)
 
       expect(setSecret).toHaveBeenCalledWith('secret-token')
-      expect(debug).toHaveBeenCalledWith('Masked signed_download_url: https://example.com/download?se=2025-03-05T16%3A47%3A23Z&sig=***')
+      expect(debug).toHaveBeenCalledWith(
+        'Masked signed_url: https://example.com/download?se=2025-03-05T16%3A47%3A23Z&sig=***'
+      )
     })
   })
 })
diff --git a/src/internal/shared/artifact-twirp-client.ts b/src/internal/shared/artifact-twirp-client.ts
index 1d3e8c6..2d38911 100644
--- a/src/internal/shared/artifact-twirp-client.ts
+++ b/src/internal/shared/artifact-twirp-client.ts
@@ -1,6 +1,6 @@
 import {HttpClient, HttpClientResponse, HttpCodes} from '@actions/http-client'
 import {BearerCredentialHandler} from '@actions/http-client/lib/auth'
-import {setSecret, info, debug, maskSigUrl} from '@actions/core'
+import {setSecret, info, debug} from '@actions/core'
 import {ArtifactServiceClientJSON} from '../../generated'
 import {getResultsServiceUrl, getRuntimeToken} from './config'
 import {getUserAgentString} from './user-agent'
@@ -74,14 +74,27 @@ export class ArtifactHttpClient implements Rpc {
     }
   }
 
+  /**
+   * Masks the `sig` parameter in a URL and sets it as a secret.
+   * @param url The URL containing the `sig` parameter.
+   * @param urlType The type of the URL (e.g., 'signed_upload_url', 'signed_download_url').
+   */
+  maskSigUrl(url: string, urlType: string): void {
+    const sigMatch = url.match(/[?&]sig=([^&]+)/)
+    if (sigMatch) {
+      setSecret(sigMatch[1])
+      debug(`Masked ${urlType}: ${url.replace(sigMatch[1], '***')}`)
+    }
+  }
+
   maskSecretUrls(
     body: CreateArtifactResponse | GetSignedArtifactURLResponse
   ): void {
     if ('signedUploadUrl' in body && body.signedUploadUrl) {
-      maskSigUrl(body.signedUploadUrl, 'signed_upload_url')
+      this.maskSigUrl(body.signedUploadUrl, 'signed_upload_url')
     }
     if ('signedUrl' in body && body.signedUrl) {
-      maskSigUrl(body.signedUrl, 'signed_url')
+      this.maskSigUrl(body.signedUrl, 'signed_url')
     }
   }