redactExchangeTokenRequest masks the external OIDC JWT. The token is a credential — it could be replayed against the original IdP or, if logged, reveal workload identity claims. The caller's email is kept for audit correlation.
(r *v1pb.ExchangeTokenRequest)
| 599 | // reveal workload identity claims. The caller's email is kept for audit |
| 600 | // correlation. |
| 601 | func redactExchangeTokenRequest(r *v1pb.ExchangeTokenRequest) *v1pb.ExchangeTokenRequest { |
| 602 | if r == nil { |
| 603 | return nil |
| 604 | } |
| 605 | r = proto.CloneOf(r) |
| 606 | if r.Token != "" { |
| 607 | r.Token = maskedString |
| 608 | } |
| 609 | return r |
| 610 | } |
| 611 | |
| 612 | // redactExchangeTokenResponse drops the issued Bytebase access token. Logging |
| 613 | // it would give anyone with audit-log read access a valid API token for the |