security: Implemented API key redaction for secure logging

- Add redact_key_for_logging() helper function to show only first/last 6 chars
- Fix API key exposure in app/service/key/key_manager.py line 68
- Apply key redaction across all Python files with API key logging
- Standardize logging security across 17 files including routers, services, handlers

app/router/config_routes.py

@@ -11,6 +11,7 @@ from pydantic import BaseModel, Field
 from app.core.security import verify_auth_token
 from app.log.logger import Logger, get_config_routes_logger
 from app.service.config.config_service import ConfigService
+from app.utils.helpers import redact_key_for_logging
 
 router = APIRouter(prefix="/api/config", tags=["config"])
 
@@ -63,10 +64,10 @@ class DeleteKeysRequest(BaseModel):
 async def delete_single_key(key_to_delete: str, request: Request):
     auth_token = request.cookies.get("auth_token")
     if not auth_token or not verify_auth_token(auth_token):
-        logger.warning(f"Unauthorized attempt to delete key: {key_to_delete}")
+        logger.warning(f"Unauthorized attempt to delete key: {redact_key_for_logging(key_to_delete)}")
         return RedirectResponse(url="/", status_code=302)
     try:
-        logger.info(f"Attempting to delete key: {key_to_delete}")
+        logger.info(f"Attempting to delete key: {redact_key_for_logging(key_to_delete)}")
         result = await ConfigService.delete_key(key_to_delete)
         if not result.get("success"):
             raise HTTPException(
@@ -79,7 +80,7 @@ async def delete_single_key(key_to_delete: str, request: Request):
     except HTTPException as e:
         raise e
     except Exception as e:
-        logger.error(f"Error deleting key '{key_to_delete}': {e}", exc_info=True)
+        logger.error(f"Error deleting key '{redact_key_for_logging(key_to_delete)}': {e}", exc_info=True)
         raise HTTPException(status_code=500, detail=f"Error deleting key: {str(e)}")
 
 

app/router/files_routes.py

@@ -15,6 +15,7 @@ from app.log.logger import get_files_logger
 from app.core.security import SecurityService
 from app.service.files.files_service import get_files_service
 from app.service.files.file_upload_handler import get_upload_handler
+from app.utils.helpers import redact_key_for_logging
 
 logger = get_files_logger()
 
@@ -202,7 +203,7 @@ async def handle_upload(
 ):
     """处理文件上传请求"""
     try:
-        logger.info(f"Handling upload request: {request.method} {upload_path}, key={key}")
+        logger.info(f"Handling upload request: {request.method} {upload_path}, key={redact_key_for_logging(key)}")
         
         # 從查詢參數獲取 upload_id
         upload_id = request.query_params.get("upload_id")
@@ -222,7 +223,7 @@ async def handle_upload(
         # 使用真實的 API key 構建完整的 Google 上傳 URL
         # 保留原始 URL 的所有參數，但使用真實的 API key
         upload_url = original_upload_url
-        logger.info(f"Using real API key for upload: {real_api_key[:8]}...{real_api_key[-4:]}")
+        logger.info(f"Using real API key for upload: {redact_key_for_logging(real_api_key)}")
         
         # 代理上传请求
         upload_handler = get_upload_handler()

app/router/gemini_routes.py

@@ -13,6 +13,7 @@ from app.service.model.model_service import ModelService
 from app.handler.retry_handler import RetryHandler
 from app.handler.error_handler import handle_route_errors
 from app.core.constants import API_VERSION
+from app.utils.helpers import redact_key_for_logging
 
 router = APIRouter(prefix=f"/gemini/{API_VERSION}")
 router_v1beta = APIRouter(prefix=f"/{API_VERSION}")
@@ -52,7 +53,7 @@ async def list_models(
         api_key = await key_manager.get_first_valid_key()
         if not api_key:
             raise HTTPException(status_code=503, detail="No valid API keys available to fetch models.")
-        logger.info(f"Using API key: {api_key}")
+        logger.info(f"Using API key: {redact_key_for_logging(api_key)}")
 
         models_data = await model_service.get_gemini_models(api_key)
         if not models_data or "models" not in models_data:
@@ -125,7 +126,7 @@ async def generate_content(
                 logger.info(f"TTS responseModalities: {response_modalities}")
                 logger.info(f"TTS speechConfig: {speech_config}")
 
-        logger.info(f"Using API key: {api_key}")
+        logger.info(f"Using API key: {redact_key_for_logging(api_key)}")
 
         if not await model_service.check_model_support(model_name):
             raise HTTPException(status_code=400, detail=f"Model {model_name} is not supported")
@@ -169,7 +170,7 @@ async def stream_generate_content(
     async with handle_route_errors(logger, operation_name, failure_message="Streaming request initiation failed"):
         logger.info(f"Handling Gemini streaming content generation for model: {model_name}")
         logger.debug(f"Request: \n{request.model_dump_json(indent=2)}")
-        logger.info(f"Using API key: {api_key}")
+        logger.info(f"Using API key: {redact_key_for_logging(api_key)}")
 
