fix(multiplayer): harden observability redaction

server/observability/log.go

@@ -45,19 +45,57 @@ func redact(key string, value any) any {
 		}
 	}
 	switch typed := value.(type) {
+	case string:
+		if looksLikeCredential(typed) {
+			return "[REDACTED]"
+		}
+		return typed
 	case map[string]any:
 		copy := make(map[string]any, len(typed))
 		for key, value := range typed {
 			copy[key] = redact(key, value)
 		}
 		return copy
+	case map[string]string:
+		copy := make(map[string]string, len(typed))
+		for key, value := range typed {
+			redacted := redact(key, value)
+			copy[key] = redacted.(string)
+		}
+		return copy
 	case []any:
 		copy := make([]any, len(typed))
 		for i, value := range typed {
 			copy[i] = redact("item", value)
 		}
 		return copy
+	case []string:
+		copy := make([]string, len(typed))
+		for i, value := range typed {
+			copy[i] = redact("item", value).(string)
+		}
+		return copy
 	default:
 		return value
 	}
 }
+
+func looksLikeCredential(value string) bool {
+	trimmed := strings.TrimSpace(value)
+	if strings.HasPrefix(strings.ToLower(trimmed), "bearer ") || strings.Contains(trimmed, "-----BEGIN ") {
+		return true
+	}
+	parts := strings.Split(trimmed, ".")
+	if len(parts) == 3 && len(parts[0]) >= 8 && len(parts[1]) >= 8 && len(parts[2]) >= 8 {
+		return true // compact JWT-like credential
+	}
+	if len(trimmed) < 40 || strings.ContainsAny(trimmed, " \t\r\n") {
+		return false
+	}
+	hasLetter, hasDigit := false, false
+	for _, ch := range trimmed {
+		hasLetter = hasLetter || (ch >= 'A' && ch <= 'Z') || (ch >= 'a' && ch <= 'z')
+		hasDigit = hasDigit || (ch >= '0' && ch <= '9')
+	}
+	return hasLetter && hasDigit
+}

server/observability/log_test.go

@@ -2,6 +2,7 @@ package observability
 
 import (
 	"encoding/json"
+	"strings"
 	"testing"
 	"time"
 )
@@ -30,3 +31,20 @@ func TestEncodeRejectsUnnamedEvents(t *testing.T) {
 		t.Fatal("unnamed event accepted")
 	}
 }
+
+func TestEncodeRedactsCredentialLookingValuesUnderUnknownKeys(t *testing.T) {
+	payload, err := Encode(Event{Event: "test", Fields: map[string]any{
+		"unexpected": "workload-secret-value-12345678901234567890",
+		"nested":     map[string]string{"opaque": "Bearer should-not-appear"},
+		"items":      []string{"eyJhbGciOiJIUzI1NiJ9.payload-value.signature-value"},
+	}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	text := string(payload)
+	for _, secret := range []string{"workload-secret-value", "Bearer should-not-appear", "eyJhbGciOiJIUzI1NiJ9"} {
+		if strings.Contains(text, secret) {
+			t.Fatalf("credential leaked under unknown key: %s", payload)
+		}
+	}
+}