fix: redact secret diagnostics

backend/app/core/redaction.py

@@ -0,0 +1,26 @@
+"""
+Utilities for making diagnostic text safe to store or log.
+"""
+
+import re
+
+SENSITIVE_VALUE = "**redacted**"
+
+_SENSITIVE_KEY_PATTERN = re.compile(
+    r"(?i)([\"']?\b(?:access_token|api_key|apikey|authorization|bearer|client_secret|"
+    r"gmail_client_secret|id_token|passwd|password|refresh_token|secret|token)\b[\"']?"
+    r"\s*[:=]\s*[\"']?)([^\"'\s,;&}]+)([\"']?)"
+)
+_BEARER_TOKEN_PATTERN = re.compile(r"(?i)\b(bearer)\s+([A-Za-z0-9._~+/=-]{8,})")
+
+
+def sanitize_for_log(value: object) -> str:
+    """Remove CR/LF characters from a value to prevent log injection attacks."""
+    return str(value).replace("\r", "").replace("\n", " ")
+
+
+def redact_sensitive_text(value: object) -> str:
+    """Sanitize text and redact common secret-bearing key/value fragments."""
+    text = sanitize_for_log(value)
+    text = _SENSITIVE_KEY_PATTERN.sub(r"\1" + SENSITIVE_VALUE + r"\3", text)
+    return _BEARER_TOKEN_PATTERN.sub(r"\1 " + SENSITIVE_VALUE, text)

backend/app/core/security.py

@@ -193,7 +193,7 @@ async def require_admin_auth(
 
     # 2. Static admin API key
     if api_key and verify_api_key(api_key):
-        return {"auth_type": "api_key", "api_key": api_key}
+        return {"auth_type": "api_key"}
 
     # 3. Bearer JWT (app-issued; also covers Bearer tokens set by older clients)
     if bearer: