fix(logs/azure): redact sensitive header when DEBUG is set

src/core.ts

@@ -1139,8 +1139,27 @@
 }
 
 export function debug(action: string, ...args: any[]) {
+  const sensitiveHeaders = ["authorization", "api-key"];
   if (typeof process !== 'undefined' && process?.env?.['DEBUG'] === 'true') {
-    console.log(`OpenAI:DEBUG:${action}`, ...args);
+    for (const arg of args) {
+      if (!arg) {
+        break;
+      }
+      // Check for sensitive headers in request body "headers"
+      if (arg["headers"]) {
+        for (const header in arg["headers"]){
+          if (sensitiveHeaders.includes(header.toLowerCase())){
+            arg["headers"][header] = "REDACTED";
+          }
+        }
+      }
+      // Check for sensitive headers in headers object
+      for (const header in arg){
+        if (sensitiveHeaders.includes(header.toLowerCase())){
+          arg[header] = "REDACTED";
+        }
+      }
+    }
   }
 }
 

tests/qs/utils.test.ts

@@ -1,3 +1,4 @@
+import { debug } from 'openai/core';
 import { combine, merge, is_buffer, assign_single_source } from 'openai/internal/qs/utils';
 
 describe('merge()', function () {
@@ -167,3 +168,50 @@
   // t.equal(is_buffer(buffer), true, 'real Buffer instance is a buffer');
   expect(is_buffer(buffer)).toEqual(true);
 });
+
+test("debug()", function(){
+  const originalDebugValue = process.env["DEBUG"];
+
+  const spy = jest.spyOn(console, "log");
+
+  // Debug enabled
+  process.env["DEBUG"]= "true";
+
+  // Test request body includes headers object with Authorization
+  const headersTest = {
+    headers: {
+      Authorization: "fakeAuthorization"
+    }
+  }
+  debug("request", headersTest);
+  expect(spy).toHaveBeenCalledWith("OpenAI:DEBUG:request", {
+    headers: {
+      Authorization: "REDACTED"
+    }
+  });
+
+  // Test request body includes headers object with api-ley
+  const apiKeyTest = {
+    headers: {
+      "api-key": "fakeKey"
+    }
+  }
+  debug("request", apiKeyTest);
+  expect(spy).toHaveBeenCalledWith("OpenAI:DEBUG:request", {
+    headers: {
+      "api-key": "REDACTED"
+    }
+  });
+
+  // Test headers object with authorization header
+  const authorizationTest = {
+    authorization: "fakeValue"
+  }
+  debug("request", authorizationTest);
+  expect(spy).toHaveBeenCalledWith("OpenAI:DEBUG:request", {
+    authorization: "REDACTED"
+  });
+
+  process.env["DEBUG"] = originalDebugValue;
+
+})