Mask tokens when exporting onyx state

src/libs/ExportOnyxState/common.ts

@@ -1,5 +1,22 @@
 import {Str} from 'expensify-common';
 import ONYXKEYS from '@src/ONYXKEYS';
+import type {Session} from '@src/types/onyx';
+
+const maskSessionDetails = (data: Record<string, unknown>): Record<string, unknown> => {
+    const session = data.session as Session;
+
+    Object.keys(session).forEach((key) => {
+        if (key !== 'authToken' && key !== 'encryptedAuthToken') {
+            return;
+        }
+        session[key] = '***';
+    });
+
+    return {
+        ...data,
+        session,
+    };
+};
 
 const maskFragileData = (data: Record<string, unknown>, parentKey?: string): Record<string, unknown> => {
     const maskedData: Record<string, unknown> = {};
@@ -15,7 +32,7 @@ const maskFragileData = (data: Record<string, unknown>, parentKey?: string): Rec
 
         const value = data[key];
 
-        if (typeof value === 'string' && (Str.isValidEmail(value) || key === 'authToken' || key === 'encryptedAuthToken')) {
+        if (typeof value === 'string' && Str.isValidEmail(value)) {
             maskedData[key] = '***';
         } else if (parentKey && parentKey.includes(ONYXKEYS.COLLECTION.REPORT_ACTIONS) && (key === 'text' || key === 'html')) {
             maskedData[key] = '***';
@@ -29,6 +46,16 @@ const maskFragileData = (data: Record<string, unknown>, parentKey?: string): Rec
     return maskedData;
 };
 
-export default {
-    maskFragileData,
+const maskOnyxState = (data: Record<string, unknown>, isMaskingFragileDataEnabled?: boolean) => {
+    let onyxState = data;
+    // Mask session details by default
+    onyxState = maskSessionDetails(data);
+    // Mask fragile data other than session details if the user has enabled the option
+    if (isMaskingFragileDataEnabled) {
+        onyxState = maskFragileData(data);
+    }
+
+    return onyxState;
 };
+
+export default maskOnyxState;

src/libs/ExportOnyxState/index.native.ts

@@ -2,7 +2,7 @@ import RNFS from 'react-native-fs';
 import {open} from 'react-native-quick-sqlite';
 import Share from 'react-native-share';
 import CONST from '@src/CONST';
-import common from './common';
+import maskOnyxState from './common';
 
 const readFromOnyxDatabase = () =>
     new Promise((resolve) => {
@@ -36,7 +36,7 @@ const shareAsFile = (value: string) => {
 };
 
 export default {
-    maskFragileData: common.maskFragileData,
+    maskOnyxState,
     readFromOnyxDatabase,
     shareAsFile,
 };

src/libs/ExportOnyxState/index.ts

@@ -1,5 +1,5 @@
 import CONST from '@src/CONST';
-import common from './common';
+import maskOnyxState from './common';
 
 const readFromOnyxDatabase = () =>
     new Promise<Record<string, unknown>>((resolve) => {
@@ -44,7 +44,7 @@ const shareAsFile = (value: string) => {
 };
 
 export default {
-    maskFragileData: common.maskFragileData,
+    maskOnyxState,
     readFromOnyxDatabase,
     shareAsFile,
 };

src/pages/settings/Troubleshoot/TroubleshootPage.tsx

@@ -57,11 +57,7 @@ function TroubleshootPage({shouldStoreLogs, shouldMaskOnyxState}: TroubleshootPa
 
     const exportOnyxState = useCallback(() => {
         ExportOnyxState.readFromOnyxDatabase().then((value: Record<string, unknown>) => {
-            let dataToShare = value;
-            if (shouldMaskOnyxState) {
-                dataToShare = ExportOnyxState.maskFragileData(value);
-            }
-
+            const dataToShare = ExportOnyxState.maskOnyxState(value, shouldMaskOnyxState);
             ExportOnyxState.shareAsFile(JSON.stringify(dataToShare));
         });
     }, [shouldMaskOnyxState]);

tests/unit/ExportOnyxStateTest.ts

@@ -0,0 +1,45 @@
+import maskOnyxState from '@libs/ExportOnyxState/common';
+import type * as OnyxTypes from '@src/types/onyx';
+
+type ExampleOnyxState = {
+    session: OnyxTypes.Session;
+};
+
+describe('maskOnyxState', () => {
+    const mockSession = {
+        authToken: 'sensitive-auth-token',
+        encryptedAuthToken: 'sensitive-encrypted-token',
+        email: 'user@example.com',
+        accountID: 12345,
+    };
+
+    it('should mask session details by default', () => {
+        const input = {session: mockSession};
+        const result = maskOnyxState(input) as ExampleOnyxState;
+
+        expect(result.session.authToken).toBe('***');
+        expect(result.session.encryptedAuthToken).toBe('***');
+    });
+
+    it('should not mask fragile data when isMaskingFragileDataEnabled is false', () => {
+        const input = {
+            session: mockSession,
+        };
+        const result = maskOnyxState(input) as ExampleOnyxState;
+
+        expect(result.session.authToken).toBe('***');
+        expect(result.session.encryptedAuthToken).toBe('***');
+        expect(result.session.email).toBe('user@example.com');
+    });
+
+    it('should mask fragile data when isMaskingFragileDataEnabled is true', () => {
+        const input = {
+            session: mockSession,
+        };
+        const result = maskOnyxState(input, true) as ExampleOnyxState;
+
+        expect(result.session.authToken).toBe('***');
+        expect(result.session.encryptedAuthToken).toBe('***');
+        expect(result.session.email).toBe('***');
+    });
+});