Mask credentials in debug output and config commands

internal/cli/auth/login.go

@@ -27,6 +27,7 @@ import (
 	"github.com/tidbcloud/tidbcloud-cli/internal/config"
 	"github.com/tidbcloud/tidbcloud-cli/internal/config/store"
 	"github.com/tidbcloud/tidbcloud-cli/internal/flag"
+	"github.com/tidbcloud/tidbcloud-cli/internal/redact"
 	"github.com/tidbcloud/tidbcloud-cli/internal/util"
 	ver "github.com/tidbcloud/tidbcloud-cli/internal/version"
 
@@ -58,7 +59,7 @@ func LoginCmd(h *internal.Helper) *cobra.Command {
 			if err != nil {
 				return err
 			}
-			opts.client.SetDebug(debug)
+			opts.client.SetTransport(redact.NewDebugTransport(opts.client.GetClient().Transport, debug))
 			return nil
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {

internal/cli/auth/logout.go

@@ -21,6 +21,7 @@ import (
 	"github.com/tidbcloud/tidbcloud-cli/internal/config"
 	"github.com/tidbcloud/tidbcloud-cli/internal/config/store"
 	"github.com/tidbcloud/tidbcloud-cli/internal/flag"
+	"github.com/tidbcloud/tidbcloud-cli/internal/redact"
 	ver "github.com/tidbcloud/tidbcloud-cli/internal/version"
 
 	"github.com/fatih/color"
@@ -50,7 +51,7 @@ func LogoutCmd(h *internal.Helper) *cobra.Command {
 			if err != nil {
 				return err
 			}
-			opts.client.SetDebug(debug)
+			opts.client.SetTransport(redact.NewDebugTransport(opts.client.GetClient().Transport, debug))
 			return nil
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {

internal/cli/auth/whoami.go

@@ -25,6 +25,7 @@ import (
 	"github.com/tidbcloud/tidbcloud-cli/internal/config"
 	"github.com/tidbcloud/tidbcloud-cli/internal/config/store"
 	"github.com/tidbcloud/tidbcloud-cli/internal/flag"
+	"github.com/tidbcloud/tidbcloud-cli/internal/redact"
 	"github.com/tidbcloud/tidbcloud-cli/internal/service/cloud"
 	ver "github.com/tidbcloud/tidbcloud-cli/internal/version"
 
@@ -56,7 +57,7 @@ func WhoamiCmd(h *internal.Helper) *cobra.Command {
 			if err != nil {
 				return err
 			}
-			opts.client.SetDebug(debug)
+			opts.client.SetTransport(redact.NewDebugTransport(opts.client.GetClient().Transport, debug))
 			return nil
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {

internal/cli/config/describe.go

@@ -21,6 +21,7 @@ import (
 	"github.com/tidbcloud/tidbcloud-cli/internal"
 	"github.com/tidbcloud/tidbcloud-cli/internal/config"
 	"github.com/tidbcloud/tidbcloud-cli/internal/output"
+	"github.com/tidbcloud/tidbcloud-cli/internal/redact"
 
 	"github.com/juju/errors"
 	"github.com/spf13/cobra"
@@ -42,7 +43,7 @@ func DescribeCmd(h *internal.Helper) *cobra.Command {
 				return err
 			}
 
-			value := viper.Get(name)
+			value := redact.Any(viper.Get(name))
 			err = output.PrintJson(h.IOStreams.Out, value)
 			return errors.Trace(err)
 

