4 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Shuai Lin	0fa9638dd5	Support custom admin session expire via ADMIN_SESSION_EXPIRE env	2025-07-21 12:16:25 +08:00
Shuai Lin	9d4d6464bf	security: enhance API key redaction with comprehensive testing and error handling ... - Refactored redaction logic to use centralized helper function - Added robust error handling in AccessLogFormatter - Improved regex patterns for better OpenAI key detection - Added comprehensive unit tests covering edge cases and error scenarios - Enhanced input validation with descriptive error placeholders	2025-07-21 10:40:24 +08:00
Shuai Lin	f3d9cb2b85	security: implement HTTP access log API key redaction ... - Add AccessLogFormatter class with regex patterns for API key detection - Create setup_access_logging() function to configure uvicorn access logs - Support redaction for Google/Gemini (AIza*) and OpenAI (sk-*) API keys - Configure main.py to use custom access logging with redaction - Prevent API key exposure in HTTP access logs like "POST /verify-key/AIza..." Now access logs show: "POST /verify-key/AIzaxx...xyzxyz" instead of full keys	2025-07-21 10:09:29 +08:00
Shuai Lin	6abda7d902	security: Implemented API key redaction for secure logging ... - Add redact_key_for_logging() helper function to show only first/last 6 chars - Fix API key exposure in app/service/key/key_manager.py line 68 - Apply key redaction across all Python files with API key logging - Standardize logging security across 17 files including routers, services, handlers	2025-07-21 02:03:29 +08:00