fix: mask sensitive connection credentials in toArray()

src/Request.php

@@ -150,7 +150,7 @@ public function setConnection(Connection $connection)
     /**
      * Return Connection Object.
      *
-     * @throws Exception\InvalidException If no valid connection was set
+     * @throws InvalidException If no valid connection was set
      */
     public function getConnection(): Connection
     {
@@ -205,7 +205,13 @@ public function toArray()
     {
         $data = $this->getParams();
         if ($this->_connection) {
-            $data['connection'] = $this->_connection->getParams();
+            $connectionParams = $this->_connection->getParams();
+            foreach (['username', 'password'] as $sensitiveKey) {
+                if (isset($connectionParams[$sensitiveKey])) {
+                    $connectionParams[$sensitiveKey] = '***';
+                }
+            }
+            $data['connection'] = $connectionParams;
         }
 
         return $data;

tests/RequestTest.php

@@ -70,9 +70,12 @@ public function testToString(): void
         $query = ['no' => 'params'];
         $data = ['key' => 'value'];
 
-        $connection = new Connection();
-        $connection->setHost($this->_getHost());
-        $connection->setPort(9200);
+        $connection = new Connection([
+            'host' => $this->_getHost(),
+            'port' => 9200,
+            'username' => 'elastic',
+            'password' => 'secret',
+        ]);
 
         $request = new Request($path, $method, $data, $query, $connection);
 
@@ -94,6 +97,8 @@ public function testToString(): void
         $this->assertEquals($request->getConnection()->getHost(), $data['connection']['host']);
         $this->assertEquals($request->getConnection()->getPort(), $data['connection']['port']);
 
+        $this->assertSame('***', $data['connection']['username']);
+        $this->assertSame('***', $data['connection']['password']);
         $this->assertIsString((string) $request);
     }