CVar.CONFIDENTIAL flag.

Hides CVar values from completion results.

Resources/Locale/en-US/commands.ftl

@@ -30,6 +30,7 @@ cmd-cvar-not-registered = CVar '{ $cvar }' is not registered. Use 'cvar ?' to ge
 cmd-cvar-parse-error = Input value is in incorrect format for type { $type }
 cmd-cvar-compl-list = List available CVars
 cmd-cvar-arg-name = <name | ?>
+cmd-cvar-value-hidden = <value hidden>
 
 ## 'list' command
 cmd-list-desc = Lists available commands, with optional search filter

Robust.Shared/CVars.cs

@@ -469,7 +469,7 @@ namespace Robust.Shared
         /// API token set by the watchdog to communicate to the server.
         /// </summary>
         public static readonly CVarDef<string> WatchdogToken =
-            CVarDef.Create("watchdog.token", "", CVar.SERVERONLY);
+            CVarDef.Create("watchdog.token", "", CVar.SERVERONLY | CVar.CONFIDENTIAL);
 
         /// <summary>
         /// Watchdog server identifier for this server.

Robust.Shared/Configuration/CVar.cs

@@ -57,6 +57,14 @@ namespace Robust.Shared.Configuration
         /// <remarks>
         ///     This is intended to aid shared code.
         /// </remarks>
-        CLIENTONLY = 128
+        CLIENTONLY = 128,
+
+        /// <summary>
+        /// CVar contains sensitive data that should not be accidentally leaked.
+        /// </summary>
+        /// <remarks>
+        /// This currently hides the content of the cvar in the "cvar" command completions.
+        /// </remarks>
+        CONFIDENTIAL = 256,
     }
 }

Robust.Shared/Configuration/ConfigurationCommands.cs

@@ -88,6 +88,10 @@ namespace Robust.Shared.Configuration
 
         private static string GetCVarValueHint(IConfigurationManager cfg, string cVar)
         {
+            var flags = cfg.GetCVarFlags(cVar);
+            if ((flags & CVar.CONFIDENTIAL) != 0)
+                return Loc.GetString("cmd-cvar-value-hidden");
+
             var value = cfg.GetCVar<object>(cVar).ToString() ?? "";
             if (value.Length > 50)
                 value = $"{value[..51]}…";

Robust.Shared/Configuration/ConfigurationManager.cs

@@ -388,6 +388,12 @@ namespace Robust.Shared.Configuration
             return _configVars.TryGetValue(name, out var cVar) && cVar.Registered;
         }
 
+        public CVar GetCVarFlags(string name)
+        {
+            using var _ = Lock.ReadGuard();
+            return _configVars[name].Flags;
+        }
+
         /// <inheritdoc />
         public IEnumerable<string> GetRegisteredCVars()
         {

Robust.Shared/Configuration/IConfigurationManager.cs

@@ -63,6 +63,11 @@ namespace Robust.Shared.Configuration
         /// <returns></returns>
         bool IsCVarRegistered(string name);
 
+        /// <summary>
+        /// Get the CVar flags of a registered cvar.
+        /// </summary>
+        CVar GetCVarFlags(string name);
+
         /// <summary>
         /// Gets a list of all registered cvars
         /// </summary>