From 51bdf2f6b38de37d813975a989cfc20d83f6c9aa Mon Sep 17 00:00:00 2001
From: Corey Haines <34802794+coreyhaines31@users.noreply.github.com>
Date: Tue, 17 Feb 2026 22:40:03 -0800
Subject: [PATCH] fix: correct auth issues in amplitude, livestorm, mixpanel,
 onesignal

- amplitude: mask api_key in dry-run body output
- livestorm: add missing Bearer prefix to Authorization header
- mixpanel: mask token/$token in dry-run ingestion body output
- onesignal: change auth from 'Key' to 'Basic' per OneSignal REST API docs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 tools/clis/amplitude.js | 4 +++-
 tools/clis/livestorm.js | 2 +-
 tools/clis/mixpanel.js  | 7 ++++++-
 tools/clis/onesignal.js | 2 +-
 4 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/tools/clis/amplitude.js b/tools/clis/amplitude.js
index 84128c4..a1321f4 100755
--- a/tools/clis/amplitude.js
+++ b/tools/clis/amplitude.js
@@ -12,7 +12,9 @@ if (!API_KEY) {
 
 async function ingestApi(method, path, body) {
   if (args['dry-run']) {
-    return { _dry_run: true, method, url: `${INGESTION_URL}${path}`, headers: { 'Content-Type': 'application/json' }, body: body || undefined }
+    const maskedBody = body ? JSON.parse(JSON.stringify(body)) : undefined
+    if (maskedBody && maskedBody.api_key) maskedBody.api_key = '***'
+    return { _dry_run: true, method, url: `${INGESTION_URL}${path}`, headers: { 'Content-Type': 'application/json' }, body: maskedBody }
   }
   const res = await fetch(`${INGESTION_URL}${path}`, {
     method,
diff --git a/tools/clis/livestorm.js b/tools/clis/livestorm.js
index b393e32..23df978 100755
--- a/tools/clis/livestorm.js
+++ b/tools/clis/livestorm.js
@@ -10,7 +10,7 @@ if (!API_TOKEN) {
 
 async function api(method, path, body) {
   const headers = {
-    'Authorization': API_TOKEN,
+    'Authorization': `Bearer ${API_TOKEN}`,
     'Content-Type': 'application/vnd.api+json',
     'Accept': 'application/vnd.api+json',
   }
diff --git a/tools/clis/mixpanel.js b/tools/clis/mixpanel.js
index e6cf02d..cae1ad3 100755
--- a/tools/clis/mixpanel.js
+++ b/tools/clis/mixpanel.js
@@ -15,7 +15,12 @@ if (!TOKEN && !API_KEY) {
 async function ingestApi(method, path, body) {
   const headers = { 'Content-Type': 'application/json' }
   if (args['dry-run']) {
-    return { _dry_run: true, method, url: `${INGESTION_URL}${path}`, headers, body: body || undefined }
+    const maskedBody = body ? JSON.parse(JSON.stringify(body)) : undefined
+    if (Array.isArray(maskedBody)) maskedBody.forEach(item => {
+      if (item.properties && item.properties.token) item.properties.token = '***'
+      if (item.$token) item.$token = '***'
+    })
+    return { _dry_run: true, method, url: `${INGESTION_URL}${path}`, headers, body: maskedBody }
   }
   const res = await fetch(`${INGESTION_URL}${path}`, {
     method,
diff --git a/tools/clis/onesignal.js b/tools/clis/onesignal.js
index 42bf0f9..408ecd7 100755
--- a/tools/clis/onesignal.js
+++ b/tools/clis/onesignal.js
@@ -16,7 +16,7 @@ if (!APP_ID) {
 
 async function api(method, path, body) {
   const headers = {
-    'Authorization': `Key ${REST_API_KEY}`,
+    'Authorization': `Basic ${REST_API_KEY}`,
     'Content-Type': 'application/json',
     'Accept': 'application/json',
   }