Apply remaining changes

Author: Copilot

src/services/secret-redactor.ts

@@ -31,6 +31,7 @@ const SECRET_QUERY_PARAMETER_NAMES = new Set([
   'sig',
   'subscription-key',
 ]);
+const BEARER_TOKEN_PATTERN = /^(\s*Bearer)(\s+)(.*?)(\s*)$/i;
 
 export interface PolicySecretFinding {
   location: string;
@@ -91,6 +92,29 @@ function shouldRedactLiteral(value: string): boolean {
   return !isApimNamedValueReference(trimmed);
 }
 
+function redactAuthorizationHeaderValue(
+  value: string
+): { redactedValue: string; wasRedacted: boolean } {
+  const bearerMatch = BEARER_TOKEN_PATTERN.exec(value);
+  if (bearerMatch) {
+    const [, scheme, spacing, tokenValue, suffix] = bearerMatch;
+    if (!shouldRedactLiteral(tokenValue)) {
+      return { redactedValue: value, wasRedacted: false };
+    }
+
+    return {
+      redactedValue: `${scheme}${spacing}${REDACTION_MARKER}${suffix}`,
+      wasRedacted: true,
+    };
+  }
+
+  if (!shouldRedactLiteral(value)) {
+    return { redactedValue: value, wasRedacted: false };
+  }
+
+  return { redactedValue: REDACTION_MARKER, wasRedacted: true };
+}
+
 /**
  * Redact inline literal secrets in policy XML content.
  */
@@ -114,12 +138,19 @@ export function redactPolicySecrets(
     return setHeaderBlock.replace(
       /(<value\b[^>]*>)([\s\S]*?)(<\/value>)/gi,
       (_full, openTag: string, value: string, closeTag: string) => {
-        if (!shouldRedactLiteral(value)) {
+        const shouldRedactHeaderValue = shouldRedactLiteral(value);
+        const { redactedValue, wasRedacted } = headerName === 'authorization'
+          ? redactAuthorizationHeaderValue(value)
+          : {
+              redactedValue: shouldRedactHeaderValue ? REDACTION_MARKER : value,
+              wasRedacted: shouldRedactHeaderValue,
+            };
+        if (!wasRedacted) {
           return `${openTag}${value}${closeTag}`;
         }
 
         addFinding(`set-header[${headerName}]`);
-        return `${openTag}${REDACTION_MARKER}${closeTag}`;
+        return `${openTag}${redactedValue}${closeTag}`;
       }
     );
   });

tests/unit/services/api-product-extractor.test.ts

@@ -263,8 +263,8 @@ describe('api-extractor', () => {
     });
 
     it('should extract API policy and redact inline secrets', async () => {
-      const policyContent = '<policies><inbound><set-header name="Authorization"><value>AUTH_LITERAL_VALUE</value></set-header></inbound></policies>';
-      const redactedPolicy = `<policies><inbound><set-header name="Authorization"><value>${REDACTION_MARKER}</value></set-header></inbound></policies>`;
+      const policyContent = '<policies><inbound><set-header name="Authorization"><value>Bearer TOKEN_LITERAL</value></set-header></inbound></policies>';
+      const redactedPolicy = `<policies><inbound><set-header name="Authorization"><value>Bearer ${REDACTION_MARKER}</value></set-header></inbound></policies>`;
       const client = createMockClient({
         getResource: vi.fn().mockImplementation(async (_ctx: unknown, desc: ResourceDescriptor) => {
           if (desc.type === ResourceType.ApiPolicy) {

tests/unit/services/secret-redactor.test.ts

@@ -114,7 +114,8 @@ describe('secret-redactor', () => {
       const basicAuthPolicy = `<authentication-basic username="user" ${passwordAttribute}="PWD_LITERAL" />`;
       const policyXml = `<policies>
     <inbound>
-      <set-header name="Authorization"><value>AUTH_LITERAL_VALUE</value></set-header>
+      <set-header name="Authorization"><value>Bearer TOKEN_LITERAL</value></set-header>
+      <set-header name="Authorization"><value>Bearer {{jwt-token}}</value></set-header>
       <set-header name="api-key"><value>{{my-api-key}}</value></set-header>
       <set-query-parameter name="sig"><value>abc123</value></set-query-parameter>
       ${basicAuthPolicy}
@@ -128,7 +129,8 @@ describe('secret-redactor', () => {
 
       const { redactedContent, findings } = redactPolicySecrets(policyXml);
 
-      expect(redactedContent).toContain(`<set-header name="Authorization"><value>${REDACTION_MARKER}</value></set-header>`);
+      expect(redactedContent).toContain(`<set-header name="Authorization"><value>Bearer ${REDACTION_MARKER}</value></set-header>`);
+      expect(redactedContent).toContain('<set-header name="Authorization"><value>Bearer {{jwt-token}}</value></set-header>');
       expect(redactedContent).toContain('<set-header name="api-key"><value>{{my-api-key}}</value></set-header>');
       expect(redactedContent).toContain(`<set-query-parameter name="sig"><value>${REDACTION_MARKER}</value></set-query-parameter>`);
       expect(redactedContent).toContain('<authentication-basic username="user"');