[zeevmoney]

Fixes Issue

N/A

Changes proposed

Keeps auth values (Authorization headers, client/store/master tokens, git and URL credentials) out of log lines, error strings, the callback report payload and HTTP responses, across opal-common, opal-client and opal-server.

opal-common / opal-client

Error formatting

• New opal_common.logging_utils.errors.describe_error() renders an exception as Type: message with credentials masked. aiohttp's repr() of ClientResponseError / ContentTypeError includes the request headers; str() does not.
• Used instead of repr(e) in the policy fetcher, the policy updater's transaction error (which also feeds the OPA health-check policy), base_policy_store_client, every OPA and Cedar client error path, the startup limiter, ApiPolicySource and the fetching engine.
• describe_validation_error() summarizes a pydantic ValidationError as locations and types, without the rejected input. The policy fetcher no longer binds the raw bundle to the log record.

Callback report payload

• The JSON POSTed to callback URLs omits each entry's fetcher config and inline data and passes entry.url through redact_url. All other fields are kept (update_id, policy_hash, user_data, fetched/saved/hash, entry.topics/dst_path/save_method, subclass fields). The keys are omitted, not set to null, and the payload still parses as DataUpdateReport.
• The reporter no longer writes the report into the registered callback configs (or the shared default callback config); each request gets its own copy.
• A non-JSON error body from one callback no longer stops the remaining failures from being logged.

Log scrubbing

• redact_url_in_text also masks sensitive query params (?token=, &api_key= ...) in free text.
• New redact_sensitive_text also masks Authorization / Proxy-Authorization values and Bearer/Basic credentials. The loguru patcher applies it to the message and to top-level string extras; CredentialScrubbingStream applies it to the final text.
• rpc.notify no longer binds the raw update; the data updater's save log redacts the source URL; the inline engine start log masks the value after -a/token flags (argv unchanged).

Responses and errors

• Unauthorized no longer echoes the presented token in the 401 body.
• throw_if_bad_status_code reads the body as text and parses JSON if it can, so an HTML error page raises the intended ValueError instead of ContentTypeError.
• An invalid OPAL_* model/JSON value raises a ValueError that names the key and the error locations, without the value. Invalid CLI option values raise click.BadParameter without the value.

Config printing

• New sensitive flag on Confi entries (confi.str("X", None, sensitive=True), accepted by every builder). Keys matching TOKEN|SECRET|PASSWORD|PASSPHRASE|API_KEY|PRIVATE_KEY|SSH_KEY count as sensitive too.
• print-config (Confi.__repr__), debug_repr() and --help show sensitive values as <redacted> and mask URL credentials in other values. OPAL's own token/key entries are marked explicitly.

Validation errors (pydantic v2)

• hide_input_in_errors=True on the config-bearing models (DataSourceEntry, DataSourceConfig, ServerDataSourceConfig, DataUpdate, CallbackEntry, UpdateCallback, the report models, FetcherConfig, FetchEvent, PolicyBundle, engine options, scope models). .errors() still has the input.
• repr() of CallbackEntry, UpdateCallback, ServerDataSourceConfig, AccessToken, CedarServerOptions, the scope auth models and the scope policy source masks URLs / tokens / keys.

opal-server

• GET /scopes omits policy.auth from every item again. The response is a list, so the exclude now addresses each item ({"__all__": {"policy": {"auth"}}}); a bare {"policy": {"auth"}} is ignored for list responses on the current pydantic v2 / FastAPI. GET /scopes/{id} already excluded it.
• POST /webhook returns repo_url through redact_url (git and API mode), and the webhook log lines redact the repo URL.
• The gunicorn master's scope preload calls configure_logs() first, so it logs with OPAL's level and redaction instead of loguru's defaults. RedisDB logs the Redis URL redacted.
• OPAL_NO_RPC_LOGS (default True) is now applied: it raises the websocket RPC/pub-sub libraries' loggers to INFO, since their DEBUG records include message payloads.
• A malformed broadcast is logged with error locations and types only, not the payload.
• Redacted URLs in the data-config redirect log, the default callback-report log (entry.url), the policy watcher failure log and the scope API's git error logs.
• /pubsub_client_info reports values of sensitive query params (token, api_key, ...) as ***.

Check List (Check all the applicable boxes)

• I sign off on contributing this submission to open-source
• My code follows the code style of this project.
• My change requires changes to the documentation.
• I have updated the documentation accordingly.
• All new and existing tests passed.
• This PR does not contain plagiarized content.
• The title of my pull request is a short description of the requested changes.

Screenshots

N/A

Note to reviewers

• Tests: every changed site has a test that triggers it with a fake value and checks the text log, a serialize=True sink, and the payload / response / error text where applicable. Test log capture runs without the global loguru patcher, so these tests check the call sites themselves. pytest packages/opal-common packages/opal-client packages/opal-server: 994 passed, 9 skipped.
• Includes fix(opal-common): keep AccessTokenRequest.ttl's schema numeric on pydantic 2.14 #965's commit so CI runs green on pydantic 2.14; it drops out when fix(opal-common): keep AccessTokenRequest.ttl's schema numeric on pydantic 2.14 #965 merges.
• CI: tests.yml gets an aggregate CI job (needs every other job and fails unless all succeed; it also checks its own needs list), runs for release/** too, and no longer uses fail-fast. The branch ruleset requires CI and pre-commit.
• Visible to consumers:
  • the callback payload no longer has entry.config / entry.data, and entry.url is redacted;
  • 401 bodies no longer have detail.token;
  • logged error strings change from repr form to Type: message (also in the OPA health-check policy's error field);
  • print-config / --help mask sensitive values;
  • a bad config value raises ValueError instead of ValidationError;
  • GET /scopes items no longer include policy.auth (as on 0.9.x);
  • the webhook response's repo_url is redacted when the configured URL carries auth;
  • /pubsub_client_info masks sensitive query values.
• Not changed: GET /scopes/{id} still returns policy.url and the scope's data entries with their config; /data/config still serves DATA_CONFIG_SOURCES to authenticated clients; DataUpdate broadcasts still carry entry configs to subscribed clients.
• The opal-common / opal-client part is ported to the 0.9 line (pydantic v1) in a separate PR against release/0.9.x.

🤖 Generated with Claude Code

[netlify]

✅ Deploy Preview for opal-docs canceled.

Name	Link
🔨 Latest commit	d083bcf
🔍 Latest deploy log	https://app.netlify.com/projects/opal-docs/deploys/6ace5575e070d6621a71694d

[linear-code]

PER-16925

PER-16823

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.