From e648bc83fa61f0e4a640bd42a7401035fd2662be Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Aur=C3=A9lien=20Sibiril?=
 <81782+aureliensibiril@users.noreply.github.com>
Date: Sun, 12 Jul 2026 11:24:01 +0200
Subject: [PATCH] Strip the Dotfile API key header when recording cassettes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The shared VCR BeforeSave hook scrubs every other header-auth provider's key
(X-Api-Key, Api-Key, Signoz-Api-Key, X-Auth-Token) but was not updated for
Dotfile, so re-recording testdata/dotfile.yaml with a real X-DOTFILE-API-KEY
would persist the key into the committed cassette. Delete the canonicalized
X-Dotfile-Api-Key header alongside the others.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
---
 pkg/accessreview/drivers/vcr_test.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkg/accessreview/drivers/vcr_test.go b/pkg/accessreview/drivers/vcr_test.go
index 038098e8c..eab92aaf9 100644
--- a/pkg/accessreview/drivers/vcr_test.go
+++ b/pkg/accessreview/drivers/vcr_test.go
@@ -66,6 +66,9 @@ func newRecorder(t *testing.T, cassettePath string, envVar string) *recorder.Rec
 			i.Request.Headers.Del("Api-Key")
 			// Scaleway authenticates with the secret key in X-Auth-Token.
 			i.Request.Headers.Del("X-Auth-Token")
+			// Dotfile authenticates with the key in X-DOTFILE-API-KEY
+			// (canonicalized to X-Dotfile-Api-Key).
+			i.Request.Headers.Del("X-Dotfile-Api-Key")
 
 			return nil
 		}, recorder.BeforeSaveHook),