From 588416cad135bc47b463862ac4f0e5a909d7bbfc Mon Sep 17 00:00:00 2001
From: Ned Petrov <nedd.petrov@gmail.com>
Date: Mon, 31 Aug 2026 09:24:26 +0300
Subject: [PATCH] Redact application_credential.secret from OpenStack API debug
 logs

ExconLoggingInstrumentor.redact did not scrub the application credential
secret from Keystone auth request bodies, causing it to appear in BOSH
task debug logs when application credential auth was in use.
---
 .../openstack/excon_logging_instrumentor.rb   |  1 +
 .../unit/excon_logging_instrumentor_spec.rb   | 27 +++++++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/src/bosh_openstack_cpi/lib/cloud/openstack/excon_logging_instrumentor.rb b/src/bosh_openstack_cpi/lib/cloud/openstack/excon_logging_instrumentor.rb
index 1b95d84e4..5362eb331 100644
--- a/src/bosh_openstack_cpi/lib/cloud/openstack/excon_logging_instrumentor.rb
+++ b/src/bosh_openstack_cpi/lib/cloud/openstack/excon_logging_instrumentor.rb
@@ -31,6 +31,7 @@ def redact(params)
         redact_body(redacted_params, 'auth.passwordCredentials.password')
         redact_body(redacted_params, 'server.user_data')
         redact_body(redacted_params, 'auth.identity.password.user.password')
+        redact_body(redacted_params, 'auth.identity.application_credential.secret')
         redact_headers(redacted_params, 'X-Auth-Token')
         redacted_params
       end
diff --git a/src/bosh_openstack_cpi/spec/unit/excon_logging_instrumentor_spec.rb b/src/bosh_openstack_cpi/spec/unit/excon_logging_instrumentor_spec.rb
index 47cb376a9..b90e50c68 100644
--- a/src/bosh_openstack_cpi/spec/unit/excon_logging_instrumentor_spec.rb
+++ b/src/bosh_openstack_cpi/spec/unit/excon_logging_instrumentor_spec.rb
@@ -195,6 +195,33 @@
         end
       end
 
+      context 'with application_credential.secret in body' do
+        let(:body) {
+          {
+            auth: {
+              identity: {
+                application_credential: {
+                  secret: 'my-application-credential-secret',
+                },
+              },
+            },
+          } }
+        let(:params) {
+          {
+            body: JSON.dump(body),
+            headers: {
+              'Content-Type' => 'application/json',
+            },
+          } }
+
+        it 'redacts application_credential.secret' do
+          redacted_params = subject.redact(params)
+
+          parsed_body = JSON.parse(redacted_params[:body])
+          expect(parsed_body['auth']['identity']['application_credential']['secret']).to eq('<redacted>')
+        end
+      end
+
       context 'with server.user_data in body' do
         let(:body) {
           {