fix(logging): mask *-api-key headers in request-log pipeline

[KooshaPari]

Summary

maskSensitiveHeaders in open-sse/utils/requestLogger.ts matched a hardcoded substring list that missed several real upstream credential headers:

Header	Provider	Was masked?
x-goog-api-key	Gemini / Vertex	❌ unmasked
api-key	Azure OpenAI	❌ unmasked
xi-api-key	ElevenLabs	❌ unmasked
x-api-key	Anthropic	✅ masked

These passed through verbatim into the request-log pipeline (logTargetRequest → getPipelinePayloads).

Fix

1. Compact header matching (open-sse/utils/requestLogger.ts):

Strip hyphens from both the header key and each candidate before comparing, so the "apikey" catch-all in sensitiveKeys matches every current and future *-api-key spelling:

const compactedKey = lowerKey.replace(/-/g, "");
if (!sensitiveKeys.some((c) => compactedKey.includes(c.replace(/-/g, "")))) continue;

2. Add xi-api-key to SENSITIVE_KEYS (src/lib/logPayloads.ts):

Defense-in-depth for body-level redaction via protectPayloadForLog / redactPayload.

Tests

New regression test file tests/unit/request-logger-header-mask-apikey-13273.test.ts with 7 tests covering:

• x-goog-api-key (Gemini) — previously unmasked, now masked
• api-key (Azure OpenAI) — previously unmasked, now masked
• xi-api-key (ElevenLabs) — previously unmasked, now masked
• x-api-key (Anthropic) — still masked (regression guard)
• x-ratelimit- headers — still NOT masked (whitelist preserved)
• protectPayloadForLog redacts xi-api-key and x-goog-api-key in body payloads

All existing tests pass: request-log-payloads (26/26), request-logger-bounded-idempotence (6/6).

Related

Fixes #13273

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.