internal/cli/config/describe_test.go

@@ -81,12 +81,12 @@ func (suite *DescribeConfigSuite) TestDescribeConfigArgs() {
 		{
 			name:         "describe config",
 			args:         []string{"test"},
-			stdoutString: "{\n  \"private-key\": \"SDWIOUEOSDSDC\",\n  \"public-key\": \"SDIWODIJQNDKJQW\"\n}\n",
+			stdoutString: "{\n  \"private-key\": \"***\",\n  \"public-key\": \"SDIWODIJQNDKJQW\"\n}\n",
 		},
 		{
 			name:         "describe config case-insensitive",
 			args:         []string{"teSt"},
-			stdoutString: "{\n  \"private-key\": \"SDWIOUEOSDSDC\",\n  \"public-key\": \"SDIWODIJQNDKJQW\"\n}\n",
+			stdoutString: "{\n  \"private-key\": \"***\",\n  \"public-key\": \"SDIWODIJQNDKJQW\"\n}\n",
 		},
 		{
 			name: "describe config with no args",
@@ -143,7 +143,7 @@ func (suite *DescribeConfigSuite) TestDescribeConfigWithSpecialCharacters() {
 		{
 			name:         "describe active profile",
 			args:         []string{"~`!@#$%^&*()_+-={}[]\\|;:,<>/?"},
-			stdoutString: "{\n  \"private-key\": \"SDWIOUEOSDSDC\",\n  \"public-key\": \"SDIWODIJQNDKJQW\"\n}\n",
+			stdoutString: "{\n  \"private-key\": \"***\",\n  \"public-key\": \"SDIWODIJQNDKJQW\"\n}\n",
 		},
 	}
 

internal/cli/config/set.go

@@ -21,6 +21,7 @@ import (
 	"github.com/tidbcloud/tidbcloud-cli/internal"
 	"github.com/tidbcloud/tidbcloud-cli/internal/config"
 	"github.com/tidbcloud/tidbcloud-cli/internal/prop"
+	"github.com/tidbcloud/tidbcloud-cli/internal/redact"
 
 	"github.com/fatih/color"
 	"github.com/juju/errors"
@@ -61,7 +62,7 @@ If not, the config in the active profile will be set`, prop.ProfileProperties())
 					}
 				}
 				viper.Set(fmt.Sprintf("%s.%s", curP, propertyName), value)
-				res = fmt.Sprintf("Set profile `%s` property `%s` to value `%s` successfully", curP, propertyName, value)
+				res = fmt.Sprintf("Set profile `%s` property `%s` to value `%s` successfully", curP, propertyName, redact.Value(propertyName, value))
 			} else {
 				return fmt.Errorf("unrecognized property `%s`, use `config set --help` to find available properties", propertyName)
 			}

internal/cli/config/set_test.go

@@ -86,7 +86,7 @@ func (suite *SetConfigSuite) TestSetConfigArgs() {
 		{
 			name:         "set config",
 			args:         []string{"private-key", newPrivateKey},
-			stdoutString: "Set profile `test` property `private-key` to value `TYTYTYYTYT` successfully\n",
+			stdoutString: "Set profile `test` property `private-key` to value `***` successfully\n",
 		},
 		{
 			name: "set config with no args",
@@ -158,7 +158,7 @@ func (suite *SetConfigSuite) TestSetConfigWhenNoActiveProfile() {
 		{
 			name:         "set config",
 			args:         []string{"private-key", "value"},
-			stdoutString: "Set profile `default` property `private-key` to value `value` successfully\n",
+			stdoutString: "Set profile `default` property `private-key` to value `***` successfully\n",
 		},
 	}
 

