Expose safe actionable upload diagnostics

tests/upload-diagnostics.test.js

@@ -25,3 +25,40 @@ test('bereinigt Zugangsdaten und mehrere URLs aus Hosterantworten', () => {
 
   assert.equal(result.responseSnippet, 'token=[redacted] one.example/a password: [redacted] two.example/b');
 });
+
+test('behält sichere Transportdetails für eine konkrete Fehleranalyse', () => {
+  const result = normalizeFailureDetails({
+    phase: 'web-upload-confirmation',
+    http: 502,
+    contentType: 'application/json',
+    safeEndpointHost: 'upload.doodstream.com',
+    responseKind: 'json',
+    retryable: true,
+    payloadSnippet: 'json response (148 bytes)'
+  });
+
+  assert.deepEqual(result, {
+    phase: 'web-upload-confirmation',
+    httpStatus: 502,
+    contentType: 'application/json',
+    endpointHost: 'upload.doodstream.com',
+    responseKind: 'json',
+    retryable: true,
+    responseSnippet: 'json response (148 bytes)'
+  });
+});
+
+test('verwirft unsichere Transportfelder und unbenannte lange Geheimnisse', () => {
+  const secret = 'SYNTHETIC_UNNAMED_SECRET_1234567890';
+  const result = normalizeFailureDetails({
+    phase: `upload ${secret}`,
+    safeEndpointHost: `evil.example/${secret}`,
+    responseKind: `json-${secret}`,
+    payloadSnippet: `Authorization: Bearer ${secret}`
+  });
+
+  assert.equal(result.phase, 'upload [redacted]');
+  assert.equal(result.endpointHost, undefined);
+  assert.equal(result.responseKind, undefined);
+  assert.doesNotMatch(JSON.stringify(result), /SYNTHETIC_UNNAMED_SECRET/);
+});