SMOODEV-2716: Redact client_secret from url-encoded request-body logging

[brentrager]

Problem

The request/response logger records the outbound request body via getRequestBody, which returned a url-encoded form body verbatim as an opaque string. The logger redacts by object key (headers, JSON fields) but can't see into a string, so an OAuth client_credentials token exchange logged client_secret=sk_... in plaintext to CloudWatch.

Surfaced during the AuthIssuer P0 (SMOODEV-2716): @smooai/config's TokenProvider.refresh does POST /token with grant_type=client_credentials&client_id=...&client_secret=sk_..., and that whole body landed in logs.

Fix

getRequestBody now runs string bodies through the new exported redactFormCredentials, which scrubs sensitive x-www-form-urlencoded params (client_secret, client_id, access_token, refresh_token, token, password, secret, code, assertion, client_assertion, api_key) to [REDACTED]. It:

• splits each pair on the first = so base64 values with = padding survive,
• leaves JSON string bodies untouched (they start with {/[; the logger key-redacts those),
• routes through the single choke point, so all 6 body log sites are covered.

Tests

src/fetch.redact.test.ts — 3 tests (redacts secret/id while preserving base64 padding; leaves benign form bodies unchanged; doesn't corrupt JSON). tsc --noEmit clean.

Scope / follow-up

TypeScript only. This is the language @smooai/config uses, so it stops the reported leak. The Python / Rust / Go / .NET implementations of @smooai/fetch have the same body-logging shape and need the same redaction — parity follow-up, intentionally not bundled into this incident fix.

Note: the leaked secret is already in CloudWatch history until log retention expires — rotation is flagged for Brent separately.

Jira: SMOODEV-2716

🤖 Generated with Claude Code

https://claude.ai/code/session_018tRq2Rge3gGHCjJdNx6xDD

[changeset-bot]

🦋 Changeset detected

Latest commit: f0e4980

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@smooai/fetch	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[brentrager]

Superseded by #98, which fixes the same leak at the root: @smooai/logger does no redaction at all, so the Authorization header, the raw query string and the full URL in the log message were leaking on every request too — not just the url-encoded body. #98 also covers JSON bodies (this PR skipped them on the premise that the logger key-redacts objects, which it does not), ports the URL case to Rust, and drives both suites off a shared corpus. Closing in favour of that.

Note one deliberate difference: #98 does not redact client_id. It is public by design in OAuth and load-bearing when debugging a token exchange.