[makssein]

With OAUTH_DEBUG=true, secrets from the request body of #get_token and AccessToken#refresh! end up in the debug log: client_secret (with auth_scheme: :request_body), code_verifier, and refresh_token. These specs reproduce it through the real client calls and currently fail.

This happens because #get_token passes the params to Faraday as a Hash, and the debug logger is added before :url_encoded. So Faraday logs the body via #pretty_inspect, like {"client_secret" => "..."}. SanitizedLogger only redacts the Authorization header, JSON pairs, and key=value pairs, so this format slips through. The existing form-encoded spec doesn't catch it because it passes an already-encoded string to client.request.

This could be fixed by making SanitizedLogger also redact Ruby Hash #inspect output ("key" => "value", key: "value", :key=>"value"). That way it works regardless of the middleware order or a custom connection_build. On top of that, the default connection could add the logger after :url_encoded, so the log shows the real encoded body.

[pboling]

@makssein This is pretty good. I'm releasing a new auth-sanitizer that will have a tool we can use to fix this.

Auth::Sanitizer.sanitize(value, filtered_keys:, label:)

ruby-oauth/auth-sanitizer#27

Also - I have the CI issues resolved separately. I'll have that into main shortly as well

[pboling]

Since this PR is just specs I'll merge it now.