[wgrant]

ENG-9372

what

at TF_LOG=DEBUG or TRACE the API client logs whole GraphQL request bodies, including write-only credentials; mask them

• mutations that send a credential register it with tflog.MaskLogStrings on the request context, through a maskSecrets helper that also masks its JSON-encoded form
• the logging transport logs through the request's context rather than the one it was built with, so the masking applies (the client no longer takes a context)
• covers every write-only credential: account and binding security contexts, Azure and GCP discovery credentials, the Datadog keys, repository auth, and the Email, Jira, ServiceNow, Slack and Symphony profiles

#257 adds the Anthropic integration's admin key; whichever of the two lands second adds ctx = maskSecrets(ctx, input.AdminKey) to its upsert

why

debug logs are often shared when reporting problems, and shouldn't carry credentials

testing

unit test capturing the provider's debug logs for a Datadog update, asserting both keys appear only masked, including one JSON-encoding escapes; existing tests pass

docs

none needed

[cubic-dev-ai]

No issues found across 11 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

Architecture diagram

sequenceDiagram
    participant Provider as Terraform Provider
    participant API as API Client (api package)
    participant Mask as maskSecrets Helper
    participant LogCtx as Request Context with Log Masking
    participant Transport as logTransport
    participant HTTP as HTTP Transport
    participant Server as GraphQL API Server
    participant Logs as Debug Logs

    Note over Provider,Server: Credential Masking in Debug Logs Flow

    Provider->>API: Call mutation (e.g., Datadog Update)
    API->>API: Build GraphQL mutation with input
    
    Note over API,Mask: NEW: Register secrets for masking
    API->>Mask: maskSecrets(ctx, secrets...)
    Mask->>Mask: Check nil/empty secrets
    alt Has secrets to mask
        Mask->>Mask: JSON-encode each secret
        Mask->>Mask: Collect raw + encoded values
        Mask->>LogCtx: Create tflog.MaskLogStrings context
        LogCtx-->>API: Return masked context
    else No secrets to mask
        Mask-->>API: Return original context
    end
    
    API->>API: Assign masked context to request
    
    API->>Transport: Mutate(maskedCtx, mutation, variables)
    Transport->>Transport: Log request with masked context
    LogCtx->>Transport: Apply masking rules
    Transport->>HTTP: Send HTTP request
    
    HTTP->>Server: GraphQL request with credentials
    Server-->>HTTP: GraphQL response
    
    HTTP-->>Transport: Return response
    Transport->>Transport: Log response with masked context
    LogCtx->>Transport: Apply masking rules
    
    Note over Transport,Logs: NEW: Credentials appear as "***"
    Transport->>Logs: Write debug log entries
    Logs-->>Logs: Masked request/response bodies
    
    Transport-->>API: Return response
    API-->>Provider: Return result

Loading

_{Re-trigger cubic}

[albertodonato]

LGTM, thanks