         if not await model_service.check_model_support(model_name):
             raise HTTPException(status_code=400, detail=f"Model {model_name} is not supported")
@@ -198,7 +199,7 @@ async def count_tokens(
     async with handle_route_errors(logger, operation_name, failure_message="Token counting failed"):
         logger.info(f"Handling Gemini token count request for model: {model_name}")
         logger.debug(f"Request: \n{request.model_dump_json(indent=2)}")
-        logger.info(f"Using API key: {api_key}")
+        logger.info(f"Using API key: {redact_key_for_logging(api_key)}")
 
         if not await model_service.check_model_support(model_name):
             raise HTTPException(status_code=400, detail=f"Model {model_name} is not supported")
@@ -274,9 +275,9 @@ async def reset_selected_key_fail_counts(
                 if result:
                     reset_count += 1
                 else:
-                    logger.warning(f"Key not found during selective reset: {key}")
+                    logger.warning(f"Key not found during selective reset: {redact_key_for_logging(key)}")
             except Exception as key_error:
-                logger.error(f"Error resetting key {key}: {str(key_error)}")
+                logger.error(f"Error resetting key {redact_key_for_logging(key)}: {str(key_error)}")
                 errors.append(f"Key {key}: {str(key_error)}")
 
         if errors:
@@ -303,7 +304,7 @@ async def reset_selected_key_fail_counts(
 async def reset_key_fail_count(api_key: str, key_manager: KeyManager = Depends(get_key_manager)):
     """重置指定Gemini API密钥的失败计数"""
     logger.info("-" * 50 + "reset_gemini_key_fail_count" + "-" * 50)
-    logger.info(f"Resetting failure count for API key: {api_key}")
+    logger.info(f"Resetting failure count for API key: {redact_key_for_logging(api_key)}")
     
     try:
         result = await key_manager.reset_key_failure_count(api_key)
@@ -348,7 +349,7 @@ async def verify_key(api_key: str, chat_service: GeminiChatService = Depends(get
         async with key_manager.failure_count_lock:
             if api_key in key_manager.key_failure_counts:
                 key_manager.key_failure_counts[api_key] += 1
-                logger.warning(f"Verification exception for key: {api_key}, incrementing failure count")
+                logger.warning(f"Verification exception for key: {redact_key_for_logging(api_key)}, incrementing failure count")
         
         return JSONResponse({"status": "invalid", "error": str(e)})
 
@@ -389,14 +390,14 @@ async def verify_selected_keys(
             return api_key, "valid", None
         except Exception as e:
             error_message = str(e)
-            logger.warning(f"Key verification failed for {api_key}: {error_message}")
+            logger.warning(f"Key verification failed for {redact_key_for_logging(api_key)}: {error_message}")
             async with key_manager.failure_count_lock:
                 if api_key in key_manager.key_failure_counts:
                     key_manager.key_failure_counts[api_key] += 1
-                    logger.warning(f"Bulk verification exception for key: {api_key}, incrementing failure count")
+                    logger.warning(f"Bulk verification exception for key: {redact_key_for_logging(api_key)}, incrementing failure count")
                 else:
                      key_manager.key_failure_counts[api_key] = 1
-                     logger.warning(f"Bulk verification exception for key: {api_key}, initializing failure count to 1")
+                     logger.warning(f"Bulk verification exception for key: {redact_key_for_logging(api_key)}, initializing failure count to 1")
             failed_keys[api_key] = error_message
             return api_key, "invalid", error_message
 

app/router/openai_compatiable_routes.py

@@ -13,6 +13,7 @@ from app.handler.error_handler import handle_route_errors
 from app.log.logger import get_openai_compatible_logger
 from app.service.key.key_manager import KeyManager, get_key_manager_instance
 from app.service.openai_compatiable.openai_compatiable_service import OpenAICompatiableService
+from app.utils.helpers import redact_key_for_logging
 
 
 router = APIRouter()
@@ -46,7 +47,7 @@ async def list_models(
     async with handle_route_errors(logger, operation_name):
         logger.info("Handling models list request")
         api_key = await key_manager.get_first_valid_key()
-        logger.info(f"Using API key: {api_key}")
+        logger.info(f"Using API key: {redact_key_for_logging(api_key)}")
         return await openai_service.get_models(api_key)
 
 
@@ -69,7 +70,7 @@ async def chat_completion(
     async with handle_route_errors(logger, operation_name):
         logger.info(f"Handling chat completion request for model: {request.model}")
         logger.debug(f"Request: \n{request.model_dump_json(indent=2)}")
-        logger.info(f"Using API key: {current_api_key}")
+        logger.info(f"Using API key: {redact_key_for_logging(current_api_key)}")
 
         if is_image_chat:
             response = await openai_service.create_image_chat_completion(request, current_api_key)
@@ -107,7 +108,7 @@ async def embedding(
     async with handle_route_errors(logger, operation_name):
         logger.info(f"Handling embedding request for model: {request.model}")
         api_key = await key_manager.get_next_working_key()
-        logger.info(f"Using API key: {api_key}")
+        logger.info(f"Using API key: {redact_key_for_logging(api_key)}")
         return await openai_service.create_embeddings(
             input_text=request.input, model=request.model, api_key=api_key
         )

