fix(auth): trim env var tokens + hardening tests

crates/dkdc-md-cli/src/auth.rs

@@ -45,10 +45,11 @@ fn resolve_token_with(
     env_var: impl Fn(&str) -> Result<String, std::env::VarError>,
 ) -> Result<String> {
     for var in ENV_VARS {
-        if let Ok(val) = env_var(var)
-            && !val.is_empty()
-        {
-            return Ok(val);
+        if let Ok(val) = env_var(var) {
+            let trimmed = val.trim().to_string();
+            if !trimmed.is_empty() {
+                return Ok(trimmed);
+            }
         }
     }
 
@@ -184,4 +185,16 @@ mod tests {
         let result = resolve_token_or_with(None, env, std::io::empty());
         assert_eq!(result.unwrap(), "env-tok");
     }
+
+    #[test]
+    fn trims_whitespace_from_env_var() {
+        let env = env_with(&[("MOTHERDUCK_TOKEN", "  tok-with-spaces  \n")]);
+        assert_eq!(resolve_token_with(env).unwrap(), "tok-with-spaces");
+    }
+
+    #[test]
+    fn skips_whitespace_only_env_vars() {
+        let env = env_with(&[("motherduck_token", "  \n"), ("MOTHERDUCK_TOKEN", "real")]);
+        assert_eq!(resolve_token_with(env).unwrap(), "real");
+    }
 }

crates/dkdc-md-cli/src/cli.rs

@@ -642,6 +642,30 @@ mod tests {
         assert_eq!(display_field(&v, "name"), "-");
     }
 
+    #[test]
+    fn display_field_returns_dash_for_null() {
+        let v = serde_json::json!({"name": null});
+        assert_eq!(display_field(&v, "name"), "-");
+    }
+
+    #[test]
+    fn extract_str_returns_value() {
+        let v = serde_json::json!({"size": "standard"});
+        assert_eq!(extract_str(&v, "size"), Some("standard"));
+    }
+
+    #[test]
+    fn extract_str_returns_none_for_missing() {
+        let v = serde_json::json!({});
+        assert_eq!(extract_str(&v, "size"), None);
+    }
+
+    #[test]
+    fn extract_str_returns_none_for_non_string() {
+        let v = serde_json::json!({"count": 42});
+        assert_eq!(extract_str(&v, "count"), None);
+    }
+
     #[test]
     fn print_table_empty_rows_no_output() {
         // Should not panic or print anything

crates/dkdc-md-cli/src/client.rs

@@ -270,4 +270,35 @@ mod tests {
         assert_eq!(json["ttl"], 3600);
         assert_eq!(json["token_type"], "read_write");
     }
+
+    #[test]
+    fn new_rejects_empty_token() {
+        let err = MotherduckClient::new("").unwrap_err();
+        assert!(err.to_string().contains("must not be empty"));
+    }
+
+    #[test]
+    fn debug_redacts_bearer_token() {
+        let client = MotherduckClient::new("secret-token").unwrap();
+        let debug = format!("{client:?}");
+        assert!(debug.contains("[redacted]"));
+        assert!(!debug.contains("secret-token"));
+    }
+
+    #[test]
+    fn parse_response_boundary_status_299() {
+        let result = parse_response(299, r#"{"ok": true}"#.into()).unwrap();
+        assert_eq!(result["ok"], true);
+    }
+
+    #[test]
+    fn parse_response_boundary_status_300() {
+        let err = parse_response(300, r#"{"message": "redirect"}"#.into()).unwrap_err();
+        assert!(err.to_string().contains("300"));
+    }
+
+    #[test]
+    fn encode_path_percent_encodes_percent() {
+        assert_eq!(encode_path("100%done"), "100%25done");
+    }
 }