Redact bearer tokens and cloud secrets from --debug HTTP dumps

DebugTransport in internal/service/cloud previously called
httputil.DumpRequestOut(r, true) and httputil.DumpResponse(resp, true)
whenever TICLOUD_DEBUG=1 (set by --debug). The dumped output included:

  * Authorization: Bearer <token> headers added by BearTokenTransport
    before the request reached DebugTransport.
  * Digest auth Authorization metadata from NewDigestTransport, which
    wraps DebugTransport.
  * Full JSON request bodies for S3/OSS/GCS/Azure import, export, and
    audit-log cloud-storage-config commands, including AWS/OSS secret
    access keys, GCS service account keys, and Azure SAS tokens.

Anyone running `ticloud --debug <cmd>` or piping logs to a shared
location could leak long-lived cloud credentials and short-lived bearer
tokens. This is the "[High]" finding in the AKSK logging security
review.

Fix

  * New package internal/service/cloud/redact with DumpRequestOut and
    DumpResponse that mirror httputil's body=true behaviour but:
      - replace sensitive header values
        (Authorization / Proxy-Authorization / Cookie / Set-Cookie)
        with "[REDACTED]", preserving the Bearer/Digest/Basic scheme
        prefix so the auth method is still visible in logs;
      - parse JSON bodies and recursively replace values for
        case-insensitive sensitive keys (secret, secretAccessKey,
        accessKeySecret, serviceAccountKey, sasToken, private-key,
        oauth-client-secret, client_secret, access_token,
        refresh_token, password, token, and underscored variants);
      - replace non-JSON bodies entirely with a length-only placeholder,
        guarding pre-signed URLs and form-encoded credentials;
      - restore the original headers and a fresh body reader on the
        request/response so the wire-level HTTP exchange is unchanged.
  * DebugTransport.RoundTrip now calls redact.DumpRequestOut /
    redact.DumpResponse instead of the raw httputil helpers. No public
    API or CLI flag changes; only --debug stdout output is affected.

Scope and out-of-scope

  Only the two "[High]" findings are addressed. The "[Medium]" issues
  (config describe / config set raw value printing, Resty SetDebug on
  auth client) and the "[Low/Latent]" generator-template issues remain
  to be handled in follow-up changes per their severity.

Tests

  * internal/service/cloud/redact/redact_test.go (19 cases, 90.7%
    coverage): Bearer / Digest auth, Cookie, Proxy-Authorization, S3 /
    OSS / GCS / Azure / audit-log bodies, deeply nested JSON, arrays of
    secrets, case-insensitive key matching, non-JSON body redaction,
    empty body, body-still-readable round-trip, and assertions that
    non-sensitive identifiers (clusterId, displayName, access key id)
    remain visible.
  * internal/service/cloud/api_client_debug_test.go (4 cases): end-to-
    end through BearTokenTransport + DebugTransport against an httptest
    server with TICLOUD_DEBUG=1, capturing os.Stdout to assert that:
      - raw bearer tokens and response access_tokens never appear;
      - access key ids (identifiers, not secrets) remain visible;
      - debug off produces no stdout output;
      - the body delivered to the upstream server is byte-identical to
        the original payload (no behavioural drift on the wire).

  All tests pass under `make test` (-race -count=1).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: baiyuqing

internal/service/cloud/api_client.go

@@ -20,11 +20,11 @@ import (
 	"fmt"
 	"io"
 	"net/http"
-	"net/http/httputil"
 	"os"
 
 	"github.com/tidbcloud/tidbcloud-cli/internal/config"
 	"github.com/tidbcloud/tidbcloud-cli/internal/prop"
+	"github.com/tidbcloud/tidbcloud-cli/internal/service/cloud/redact"
 	"github.com/tidbcloud/tidbcloud-cli/internal/version"
 	"github.com/tidbcloud/tidbcloud-cli/pkg/tidbcloud/v1beta1/iam"
 	"github.com/tidbcloud/tidbcloud-cli/pkg/tidbcloud/v1beta1/serverless/auditlog"
@@ -854,7 +854,7 @@ func (dt *DebugTransport) RoundTrip(r *http.Request) (*http.Response, error) {
 	debug := os.Getenv(config.DebugEnv) == "true" || os.Getenv(config.DebugEnv) == "1"
 
 	if debug {
-		dump, err := httputil.DumpRequestOut(r, true)
+		dump, err := redact.DumpRequestOut(r)
 		if err != nil {
 			return nil, err
 		}
@@ -867,7 +867,7 @@ func (dt *DebugTransport) RoundTrip(r *http.Request) (*http.Response, error) {
 	}
 
 	if debug {
-		dump, err := httputil.DumpResponse(resp, true)
+		dump, err := redact.DumpResponse(resp)
 		if err != nil {
 			return resp, err
 		}