app/router/openai_routes.py

@@ -18,6 +18,7 @@ from app.service.image.image_create_service import ImageCreateService
 from app.service.tts.tts_service import TTSService
 from app.service.key.key_manager import KeyManager, get_key_manager_instance
 from app.service.model.model_service import ModelService
+from app.utils.helpers import redact_key_for_logging
 
 router = APIRouter()
 logger = get_openai_logger()
@@ -60,7 +61,7 @@ async def list_models(
     async with handle_route_errors(logger, operation_name):
         logger.info("Handling models list request")
         api_key = await key_manager.get_first_valid_key()
-        logger.info(f"Using API key: {api_key}")
+        logger.info(f"Using API key: {redact_key_for_logging(api_key)}")
         return await model_service.get_gemini_openai_models(api_key)
 
 
@@ -84,7 +85,7 @@ async def chat_completion(
     async with handle_route_errors(logger, operation_name):
         logger.info(f"Handling chat completion request for model: {request.model}")
         logger.debug(f"Request: \n{request.model_dump_json(indent=2)}")
-        logger.info(f"Using API key: {current_api_key}")
+        logger.info(f"Using API key: {redact_key_for_logging(current_api_key)}")
 
         if not await model_service.check_model_support(request.model):
             raise HTTPException(
@@ -129,7 +130,7 @@ async def embedding(
     async with handle_route_errors(logger, operation_name):
         logger.info(f"Handling embedding request for model: {request.model}")
         api_key = await key_manager.get_next_working_key()
-        logger.info(f"Using API key: {api_key}")
+        logger.info(f"Using API key: {redact_key_for_logging(api_key)}")
         response = await embedding_service.create_embedding(
             input_text=request.input, model=request.model, api_key=api_key
         )
@@ -170,6 +171,6 @@ async def text_to_speech(
     async with handle_route_errors(logger, operation_name):
         logger.info(f"Handling TTS request for model: {request.model}")
         logger.debug(f"Request: \n{request.model_dump_json(indent=2)}")
-        logger.info(f"Using API key: {api_key}")
+        logger.info(f"Using API key: {redact_key_for_logging(api_key)}")
         audio_data = await tts_service.create_tts(request, api_key)
         return Response(content=audio_data, media_type="audio/wav")

app/router/stats_routes.py

@@ -3,6 +3,7 @@ from starlette import status
 from app.core.security import verify_auth_token
 from app.service.stats.stats_service import StatsService
 from app.log.logger import get_stats_logger
+from app.utils.helpers import redact_key_for_logging
 
 logger = get_stats_logger()
 
@@ -48,7 +49,7 @@ async def get_key_usage_details(key: str):
             return {}
         return usage_details
     except Exception as e:
-        logger.error(f"Error fetching key usage details for key {key[:4]}...: {e}")
+        logger.error(f"Error fetching key usage details for key {redact_key_for_logging(key)}: {e}")
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
             detail=f"获取密钥使用详情时出错: {e}"

app/router/vertex_express_routes.py

@@ -11,6 +11,7 @@ from app.service.model.model_service import ModelService
 from app.handler.retry_handler import RetryHandler
 from app.handler.error_handler import handle_route_errors
 from app.core.constants import API_VERSION
+from app.utils.helpers import redact_key_for_logging
 
 router = APIRouter(prefix=f"/vertex-express/{API_VERSION}")
 logger = get_vertex_express_logger()
@@ -48,7 +49,7 @@ async def list_models(
         api_key = await key_manager.get_first_valid_key()
         if not api_key:
             raise HTTPException(status_code=503, detail="No valid API keys available to fetch models.")
-        logger.info(f"Using API key: {api_key}")
+        logger.info(f"Using API key: {redact_key_for_logging(api_key)}")
 
         models_data = await model_service.get_gemini_models(api_key)
         if not models_data or "models" not in models_data:
@@ -105,7 +106,7 @@ async def generate_content(
     async with handle_route_errors(logger, operation_name, failure_message="Content generation failed"):
         logger.info(f"Handling Gemini content generation request for model: {model_name}")
         logger.debug(f"Request: \n{request.model_dump_json(indent=2)}")
-        logger.info(f"Using API key: {api_key}")
+        logger.info(f"Using API key: {redact_key_for_logging(api_key)}")
 
         if not await model_service.check_model_support(model_name):
             raise HTTPException(status_code=400, detail=f"Model {model_name} is not supported")
@@ -133,7 +134,7 @@ async def stream_generate_content(
     async with handle_route_errors(logger, operation_name, failure_message="Streaming request initiation failed"):
         logger.info(f"Handling Gemini streaming content generation for model: {model_name}")
         logger.debug(f"Request: \n{request.model_dump_json(indent=2)}")
-        logger.info(f"Using API key: {api_key}")
+        logger.info(f"Using API key: {redact_key_for_logging(api_key)}")
 
         if not await model_service.check_model_support(model_name):
             raise HTTPException(status_code=400, detail=f"Model {model_name} is not supported")