NO-ISSUE: Remove credentials and tokens from debug logs

[jhernand]

Summary

• Remove log statements from the OAuth flow implementations that were writing
  sensitive data (client secrets, passwords, access tokens, refresh tokens) to
  debug and error logs.
• Remove the form data from the sendForm logger context, where it was
  attached to a local logger and could surface credentials in every subsequent
  log line.
• Centralize token request error logging in sendTokenForm with the request
  marked using the ! field name prefix so it is redacted by default.
• Add the ! prefix to the redirect query field in the authorization code
  flow and to verification_uri / verification_uri_complete in the device
  flow, since these can embed authorization codes or user codes.

Test plan

• ginkgo run internal/oauth passes (91 specs).

[openshift-ci-robot]

@jhernand: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

• Remove log statements from the OAuth flow implementations that were writing
  sensitive data (client secrets, passwords, access tokens, refresh tokens) to
  debug and error logs.
• Remove the form data from the sendForm logger context, where it was
  attached to a local logger and could surface credentials in every subsequent
  log line.
• Centralize token request error logging in sendTokenForm with the request
  marked using the ! field name prefix so it is redacted by default.
• Add the ! prefix to the redirect query field in the authorization code
  flow and to verification_uri / verification_uri_complete in the device
  flow, since these can embed authorization codes or user codes.

Test plan

• ginkgo run internal/oauth passes (91 specs).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jhernand

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jhernand]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 50a1cd86-5f07-492b-891e-3c55bef68730

📥 Commits

Reviewing files that changed from the base of the PR and between 2efb506 and 6101c0f.

📒 Files selected for processing (5)

• internal/oauth/oauth_code_flow.go
• internal/oauth/oauth_credentials_flow.go
• internal/oauth/oauth_device_flow.go
• internal/oauth/oauth_password_flow.go
• internal/oauth/oauth_token_source.go

💤 Files with no reviewable changes (2)

• internal/oauth/oauth_password_flow.go
• internal/oauth/oauth_credentials_flow.go

✅ Files skipped from review due to trivial changes (2)

• internal/oauth/oauth_code_flow.go
• internal/oauth/oauth_device_flow.go

---

Summary by CodeRabbit

• Refactor
  • Refined OAuth authentication logging across multiple flows to reduce noise and remove redundant entries.
  • Standardized debug field naming conventions for certain response fields to improve log consistency.
  • Consolidated error logging behavior so failures are logged more consistently while normal operation and token handling remain unchanged.

Walkthrough

Centralizes error logging for token form requests in TokenSource by removing a local wrapped logger and calling s.logger.ErrorContext directly; sendTokenForm now logs failures as “Failed to send token form”. Individual OAuth flows (code, device, credentials, password) drop redundant per-flow error logs and standardize debug-field names (prefixing request/URI fields with !); device flow also removes a token-response debug log.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: removing credentials and tokens from debug logs across OAuth flow implementations.
Description check	✅ Passed	The description is well-detailed and directly related to the changeset, explaining the removal of sensitive data from logs and the redaction strategy used.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@internal/oauth/oauth_token_source.go`:
- Around line 805-810: The centralized token-form failure log call using
s.logger.ErrorContext currently omits the error variable; update the
ErrorContext invocation (the call that logs "Failed to send token form") to
include the actual error (err) as a field (e.g., slog.Any or slog.Any("err",
err) or slog.Error) alongside the existing "endpoint" and "!request" fields so
the log contains the root-cause information for send/token form failures; modify
the ErrorContext call in oauth_token_source.go where s.logger.ErrorContext is
invoked to add the err argument.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: bd550b31-7b20-41c8-90e5-241ee3b6f965

📥 Commits

Reviewing files that changed from the base of the PR and between bd81c00 and 2efb506.

📒 Files selected for processing (5)

• internal/oauth/oauth_code_flow.go
• internal/oauth/oauth_credentials_flow.go
• internal/oauth/oauth_device_flow.go
• internal/oauth/oauth_password_flow.go
• internal/oauth/oauth_token_source.go

💤 Files with no reviewable changes (2)

• internal/oauth/oauth_credentials_flow.go
• internal/oauth/oauth_password_flow.go

[omer-vishlitzky]

/retest

[omer-vishlitzky]

/retest

[openshift-ci]

@jhernand: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-vmaas	6101c0f	link	true	/test e2e-vmaas

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.