fix(logs/azure): redact sensitive header when DEBUG is set

src/core.ts

@@ -1138,9 +1138,33 @@ function applyHeadersMut(targetHeaders: Headers, newHeaders: Headers): void {
   }
 }
 
+const SENSITIVE_HEADERS = new Set(['authorization', 'api-key']);
+
 export function debug(action: string, ...args: any[]) {
   if (typeof process !== 'undefined' && process?.env?.['DEBUG'] === 'true') {
-    console.log(`OpenAI:DEBUG:${action}`, ...args);
+    const modifiedArgs = args.map((arg) => {
+      if (!arg) {
+        return arg;
+      }
+
+      const modifiedArg = { ...arg };
+      // Check for sensitive headers in request body 'headers' object
+      if (modifiedArg['headers']) {
+        for (const header in modifiedArg['headers']) {
+          if (SENSITIVE_HEADERS.has(header.toLowerCase())) {
+            modifiedArg['headers'][header] = 'REDACTED';
+          }
+        }
+      }
+      // Check for sensitive headers in headers object
+      for (const header in modifiedArg) {
+        if (SENSITIVE_HEADERS.has(header.toLowerCase())) {
+          modifiedArg[header] = 'REDACTED';
+        }
+      }
+      return modifiedArg;
+    });
+    console.log(`OpenAI:DEBUG:${action}`, ...modifiedArgs);
   }
 }
 

tests/index.test.ts

@@ -2,7 +2,7 @@
 
 import OpenAI from 'openai';
 import { APIUserAbortError } from 'openai';
-import { Headers } from 'openai/core';
+import { debug, Headers } from 'openai/core';
 import defaultFetch, { Response, type RequestInit, type RequestInfo } from 'node-fetch';
 
 describe('instantiate client', () => {
@@ -411,3 +411,59 @@ describe('retries', () => {
     expect(count).toEqual(3);
   });
 });
+
+describe('Debug', () => {
+  const env = process.env;
+  const spy = jest.spyOn(console, 'log');
+
+  beforeEach(() => {
+    jest.resetModules();
+    process.env = { ...env };
+    process.env['DEBUG'] = 'true';
+  });
+
+  afterEach(() => {
+    process.env = env;
+  });
+
+  test('body request object with Authorization header', function () {
+    // Test request body includes headers object with Authorization
+    const headersTest = {
+      headers: {
+        Authorization: 'fakeAuthorization',
+      },
+    };
+    debug('request', headersTest);
+    expect(spy).toHaveBeenCalledWith('OpenAI:DEBUG:request', {
+      headers: {
+        Authorization: 'REDACTED',
+      },
+    });
+  });
+
+  test('body request object with api-key header', function () {
+    // Test request body includes headers object with api-ley
+    const apiKeyTest = {
+      headers: {
+        'api-key': 'fakeKey',
+      },
+    };
+    debug('request', apiKeyTest);
+    expect(spy).toHaveBeenCalledWith('OpenAI:DEBUG:request', {
+      headers: {
+        'api-key': 'REDACTED',
+      },
+    });
+  });
+
+  test('header object with Authorization header', function () {
+    // Test headers object with authorization header
+    const authorizationTest = {
+      authorization: 'fakeValue',
+    };
+    debug('request', authorizationTest);
+    expect(spy).toHaveBeenCalledWith('OpenAI:DEBUG:request', {
+      authorization: 'REDACTED',
+    });
+  });
+});