supabase / cli / 29565373841

65%

develop: 65%

push

github

fix(cli): redact API keys (#5891)

## TL;DR

fixes project keys being written to CLI traces, matching the Go cli's
behavior...

## Problem

The Go-cli use to send keys through the `apikey` header:


https://github.com/supabase/cli/blob/<a class=hub.com/supabase/cli/commit/2cb2d6e83a3f7d65ebdab905c35b8f8257e685dc">2cb2d6e83/apps/cli-go/pkg/fetcher/gateway.go#L22-L33

Its debug transport only logs the request method and URL:


https://github.com/supabase/cli/blob/2cb2d6e83a3f7d65ebdab905c35b8f8257e685dc/apps/cli-go/internal/debug/http.go#L14-L16

Effect tracing captures request headers, but `apikey` is not included in
its default redaction list...
this allowed values to be written to local traces...

## sol

exclude `apikey` header attributes at the tracing boundary....
requests and all other telemetry remain unchanged, while NDJSON and
debug output no longer contain project keys....

## ref:

- reported in: #5890

11145 of 17125 relevant lines covered (65.08%)

10.49 hits per line