internal/service/cloud/api_client_debug_test.go

@@ -0,0 +1,208 @@
+// Copyright 2026 PingCAP, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cloud
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/tidbcloud/tidbcloud-cli/internal/config"
+)
+
+// captureStdout swaps os.Stdout for a pipe while fn runs and returns the
+// captured bytes. Not safe for concurrent use; these tests must not run in
+// parallel.
+func captureStdout(t *testing.T, fn func()) string {
+	t.Helper()
+	old := os.Stdout
+	r, w, err := os.Pipe()
+	if err != nil {
+		t.Fatalf("os.Pipe: %v", err)
+	}
+	os.Stdout = w
+
+	done := make(chan struct{})
+	var buf bytes.Buffer
+	go func() {
+		_, _ = io.Copy(&buf, r)
+		close(done)
+	}()
+
+	fn()
+
+	_ = w.Close()
+	<-done
+	os.Stdout = old
+	_ = r.Close()
+	return buf.String()
+}
+
+func TestDebugTransport_RedactsBearerToken(t *testing.T) {
+	t.Setenv(config.DebugEnv, "1")
+
+	const token = "leakyBearerTokenABCDEF.payload.signature"
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.Header().Set("Set-Cookie", "sid=responseLeakCookie; HttpOnly")
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte(`{"access_token":"responseAccessTokenSecret","user":"alice"}`))
+	}))
+	defer srv.Close()
+
+	transport := NewBearTokenTransport(token)
+	client := &http.Client{Transport: transport}
+
+	out := captureStdout(t, func() {
+		req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, srv.URL+"/v1/x", nil)
+		if err != nil {
+			t.Fatalf("NewRequest: %v", err)
+		}
+		resp, err := client.Do(req)
+		if err != nil {
+			t.Fatalf("client.Do: %v", err)
+		}
+		_, _ = io.Copy(io.Discard, resp.Body)
+		_ = resp.Body.Close()
+	})
+
+	if strings.Contains(out, token) {
+		t.Fatalf("raw bearer token leaked to stdout:\n%s", out)
+	}
+	if !strings.Contains(out, "Bearer [REDACTED]") {
+		t.Fatalf("expected 'Bearer [REDACTED]' in stdout, got:\n%s", out)
+	}
+	if strings.Contains(out, "responseAccessTokenSecret") {
+		t.Fatalf("response access_token leaked to stdout:\n%s", out)
+	}
+	if strings.Contains(out, "responseLeakCookie") {
+		t.Fatalf("Set-Cookie value leaked to stdout:\n%s", out)
+	}
+}
+
+func TestDebugTransport_NoDebug_NoOutput(t *testing.T) {
+	t.Setenv(config.DebugEnv, "")
+
+	const token = "shouldNotBePrintedToken"
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	client := &http.Client{Transport: NewBearTokenTransport(token)}
+
+	out := captureStdout(t, func() {
+		req, _ := http.NewRequestWithContext(context.Background(), http.MethodGet, srv.URL, nil)
+		resp, err := client.Do(req)
+		if err != nil {
+			t.Fatalf("client.Do: %v", err)
+		}
+		_ = resp.Body.Close()
+	})
+
+	if out != "" {
+		t.Fatalf("expected no stdout output when debug off, got %q", out)
+	}
+}
+
+func TestDebugTransport_RedactsS3ImportSecret(t *testing.T) {
+	t.Setenv(config.DebugEnv, "1")
+
+	const (
+		token             = "bearerForS3Test"
+		secretAccessValue = "wJalrXUtnFEMI_S3_SECRET_LEAK_CANARY"
+	)
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// drain the body so DumpRequestOut sees something to dump
+		_, _ = io.Copy(io.Discard, r.Body)
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte(`{"id":"imp-1"}`))
+	}))
+	defer srv.Close()
+
+	body := bytes.NewBufferString(
+		`{"source":{"type":"S3","s3":{"uri":"s3://b/k","accessKey":{"id":"AKIATEST","secret":"` + secretAccessValue + `"}}}}`,
+	)
+
+	client := &http.Client{Transport: NewBearTokenTransport(token)}
+
+	out := captureStdout(t, func() {
+		req, err := http.NewRequestWithContext(context.Background(), http.MethodPost, srv.URL+"/v1/imports", body)
+		if err != nil {
+			t.Fatalf("NewRequest: %v", err)
+		}
+		req.Header.Set("Content-Type", "application/json")
+		resp, err := client.Do(req)
+		if err != nil {
+			t.Fatalf("client.Do: %v", err)
+		}
+		_, _ = io.Copy(io.Discard, resp.Body)
+		_ = resp.Body.Close()
+	})
+
+	if strings.Contains(out, secretAccessValue) {
+		t.Fatalf("S3 secret leaked to stdout:\n%s", out)
+	}
+	if !strings.Contains(out, "AKIATEST") {
+		t.Fatalf("access key id should remain visible (it is an identifier, not a secret):\n%s", out)
+	}
+	if strings.Contains(out, token) {
+		t.Fatalf("bearer token leaked to stdout:\n%s", out)
+	}
+}
+
+func TestDebugTransport_BodyForwardedToServer(t *testing.T) {
+	t.Setenv(config.DebugEnv, "1")
+
+	const payload = `{"clusterId":"c-1","secret":"x"}`
+
+	var received []byte
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		b, _ := io.ReadAll(r.Body)
+		received = b
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	client := &http.Client{Transport: NewBearTokenTransport("t")}
+
+	captureStdout(t, func() {
+		req, _ := http.NewRequestWithContext(
+			context.Background(),
+			http.MethodPost,
+			srv.URL+"/",
+			bytes.NewBufferString(payload),
+		)
+		req.Header.Set("Content-Type", "application/json")
+		resp, err := client.Do(req)
+		if err != nil {
+			t.Fatalf("client.Do: %v", err)
+		}
+		_ = resp.Body.Close()
+	})
+
+	if string(received) != payload {
+		t.Fatalf("server received %q, want %q (debug dump must not alter wire body)", string(received), payload)
+	}
+}