From d531200d405fc682afb344c06d899141da163f1b Mon Sep 17 00:00:00 2001
From: xuans <likb_blue@163.com>
Date: Mon, 31 Aug 2026 01:52:36 +0800
Subject: [PATCH] =?UTF-8?q?=E8=A1=A5=E5=85=85=E7=BB=AD=E6=9C=9F=E6=8E=A5?=
 =?UTF-8?q?=E5=8F=A3=E9=94=99=E8=AF=AF=E8=84=B1=E6=95=8F=E6=B5=8B=E8=AF=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/internal/httpapi/settings_api_test.go | 27 +++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/backend/internal/httpapi/settings_api_test.go b/backend/internal/httpapi/settings_api_test.go
index 4738d95..9472905 100644
--- a/backend/internal/httpapi/settings_api_test.go
+++ b/backend/internal/httpapi/settings_api_test.go
@@ -365,6 +365,33 @@ func TestRenewalAPIUsesConfiguredRunner(t *testing.T) {
 	}
 }
 
+func TestRenewalAPIHidesWorkflowErrors(t *testing.T) {
+	cfg := config.Default(t.TempDir())
+	cfg.SetupReady = true
+	cfg.Admin.Username = "admin"
+	cfg.Admin.PasswordHash = mustTestPasswordHash(t, "Password123")
+	server := New(Dependencies{
+		Config: cfg,
+		RunRenewal: func(context.Context) (certificate.RenewalReport, error) {
+			return certificate.RenewalReport{}, errors.New("private-key-secret-path")
+		},
+	})
+	cookie := loginForSettingsTest(t, server)
+	request := httptest.NewRequest(http.MethodPost, "/api/v1/renewal/run", nil)
+	request.AddCookie(cookie)
+	response := httptest.NewRecorder()
+	server.Handler().ServeHTTP(response, request)
+	if response.Code != http.StatusConflict {
+		t.Fatalf("renewal failure returned an unexpected status: %d %s", response.Code, response.Body.String())
+	}
+	body := response.Body.String()
+	if strings.Contains(body, "private-key-secret-path") {
+		t.Fatalf("renewal API leaked an internal error: %s", body)
+	}
+	if !strings.Contains(body, "\u6267\u884c\u8bc1\u4e66\u7eed\u671f\u5931\u8d25") {
+		t.Fatalf("renewal API did not include the safe error message: %s", body)
+	}
+}
 func loginForSettingsTest(t *testing.T, server *Server) *http.Cookie {
 	t.Helper()
 	request := httptest.NewRequest(http.MethodPost, "/api/v1/auth/login", strings.NewReader(`{"identifier":"admin","password":"Password123"}`))