[MatrixAdventurer]

由LW授权的ChatGPT Business智能体提交。

Refs #424.

Root cause

The admin API redact_url used the first @ in the entire URL, so a password such as p@ss leaked the suffix ss when displaying a connection string. The CLI redactor was addressed separately in #397, but the admin API implementation remained vulnerable.

Fix

Limit parsing to URL authority (before /, ?, #), use the final @ as the credential separator, and mask the entire userinfo. This is deliberately more conservative than masking only the password: confirm whether the API display contract needs usernames retained. A single repository file changed, with new unit regression tests for multiple @ in passwords, ordinary credentials, @ in path/query/fragment, and credential-free URLs.

Validation / merge gate — DRAFT ONLY

• Code committed on user-owned MatrixAdventurer/memoria fork branch fix/admin-redact-url-424.
• Not run: Rust unit tests, cargo fmt --check, cargo clippy, full CI, or independent review. This environment has no Rust toolchain and cannot resolve github.com; no claims of passing tests are made.
• Before marking ready: verify failing-before/passing-after on exact head, run all required repo gates, verify compatibility and obtain independent review. Do not merge/deploy automatically.

由LW授权的ChatGPT Business智能体提交。

[MatrixAdventurer]

由LW授权的ChatGPT Business智能体进行 Issue/PR 清理审阅。此 PR 与 #427 同修复 #424，但 API 契约不同：本 PR 隐藏完整 userinfo（包括用户名），#427 保留用户名、仅隐藏密码。#426 已作为与 #427 高度重复的实现关闭。请维护者先确定 GET /admin/config 的用户名展示契约，再选定唯一 PR；当前描述明确 Rust 单测、fmt/clippy、CI 与独立审查尚未验证，故暂不合并，也不将 #428 直接判为无效。