Sanitize leaked credentials in order booking HTTP template

test/orderBookingsPost.http

@@ -1,3 +1,6 @@
+# Local testing template only. Fill placeholders with non-production credentials from local env/secrets.
+# Never commit real API tokens, setup tokens, emails, or passwords.
+
 ### POST request to /account/auth/phone
 POST https://api.truckwash.dk:4433/account/auth/phone
 Accept: application/json
@@ -12,7 +15,7 @@ Content-Type: application/json
 POST https://api.truckwash.dk:4433/subusers
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer e9d4359673de64f6a9bc4231bf50ac9f5726ad5b3ee6fcad5f8ebbb20647c3b8
+Authorization: Bearer {{ADMIN_BEARER_TOKEN}}
 
 {
     "cvr": 41004355,
@@ -21,10 +24,10 @@ Authorization: Bearer e9d4359673de64f6a9bc4231bf50ac9f5726ad5b3ee6fcad5f8ebbb206
 }
 
 ### GET request to /subusers/setup
-GET https://api.truckwash.dk:4433/subusers/setup?token=1c1be8280bac3937487e5c77b76bb839
+GET https://api.truckwash.dk:4433/subusers/setup?token={{SUBUSER_SETUP_TOKEN}}
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer e9d4359673de64f6a9bc4231bf50ac9f5726ad5b3ee6fcad5f8ebbb20647c3b8
+Authorization: Bearer {{ADMIN_BEARER_TOKEN}}
 
 ### POST /bird/voice/calls/webhook/inbound
 POST http://localhost/bird/voice/calls/webhook/inbound
@@ -35,7 +38,7 @@ content-type: application/json
     "service": "channels",
     "event": "voice.inbound",
     "url": "https://yoururl.com",
-    "signingKey": "mysecretkey",
+    "signingKey": "{{BIRD_SIGNING_KEY}}",
     "eventFilters": [
         {
             "key": "channelId",
@@ -57,14 +60,14 @@ content-type: application/json
 POST http://localhost/api/subusers/setup
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer e9d4359673de64f6a9bc4231bf50ac9f5726ad5b3ee6fcad5f8ebbb20647c3b8
+Authorization: Bearer {{ADMIN_BEARER_TOKEN}}
 
 {
-    "token": "1c1be8280bac3937487e5c77b76bb839",
+    "token": "{{SUBUSER_SETUP_TOKEN}}",
     "name": "Test Subuser",
     "username": "testsubuser",
-    "email": "jb@truckwash.dk",
-    "password": "Test1234"
+    "email": "{{SUBUSER_EMAIL}}",
+    "password": "{{SUBUSER_PASSWORD}}"
 }
 
 ### POST request to /subusers/auth/password
@@ -74,42 +77,42 @@ Content-Type: application/json
 
 {
     "username": "testsubuser",
-    "password": "Test1234"
+    "password": "{{SUBUSER_PASSWORD}}"
 }
 
 ### GET request to /order-bookings (As subuser)
 GET https://api.truckwash.dk:4433/order-bookings
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer 9ed711260d58165ee7601060bf7463f6e201481edd16c8ee4fc4a5f04b79a232
+Authorization: Bearer {{SUBUSER_BEARER_TOKEN}}
 X-Customer-Number: 42331128
 
 ### GET request to /order-bookings (As subuser, specific ID)
 GET https://api.truckwash.dk:4433/order-bookings?id=76
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer 9ed711260d58165ee7601060bf7463f6e201481edd16c8ee4fc4a5f04b79a232
+Authorization: Bearer {{SUBUSER_BEARER_TOKEN}}
 X-Customer-Number: 42331128
 
 ### GET request to /vehicles (As subuser)
 GET https://api.truckwash.dk:4433/vehicles
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer 9ed711260d58165ee7601060bf7463f6e201481edd16c8ee4fc4a5f04b79a232
+Authorization: Bearer {{SUBUSER_BEARER_TOKEN}}
 X-Customer-Number: 42331128
 
 ### GET request to /vehicles (As subuser, specific ID)
 GET https://api.truckwash.dk:4433/vehicles?id=384
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer 9ed711260d58165ee7601060bf7463f6e201481edd16c8ee4fc4a5f04b79a232
+Authorization: Bearer {{SUBUSER_BEARER_TOKEN}}
 X-Customer-Number: 42331128
 
 ### GET request to /orders (As subuser)
 GET https://api.truckwash.dk:4433/orders
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer 9ed711260d58165ee7601060bf7463f6e201481edd16c8ee4fc4a5f04b79a232
+Authorization: Bearer {{SUBUSER_BEARER_TOKEN}}
 X-Customer-Number: 42331128
 
 
@@ -117,46 +120,46 @@ X-Customer-Number: 42331128
 GET https://api.truckwash.dk:4433/subusers/me
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer 9ed711260d58165ee7601060bf7463f6e201481edd16c8ee4fc4a5f04b79a232
+Authorization: Bearer {{SUBUSER_BEARER_TOKEN}}
 X-Customer-Number: 42331128
 
 ### GET request to /subusers/permission-nodes
 GET https://api.truckwash.dk:4433/subusers/permission-nodes
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer e9d4359673de64f6a9bc4231bf50ac9f5726ad5b3ee6fcad5f8ebbb20647c3b8
+Authorization: Bearer {{ADMIN_BEARER_TOKEN}}
 
 ### GET request to /subusers/grants (As subuser)
 GET https://api.truckwash.dk:4433/subusers/grants
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer 9ed711260d58165ee7601060bf7463f6e201481edd16c8ee4fc4a5f04b79a232
+Authorization: Bearer {{SUBUSER_BEARER_TOKEN}}
 X-Customer-Number: 42331128
 
 ### GET request to order bookings (list all)
 GET https://api.truckwash.dk:4433/order-bookings
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer e9d4359673de64f6a9bc4231bf50ac9f5726ad5b3ee6fcad5f8ebbb20647c3b8
+Authorization: Bearer {{ADMIN_BEARER_TOKEN}}
 
 ### GET request to order bookings (specific ID)
 GET https://api.truckwash.dk:4433/order-bookings?id=1
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer e9d4359673de64f6a9bc4231bf50ac9f5726ad5b3ee6fcad5f8ebbb20647c3b8
+Authorization: Bearer {{ADMIN_BEARER_TOKEN}}
 
 
 ### GET request to weather (specific ID)
 GET https://api.truckwash.io/departments/weather?id=1
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer e9d4359673de64f6a9bc4231bf50ac9f5726ad5b3ee6fcad5f8ebbb20647c3b8
+Authorization: Bearer {{ADMIN_BEARER_TOKEN}}
 
 ### PUT request to order bookings (update specific ID)
 PUT https://api.truckwash.dk:4433/order-bookings
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer e9d4359673de64f6a9bc4231bf50ac9f5726ad5b3ee6fcad5f8ebbb20647c3b8
+Authorization: Bearer {{ADMIN_BEARER_TOKEN}}
 
 {
     "id": 4,
@@ -169,7 +172,7 @@ Authorization: Bearer e9d4359673de64f6a9bc4231bf50ac9f5726ad5b3ee6fcad5f8ebbb206
 POST https://api.truckwash.dk:4433/order-bookings/complete
 Accept: application/json
 Content-Type: application/json
-Authorization: Bearer e9d4359673de64f6a9bc4231bf50ac9f5726ad5b3ee6fcad5f8ebbb20647c3b8
+Authorization: Bearer {{ADMIN_BEARER_TOKEN}}
 
 {
     "id": 3,
@@ -188,7 +191,7 @@ Content-Type: application/json
 ### Get department distribution e-conomic
 GET http://localhost/api/superuser/invoicing/period/distribution/v2/booked-department-75
 Accept: application/json
-Authorization: Bearer e9d4359673de64f6a9bc4231bf50ac9f5726ad5b3ee6fcad5f8ebbb20647c3b8
+Authorization: Bearer {{ADMIN_BEARER_TOKEN}}
 Content-Type: application/json
 
 {
@@ -201,7 +204,7 @@ Content-Type: application/json
 POST https://api.truckwash.dk:4433/order-bookings
 Accept: application/json, text/plain, */*
 Accept-Language: en-GB,en;q=0.6
-Authorization: Bearer e9d4359673de64f6a9bc4231bf50ac9f5726ad5b3ee6fcad5f8ebbb20647c3b8
+Authorization: Bearer {{ADMIN_BEARER_TOKEN}}
 Content-Type: application/json
 
 {