Feature 08 task 2: OpenAI-compatible adapter (#35)

Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com>
Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>

internal/ai/llm/errors.go

@@ -26,13 +26,32 @@ var (
 )
 
 // RateLimitedError is a throttled request. It matches ErrRateLimited.
+// Adapters build it with NewRateLimitedError so its text never holds their
+// credential.
 type RateLimitedError struct {
 	// RetryAfter is how long the vendor asked callers to wait; 0 means it
 	// did not say.
 	RetryAfter time.Duration
+	// text is the redacted Error text set by NewRateLimitedError; "" means
+	// the error was built without a credential.
+	text string
+}
+
+// NewRateLimitedError returns the error for a throttled request. secret is
+// the credential sent with the request, or "" when the request sent none.
+// Every occurrence of a non-empty secret is removed from the error text
+// when it is built, even where the fixed text happens to spell it, and the
+// secret itself is not kept.
+func NewRateLimitedError(retryAfter time.Duration, secret string) *RateLimitedError {
+	e := &RateLimitedError{RetryAfter: retryAfter}
+	e.text = Redact(e.Error(), secret)
+	return e
 }
 
 func (e *RateLimitedError) Error() string {
+	if e.text != "" {
+		return e.text
+	}
 	if e.RetryAfter == 0 {
 		return ErrRateLimited.Error()
 	}
@@ -46,58 +65,68 @@ func (e *RateLimitedError) Is(target error) bool { return target == ErrRateLimit
 // ProviderError keeps.
 const MaxBodyExcerpt = 512
 
-// redacted replaces each secret in a ProviderError body.
-const redacted = "[REDACTED]"
+// redactionMarker replaces each secret in redacted text, unless the marker
+// would itself hold the secret.
+const redactionMarker = "[REDACTED]"
+
+// Redact returns s with every occurrence of a non-empty secret removed. Each
+// occurrence becomes "[REDACTED]" when the result then holds no secret;
+// otherwise, because the marker contains the secret or joins with its
+// neighbours to form it, occurrences are deleted until none remains. The
+// result never contains secret.
+func Redact(s, secret string) string {
+	if secret == "" {
+		return s
+	}
+	if out := strings.ReplaceAll(s, secret, redactionMarker); !strings.Contains(out, secret) {
+		return out
+	}
+	for strings.Contains(s, secret) {
+		s = strings.ReplaceAll(s, secret, "")
+	}
+	return s
+}
 
 // ProviderError is an unexpected HTTP status from the vendor. It matches
 // ErrProvider. Build it with NewProviderError, which redacts the body.
 type ProviderError struct {
 	status int
 	body   string
+	text   string
 }
 
-// NewProviderError returns the error for an unexpected HTTP status.
-// secrets must hold the API key (and any other credential sent with the
-// request). Every occurrence of each non-empty secret in body is replaced
-// before the body is cut to MaxBodyExcerpt bytes, so no part of a secret
-// survives. If secrets holds no non-empty value the body cannot be
-// redacted, so no excerpt is kept at all.
-func NewProviderError(status int, body []byte, secrets []string) *ProviderError {
-	s := string(body)
-	redactedAny := false
-	for _, secret := range secrets {
-		if secret != "" {
-			s = strings.ReplaceAll(s, secret, redacted)
-			redactedAny = true
-		}
-	}
-	if !redactedAny {
-		return &ProviderError{status: status}
-	}
-	s = strings.TrimSpace(s)
+// NewProviderError returns the error for an unexpected HTTP status. It
+// always keeps a body excerpt of at most MaxBodyExcerpt bytes. secret is the
+// credential sent with the request, or "" when the request sent none; every
+// occurrence of a non-empty secret in body is removed by Redact before the
+// body is cut, so no part of it survives, and again after the cut, so the
+// truncation mark cannot complete it. It is removed from the complete error
+// text too, even where the fixed text happens to spell it, and the secret
+// itself is not kept.
+func NewProviderError(status int, body []byte, secret string) *ProviderError {
+	s := strings.TrimSpace(Redact(string(body), secret))
 	if len(s) > MaxBodyExcerpt {
 		cut := MaxBodyExcerpt
 		for cut > 0 && !utf8.RuneStart(s[cut]) {
 			cut--
 		}
-		s = s[:cut] + "…"
+		s = Redact(s[:cut]+"…", secret)
 	}
-	return &ProviderError{status: status, body: s}
+	text := fmt.Sprintf("%s: HTTP %d", ErrProvider, status)
+	if s != "" {
+		text += ": " + s
+	}
+	return &ProviderError{status: status, body: s, text: Redact(text, secret)}
 }
 
 // Status returns the HTTP status code.
 func (e *ProviderError) Status() int { return e.status }
 
 // Body returns the redacted, truncated response-body excerpt; it is empty
-// when the vendor sent no body or no secret was given to redact it with.
+// when the vendor sent no body.
 func (e *ProviderError) Body() string { return e.body }
 
-func (e *ProviderError) Error() string {
-	if e.body == "" {
-		return fmt.Sprintf("%s: HTTP %d", ErrProvider, e.status)
-	}
-	return fmt.Sprintf("%s: HTTP %d: %s", ErrProvider, e.status, e.body)
-}
+func (e *ProviderError) Error() string { return e.text }
 
 // Is reports whether target is ErrProvider.
 func (e *ProviderError) Is(target error) bool { return target == ErrProvider }