fix: Redact all credential-bearing URL components in the status dbServer field

[keelerm84]

Summary

util.RedactURL only replaced a password inside a URL's userinfo, and returned an unparseable URL verbatim. ConfigureDataStore then published the Consul host and the DynamoDB endpoint URL into DBServer without redacting either. The status resource is unauthenticated, so a secret in the username position, in a query parameter, or in a fragment was exposed.

RedactURL now replaces the userinfo, query and fragment independently, each only when it is present, and replaces a URL entirely when it cannot be parsed. Two shapes needed care:

• A non-hierarchical scheme:rest URL keeps everything, userinfo included, in URL.Opaque. The config layer accepts these, since url.IsAbs is true, so a missing // must not publish the credential verbatim. Only the part up to the last @ is redacted.
• url.Parse also reports a bare host:port as a scheme plus an opaque body, and Consul's dbServer is exactly that shape, so redacting the whole opaque body would destroy the port.

The scheme, host, port and path survive so the result stays useful for diagnostics. The path is deliberately preserved, which means the result is not safe for a URL that embeds a credential in a path segment; docs/endpoints.md states that limitation rather than leaving it implied.

The Consul store itself still receives the real address. Only the displayed copy is redacted.

This brings v9 to parity with v8 #846.

Not affected

• internal/httpconfig/httpconfig.go redacts its proxy URL with url.Redacted() directly rather than util.RedactURL, so its behavior and its test expectations are unchanged.
• internal/sdks/big_segments.go is a third RedactURL caller that benefits automatically; it had no redaction assertions to update.
• integrationtests/database_params_test.go needs no change: its DBServer expectations use Consul and DynamoDB addresses that carry no credentials, so redaction is a no-op there.

---

Note

Overview
Strengthens URL redaction so secrets are not exposed on the unauthenticated /status dataStoreStatus.dbServer field (and related logs).

util.RedactURL now replaces userinfo, query, and fragment with xxxxx (not only passwords), handles unparseable URLs and scheme:opaque shapes, and keeps host/port/path for diagnostics—with a documented exception that path segments are not redacted. ConfigureDataStore applies this to Consul hosts and DynamoDB endpoint URLs in status info and Info logs; Redis expectations/tests now cover username-only secrets and query/fragment redaction. Docs describe the redaction rules for dbServer.

^{Reviewed by Cursor Bugbot for commit 3e58558. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 04b53bc. Configure here.}