fix(cli): redact API keys

[7ttp]

TL;DR

fixes project keys being written to CLI traces, matching the Go cli's behavior...

Problem

The Go-cli use to send keys through the apikey header:

cli/apps/cli-go/pkg/fetcher/gateway.go

Lines 22 to 33 in 2cb2d6e

	func withAuthToken(token string) FetcherOption {
	if strings.HasPrefix(token, "sb_") {
	header := func(req *http.Request) {
	req.Header.Add("apikey", token)
	}
	return WithRequestEditor(header)
	}
	header := func(req *http.Request) {
	req.Header.Add("apikey", token)
	req.Header.Add("Authorization", "Bearer "+token)
	}
	return WithRequestEditor(header)

Its debug transport only logs the request method and URL:

cli/apps/cli-go/internal/debug/http.go

Lines 14 to 16 in 2cb2d6e

	func (t *debugTransport) RoundTrip(req *http.Request) (*http.Response, error) {
	t.logger.Printf("%s: %s\n", req.Method, req.URL)
	return t.RoundTripper.RoundTrip(req)

Effect tracing captures request headers, but apikey is not included in its default redaction list...
this allowed values to be written to local traces...

sol

exclude apikey header attributes at the tracing boundary....
requests and all other telemetry remain unchanged, while NDJSON and debug output no longer contain project keys....

ref:

• reported in: Supabase CLI 2.109.1 on Windows can resolve different Management API identities from different process contexts on the same computer and Windows user account. #5890

[7ttp]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 83b5d25ded

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".