[MM-63760] Only partially sanitize DB datasources for Support Packet (#30728)

Co-authored-by: Claude <noreply@anthropic.com>

server/channels/app/config.go

@@ -226,11 +226,11 @@ func (a *App) SanitizedConfig(cfg *model.Config) {
 	if err != nil {
 		// GetPluginManifests might error, e.g. when plugins are disabled.
 		// Sanitize all plugin settings in this case.
-		cfg.Sanitize(nil)
+		cfg.Sanitize(nil, nil)
 		return
 	}
 
-	cfg.Sanitize(manifests)
+	cfg.Sanitize(manifests, nil)
 }
 
 // GetEnvironmentConfig returns a map of configuration keys whose values have been overridden by an environment variable.

server/channels/app/platform/config.go

@@ -42,7 +42,7 @@ func (ps *PlatformService) Config() *model.Config {
 }
 
 // getSanitizedConfig gets the configuration without any secrets.
-func (ps *PlatformService) getSanitizedConfig(rctx request.CTX) *model.Config {
+func (ps *PlatformService) getSanitizedConfig(rctx request.CTX, opts *model.SanitizeOptions) *model.Config {
 	cfg := ps.Config().Clone()
 
 	manifests, err := ps.getPluginManifests()
@@ -50,9 +50,9 @@ func (ps *PlatformService) getSanitizedConfig(rctx request.CTX) *model.Config {
 		// getPluginManifests might error, e.g. when plugins are disabled.
 		// Sanitize all plugin settings in this case.
 		rctx.Logger().Warn("Failed to get plugin manifests for config sanitization. Will sanitize all plugin settings.", mlog.Err(err))
-		cfg.Sanitize(nil)
+		cfg.Sanitize(nil, opts)
 	} else {
-		cfg.Sanitize(manifests)
+		cfg.Sanitize(manifests, opts)
 	}
 
 	return cfg

server/channels/app/platform/support_packet.go

@@ -196,7 +196,7 @@ func (ps *PlatformService) getSupportPacketDiagnostics(rctx request.CTX) (*model
 }
 
 func (ps *PlatformService) getSanitizedConfigFile(rctx request.CTX) (*model.FileData, error) {
-	config := ps.getSanitizedConfig(rctx)
+	config := ps.getSanitizedConfig(rctx, &model.SanitizeOptions{PartiallyRedactDataSources: true})
 	spConfig := model.SupportPacketConfig{
 		Config:       config,
 		FeatureFlags: *config.FeatureFlags,

server/channels/app/platform/support_packet_test.go

@@ -360,13 +360,18 @@ func TestGetSanitizedConfigFile(t *testing.T) {
 	require.NoError(t, err)
 
 	// Ensure sensitive fields are redacted
-	assert.Equal(t, model.FakeSetting, *config.SqlSettings.DataSource)
+	assert.Equal(t, model.FakeSetting, *config.FileSettings.PublicLinkSalt)
 
 	// Ensure non-sensitive fields are present
 	assert.Equal(t, "example.com", *config.ServiceSettings.AllowedUntrustedInternalConnections)
 
 	// Ensure feature flags are present
 	assert.Equal(t, "true", config.FeatureFlags.TestFeature)
+
+	// Ensure DataSource is partially sanitized (not completely replaced with FakeSetting)
+	// The default test database connection string should have username/password redacted
+	assert.Contains(t, *config.SqlSettings.DataSource, "****:****")
+	assert.NotEqual(t, model.FakeSetting, *config.SqlSettings.DataSource)
 }
 
 func TestGetCPUProfile(t *testing.T) {