test(logfire): stop test fixtures looking like real read tokens

GitGuardian flagged the pylf_v1_*_token/abc fixtures as secrets. Only the
pylf_v{n}_{region}_ prefix is meaningful to getLogfireBaseUrl, so keep that and
give the suffix an obviously-synthetic value. Extracted the repeated literals in
utils.test.ts into named constants.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: icecrasher321

apps/sim/tools/logfire/get_token_info.test.ts

@@ -4,7 +4,7 @@
 import { describe, expect, it } from 'vitest'
 import { logfireGetTokenInfoTool } from '@/tools/logfire/get_token_info'
 
-const baseParams = { apiKey: 'pylf_v1_us_token' }
+const baseParams = { apiKey: 'pylf_v1_us_NOT-A-REAL-TOKEN' }
 
 describe('logfireGetTokenInfoTool request', () => {
   it('targets the read-token-info endpoint with a GET', () => {

apps/sim/tools/logfire/get_trace.test.ts

@@ -4,7 +4,10 @@
 import { describe, expect, it } from 'vitest'
 import { logfireGetTraceTool } from '@/tools/logfire/get_trace'
 
-const baseParams = { apiKey: 'pylf_v1_eu_token', traceId: '0123456789abcdef0123456789abcdef' }
+const baseParams = {
+  apiKey: 'pylf_v1_eu_NOT-A-REAL-TOKEN',
+  traceId: '0123456789abcdef0123456789abcdef',
+}
 
 describe('logfireGetTraceTool request', () => {
   it('routes EU tokens to the EU host', () => {

apps/sim/tools/logfire/query.test.ts

@@ -6,7 +6,7 @@ import { logfireQueryTool } from '@/tools/logfire/query'
 import type { LogfireQueryParams } from '@/tools/logfire/types'
 
 const baseParams: LogfireQueryParams = {
-  apiKey: 'pylf_v1_us_token',
+  apiKey: 'pylf_v1_us_NOT-A-REAL-TOKEN',
   sql: 'SELECT message FROM records',
 }
 

apps/sim/tools/logfire/search_records.test.ts

@@ -5,7 +5,7 @@ import { describe, expect, it } from 'vitest'
 import { logfireSearchRecordsTool } from '@/tools/logfire/search_records'
 import type { LogfireSearchRecordsParams } from '@/tools/logfire/types'
 
-const baseParams: LogfireSearchRecordsParams = { apiKey: 'pylf_v1_us_token' }
+const baseParams: LogfireSearchRecordsParams = { apiKey: 'pylf_v1_us_NOT-A-REAL-TOKEN' }
 
 /** Shape `/v2/query` actually returns: rows under `data`, columns under `schema.fields`. */
 const WIRE_RESPONSE = {

apps/sim/tools/logfire/utils.test.ts

@@ -18,16 +18,26 @@ import {
 const US_BASE = 'https://logfire-us.pydantic.dev'
 const EU_BASE = 'https://logfire-eu.pydantic.dev'
 
+/**
+ * Synthetic read tokens. Only the `pylf_v{n}_{region}_` prefix is meaningful to
+ * the code under test, so the suffix is deliberately not token-shaped — these
+ * are fixtures, never credentials.
+ */
+const US_TOKEN = 'pylf_v1_us_NOT-A-REAL-TOKEN'
+const EU_TOKEN = 'pylf_v1_eu_NOT-A-REAL-TOKEN'
+const EU_TOKEN_V2 = 'pylf_v2_eu_NOT-A-REAL-TOKEN'
+const UNKNOWN_REGION_TOKEN = 'pylf_v1_apac_NOT-A-REAL-TOKEN'
+
 describe('getLogfireBaseUrl', () => {
   it('prefers an explicit region over the token prefix', () => {
-    expect(getLogfireBaseUrl('pylf_v1_eu_abc', 'us')).toBe(US_BASE)
-    expect(getLogfireBaseUrl('pylf_v1_us_abc', 'eu')).toBe(EU_BASE)
+    expect(getLogfireBaseUrl(EU_TOKEN, 'us')).toBe(US_BASE)
+    expect(getLogfireBaseUrl(US_TOKEN, 'eu')).toBe(EU_BASE)
   })
 
   it('reads the region from the token prefix when set to auto', () => {
-    expect(getLogfireBaseUrl('pylf_v1_eu_abc', 'auto')).toBe(EU_BASE)
-    expect(getLogfireBaseUrl('pylf_v1_us_abc', 'auto')).toBe(US_BASE)
-    expect(getLogfireBaseUrl('pylf_v2_eu_abc')).toBe(EU_BASE)
+    expect(getLogfireBaseUrl(EU_TOKEN, 'auto')).toBe(EU_BASE)
+    expect(getLogfireBaseUrl(US_TOKEN, 'auto')).toBe(US_BASE)
+    expect(getLogfireBaseUrl(EU_TOKEN_V2)).toBe(EU_BASE)
   })
 
   it('treats a token with no region prefix as US', () => {
@@ -36,19 +46,19 @@ describe('getLogfireBaseUrl', () => {
   })
 
   it('refuses to guess a host for a region it does not know', () => {
-    expect(() => getLogfireBaseUrl('pylf_v1_apac_abc')).toThrow(
+    expect(() => getLogfireBaseUrl(UNKNOWN_REGION_TOKEN)).toThrow(
       "Unrecognized Logfire token region 'apac'"
     )
   })
 
   it('rejects an explicit region outside the known set rather than building undefined/', () => {
-    expect(() => getLogfireBaseUrl('pylf_v1_us_abc', 'apac' as unknown as LogfireRegion)).toThrow(
+    expect(() => getLogfireBaseUrl(US_TOKEN, 'apac' as unknown as LogfireRegion)).toThrow(
       "Unrecognized Logfire region 'apac'"
     )
   })
 
   it('lets a self-hosted host override both the region and the token prefix', () => {
-    expect(getLogfireBaseUrl('pylf_v1_eu_abc', 'us', 'https://logfire.example.com')).toBe(
+    expect(getLogfireBaseUrl(EU_TOKEN, 'us', 'https://logfire.example.com')).toBe(
       'https://logfire.example.com'
     )
   })
@@ -78,8 +88,8 @@ describe('getLogfireBaseUrl', () => {
   })
 
   it('ignores a blank host and falls back to region resolution', () => {
-    expect(getLogfireBaseUrl('pylf_v1_eu_abc', 'auto', '   ')).toBe(EU_BASE)
-    expect(getLogfireBaseUrl('pylf_v1_eu_abc', 'auto', undefined)).toBe(EU_BASE)
+    expect(getLogfireBaseUrl(EU_TOKEN, 'auto', '   ')).toBe(EU_BASE)
+    expect(getLogfireBaseUrl(EU_TOKEN, 'auto', undefined)).toBe(EU_BASE)
   })
 
   it('rejects a host carrying a query string or fragment that would swallow the path', () => {
@@ -100,7 +110,7 @@ describe('getLogfireBaseUrl', () => {
 
 describe('logfireHeaders', () => {
   it('trims the token so a pasted value does not corrupt the bearer credential', () => {
-    expect(logfireHeaders('  pylf_v1_us_abc\n').Authorization).toBe('Bearer pylf_v1_us_abc')
+    expect(logfireHeaders(`  ${US_TOKEN}\n`).Authorization).toBe(`Bearer ${US_TOKEN}`)
   })
 })