fix: redact GitLab token from debug/warn logs in auth context

[brennanneoh]

Summary

• buildAuthHeaders() (index.ts) logged the entire SessionAuth context object at debug level via logger.debug({ context: ctx }, ...). That object includes the raw GitLab bearer token / PAT / job token.
• getEffectiveApiUrl() had the identical pattern on its fallback path (logger.warn({ ctx }, ...)).
• Both now log only the non-sensitive fields (sessionId, header, apiUrl) instead of the full context object.

Why

Security issue: buildAuthHeaders() runs on essentially every proxied tool call when REMOTE_AUTHORIZATION or GITLAB_MCP_OAUTH is enabled (multi-tenant HTTP/stateless server mode). With LOG_LEVEL=debug set, which the project's own docs suggest for troubleshooting, anyone with read access to the resulting logs could harvest live GitLab tokens for every active session and reuse them directly against the GitLab API.

Reported privately to the maintainer alongside a second, unrelated finding before opening this PR.

How tested

• npx tsc --noEmit
• npm run test:mock (all suites pass, including npm run test:remote-auth, which exercises sessionAuthStore / session auth headers end to end)
• npm run test:consumer-smoke

Breaking changes

None. Only log output changes; no behavior or API surface change.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ab6b49f1-3956-4585-a76b-37d7a01c102c

📥 Commits

Reviewing files that changed from the base of the PR and between 926d42c and 3580e03.

📒 Files selected for processing (1)

• index.ts

📜 Recent review details

🔇 Additional comments (1)

index.ts (1)

1565-1568: LGTM!

Also applies to: 1618-1621

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Improved diagnostic logging to show relevant session identifiers, headers, and API URLs without exposing complete authentication context details.

Walkthrough

Authentication diagnostics now log selected session, header, and API URL fields instead of complete authentication context objects.

Changes

Authentication diagnostics

Layer / File(s)	Summary
Structured authentication logging index.ts	buildAuthHeaders and getEffectiveApiUrl now log selected session identifiers, header types, and API URLs while retaining the API URL fallback warning.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: zereight, vrajpal-jhala

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main security change: preventing GitLab tokens from appearing in authentication-context logs.
Description check	✅ Passed	The description directly explains the sensitive logging issue, the code changes, the security impact, and the validation performed.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}