[hardening] Wrap ProviderKey.secret (+ guardrail/exporter creds) in a redacting Secret type — make log leakage impossible by construction

[moonming]

Summary

Provider/guardrail/exporter secrets are stored as plaintext String that derive Debug. Leakage to logs is prevented today only by discipline (an audit confirmed no current log statement prints them), not by construction. A future debug!("{:?}", provider_key) or any struct-dump would print the upstream secret into production logs. Wrapping secrets in a redacting newtype makes that a compile-time impossibility.

Current state

• crates/aisix-core/src/models/provider_key.rs:

  #[derive(Debug, Clone, Serialize, Deserialize, schemars::JsonSchema, PartialEq)]
  pub struct ProviderKey { pub secret: String, /* … */ }

  Plaintext + Debug-derived.
• Same trust boundary (per the secret field's own doc comment): Guardrail credentials (models/guardrail.rs secret_access_key / access_key_secret) and ObservabilityExporter headers (models/observability_exporter.rs).
• Verified: no log statement currently prints these (so no active leak); protection is discipline-only.

Proposal — a redacting Secret newtype

Option A — secrecy crate (SecretString): zeroize-on-drop, battle-tested. Needs a serde-transparent wrapper for the etcd-projection round-trip (cp-api projects the plaintext secret over mTLS).

Option B — hand-rolled newtype (fits the existing serde-transparent need):

// crates/aisix-core/src/models/secret.rs
#[derive(Clone, Serialize, Deserialize, PartialEq, schemars::JsonSchema)]
#[serde(transparent)]                 // wire / on-disk / etcd stay a bare string
pub struct Secret(String);

impl std::fmt::Debug for Secret {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.write_str("Secret([redacted])")
    }
}
impl Secret {
    pub fn expose(&self) -> &str { &self.0 }  // sole plaintext accessor → greppable audit
}

Changes

1. ProviderKey.secret: String → Secret.
2. Every use site (bridges building the api-key / Authorization header, Bedrock SigV4 signer) → provider_key.secret.expose() — making every plaintext access explicit and grep-auditable.
3. #[derive(Debug)] on ProviderKey is now safe by construction (prints Secret([redacted])).
4. Extend to Guardrail (secret_access_key, access_key_secret) and ObservabilityExporter secret/header fields.

Non-breaking

#[serde(transparent)] keeps the wire / on-disk / etcd projection format a bare string — behavior unchanged; this only adds a Debug/Display guard.

Known boundary

This guards accidental Debug/Display logging, not a deliberate serde_json::to_string(&pk) written into a log (rarer path). Call that out in review / add a lint if desired.

Test

api7/ai-gateway has Rust unit tests; add:

#[test]
fn provider_key_debug_redacts_secret() {
    let pk = ProviderKey { secret: Secret("super-secret".into()), /* … */ };
    let d = format!("{:?}", pk);
    assert!(!d.contains("super-secret"));
    assert!(d.contains("[redacted]"));
}

Priority / sequencing

Defense-in-depth. No active leak today (verified), so not urgent — but it's the structural fix that makes the whole leakage class impossible. Pairs with the CI-side backstop already merged in api7/AISIX-Cloud#713 (test-harness redactSecrets for dumped docker logs). Suggested as a 2-step PR: (1) Secret newtype + ProviderKey; (2) extend to guardrail / observability creds.

Refs: api7/AISIX-Cloud#713 (test-harness redaction backstop, merged).

[coderabbitai]

🔗 Related PRs

#355 - fix(proxy): use UUID request IDs across handlers [merged]
#505 - refactor(dispatch): remove the pre-Phase-A compat shim (#377) [closed]
api7/api7ee-3-control-plane#2721 - feat(developer-portal): only reveal credential secrets once [closed]
#506 - feat(guardrails): add Aliyun text-moderation guardrail kind (#603) [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!