First attempt to store creds and hide user/pass for mirror URL.

app/models/remote_mirror.rb

@@ -93,6 +93,18 @@ def mark_as_failed(error_message)
     update_column(:last_error, error_message)
   end
+  def url=(value)
+    mirror_url = Gitlab::ImportUrl.new(value)
+    self.credentials = mirror_url.credentials if mirror_url.credentials.values.any?
+
+    super(mirror_url.sanitized_url)
+  end
+
+  def full_url
+    mirror_url = Gitlab::ImportUrl.new(super, credentials: credentials)
+    mirror_url.full_url
+  end
+
   private
   def url_availability
@@ -122,7 +134,7 @@ def add_update_job
   def refresh_remote
     project.repository.remove_remote(ref_name)
-    project.repository.add_remote(ref_name, url)
+    project.repository.add_remote(ref_name, full_url)
   end
   def remove_remote

lib/gitlab/import_url.rb

+# I'm borrowing this class from: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/3066
+# So we should fix the conflict once the CE -> EE merge process starts.
+module Gitlab
+  class ImportUrl
+    def initialize(url, credentials: nil)
+      @url = URI.parse(url)
+      @credentials = credentials
+    end
+
+    def sanitized_url
+      @sanitized_url ||= safe_url.to_s
+    end
+
+    def credentials
+      @credentials ||= { user: @url.user, password: @url.password }
+    end
+
+    def full_url
+      @full_url ||= generate_full_url.to_s
+    end
+
+    private
+
+    def generate_full_url
+      return @url unless valid_credentials?
+      @full_url = @url.dup
+      @full_url.user = credentials[:user]
+      @full_url.password = credentials[:password]
+      @full_url
+    end
+
+    def safe_url
+      safe_url = @url.dup
+      safe_url.password = nil
+      safe_url.user = nil
+      safe_url
+    end
+
+    def valid_credentials?
+      credentials && credentials.is_a?(Hash) && credentials.any?
+    end
+  end
+end

[Douwe Maan]

To keep the encryption transparent, and have stuff like x.url = x.url work as expected, #url and #url= should both deal with the full URL. We should have a separate safe_url, like we have on Project, that will strip the credentials and be used in the UI.

[Rubén Dávila]

@DouweM just to make sure we're on the same page, do you mean to left the #url method as is and add a new #url method that returns the full url? Apart from adding #safe_url of course.

[Douwe Maan]

@rdavila Bottom line is that #url and #url should behave as if it's just a string field. The fact that credentials are stored in a separate attribute is an implementation detail. We should override both #url and #url= to call super and insert/extract the credentials on the fly.

Safe URL would then mask the credentials, like happens in Project#safe_import_url.

Does that make sense?