fix(security): redact Authorization/credential headers before logging

The ArgoCD connector logged its request headers verbatim
(`logger.debug(f"Request headers: {headers}")`), leaking a live ArgoCD admin
Bearer JWT into the log stream on every API call. Anyone able to read the logs
(Loki, `kubectl logs`) could lift a valid token until it expired.

Add a shared redact_sensitive_headers() util (masks authorization,
proxy-authorization, x-api-key, api-key, x-auth-token, cookie, set-cookie) and
use it in argo.py. The HTTP connector already sanitized its header logging; this
brings argo into line and gives one tested helper for future use.

Regression test asserts the bearer token value never survives redaction.

Author: uittenbroekrobbert

operations-manager/python/opi/connectors/argo.py

@@ -13,6 +13,8 @@
 import aiohttp
 import requests
 
+from opi.utils.logging_redact import redact_sensitive_headers
+
 logger = logging.getLogger(__name__)
 
 
@@ -218,7 +220,7 @@ async def _make_authenticated_request(
 
         async with aiohttp.ClientSession(connector=connector, timeout=request_timeout) as session:
             headers = {"Authorization": f"Bearer {self.auth_token}", "Content-Type": "application/json"}
-            logger.debug(f"Request headers: {headers}")
+            logger.debug(f"Request headers: {redact_sensitive_headers(headers)}")
             logger.debug(f"Making {method} request to: {url}")
 
             async with session.request(method, url, json=json_data or {}, headers=headers) as response:

operations-manager/python/opi/utils/logging_redact.py

@@ -0,0 +1,31 @@
+"""Helpers for keeping secrets out of logs.
+
+Logging request/response headers is useful for debugging, but headers routinely
+carry credentials (``Authorization: Bearer …``, ``X-API-Key``, cookies). Logging
+them verbatim leaks live tokens into the log stream. Always run header dicts
+through :func:`redact_sensitive_headers` before logging them.
+"""
+
+# Header names (lower-cased) whose value must never be logged.
+_SENSITIVE_HEADERS = frozenset(
+    {
+        "authorization",
+        "proxy-authorization",
+        "x-api-key",
+        "api-key",
+        "x-auth-token",
+        "cookie",
+        "set-cookie",
+    }
+)
+
+_REDACTED = "***REDACTED***"
+
+
+def redact_sensitive_headers(headers: dict[str, str]) -> dict[str, str]:
+    """Return a copy of ``headers`` with credential-bearing values masked.
+
+    Matching is case-insensitive on the header name. Non-sensitive headers pass
+    through unchanged so the log still shows the request shape.
+    """
+    return {key: (_REDACTED if str(key).lower() in _SENSITIVE_HEADERS else value) for key, value in headers.items()}

operations-manager/python/tests/test_logging_redact.py

@@ -0,0 +1,40 @@
+"""redact_sensitive_headers must keep credentials out of logs.
+
+Regression guard for the ArgoCD connector leaking a live admin Bearer JWT via
+`logger.debug(f"Request headers: {headers}")`.
+"""
+
+from opi.utils.logging_redact import redact_sensitive_headers
+
+
+def test_masks_bearer_token_value() -> None:
+    token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.secret.signature"
+    out = redact_sensitive_headers({"Authorization": f"Bearer {token}", "Content-Type": "application/json"})
+    assert token not in str(out)
+    assert out["Authorization"] == "***REDACTED***"
+    # Non-sensitive headers pass through so the log still shows request shape.
+    assert out["Content-Type"] == "application/json"
+
+
+def test_case_insensitive_and_multiple_sensitive_headers() -> None:
+    out = redact_sensitive_headers(
+        {
+            "authorization": "Basic abc123",
+            "X-API-Key": "supersecret",
+            "Cookie": "session=deadbeef",
+            "Accept": "application/json",
+        }
+    )
+    assert out["authorization"] == "***REDACTED***"
+    assert out["X-API-Key"] == "***REDACTED***"
+    assert out["Cookie"] == "***REDACTED***"
+    assert out["Accept"] == "application/json"
+    # No secret value survives anywhere in the output.
+    for leaked in ("abc123", "supersecret", "deadbeef"):
+        assert leaked not in str(out)
+
+
+def test_does_not_mutate_input() -> None:
+    headers = {"Authorization": "Bearer x"}
+    redact_sensitive_headers(headers)
+    assert headers == {"Authorization": "Bearer x"}  # original untouched