internal/cli/root_test.go

@@ -88,28 +88,28 @@ func (suite *RootCmdSuite) TestFlagProfile() {
 		{
 			name:          "test without flag profile",
 			args:          []string{"config", "set", "private-key", privateKey3},
-			stdoutString:  "Set profile `test` property `private-key` to value `324OPIFO2423423DFO` successfully\n",
+			stdoutString:  "Set profile `test` property `private-key` to value `***` successfully\n",
 			propertyKey:   "test.private-key",
 			propertyValue: "324OPIFO2423423DFO",
 		},
 		{
 			name:          "test flag --profile",
 			args:          []string{"config", "set", "private-key", privateKey1, "--profile", "test1"},
-			stdoutString:  "Set profile `test1` property `private-key` to value `SAJKGDUYAKGD` successfully\n",
+			stdoutString:  "Set profile `test1` property `private-key` to value `***` successfully\n",
 			propertyKey:   "test1.private-key",
 			propertyValue: "SAJKGDUYAKGD",
 		},
 		{
 			name:          "test flag -P",
 			args:          []string{"config", "set", "private-key", privateKey2, "-P", "test1"},
-			stdoutString:  "Set profile `test1` property `private-key` to value `{OPIFOPIDFO` successfully\n",
+			stdoutString:  "Set profile `test1` property `private-key` to value `***` successfully\n",
 			propertyKey:   "test1.private-key",
 			propertyValue: "{OPIFOPIDFO",
 		},
 		{
 			name:          "test flag -P case-insensitive",
 			args:          []string{"config", "set", "private-key", "SADASDIDFO", "-P", "tESt1"},
-			stdoutString:  "Set profile `test1` property `private-key` to value `SADASDIDFO` successfully\n",
+			stdoutString:  "Set profile `test1` property `private-key` to value `***` successfully\n",
 			propertyKey:   "test1.private-key",
 			propertyValue: "SADASDIDFO",
 		},

internal/redact/redact.go

@@ -0,0 +1,230 @@
+// Copyright 2026 PingCAP, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package redact masks credentials in values that are printed for debugging
+// (HTTP dumps, profile output) so that debug mode does not leak secrets.
+package redact
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+)
+
+const Mask = "***"
+
+// normalize lower-cases a key and strips "-" and "_" so that
+// "secret_access_key", "secretAccessKey" and "secret-access-key" all compare equal.
+func normalize(key string) string {
+	return strings.NewReplacer("-", "", "_", "").Replace(strings.ToLower(key))
+}
+
+var sensitiveKeys = map[string]struct{}{
+	"secret":            {},
+	"secretaccesskey":   {},
+	"accesskeysecret":   {},
+	"serviceaccountkey": {},
+	"sastoken":          {},
+	"azuresastoken":     {},
+	"privatekey":        {},
+	"oauthclientsecret": {},
+	"clientsecret":      {},
+	"accesstoken":       {},
+	"devicecode":        {},
+	"refreshtoken":      {},
+	"token":             {},
+	"password":          {},
+	"rootpassword":      {},
+	"sslkeycontent":     {},
+}
+
+var sensitiveHeaders = map[string]struct{}{
+	"authorization":        {},
+	"proxy-authorization":  {},
+	"cookie":               {},
+	"set-cookie":           {},
+	"x-amz-security-token": {},
+}
+
+// IsSensitiveKey reports whether a JSON field, profile property or query
+// parameter name holds a credential.
+func IsSensitiveKey(key string) bool {
+	_, ok := sensitiveKeys[normalize(key)]
+	return ok
+}
+
+// isSensitiveQueryParam covers pre-signed URL parameters of S3, GCS, Azure and OSS.
+func isSensitiveQueryParam(key string) bool {
+	k := normalize(key)
+	if IsSensitiveKey(k) || k == "sig" || k == "ossaccesskeyid" {
+		return true
+	}
+	for _, suffix := range []string{"signature", "credential", "securitytoken"} {
+		if strings.HasSuffix(k, suffix) {
+			return true
+		}
+	}
+	return false
+}
+
+// Value returns Mask when key is sensitive, otherwise value unchanged.
+func Value(key, value string) string {
+	if IsSensitiveKey(key) {
+		return Mask
+	}
+	return value
+}
+
+// Any recursively masks sensitive keys in decoded JSON / viper values.
+func Any(v interface{}) interface{} {
+	switch t := v.(type) {
+	case map[string]interface{}:
+		out := make(map[string]interface{}, len(t))
+		for k, val := range t {
+			if IsSensitiveKey(k) {
+				out[k] = Mask
+			} else {
+				out[k] = Any(val)
+			}
+		}
+		return out
+	case []interface{}:
+		out := make([]interface{}, len(t))
+		for i, val := range t {
+			out[i] = Any(val)
+		}
+		return out
+	default:
+		return v
+	}
+}
+
+// JSON masks sensitive fields of a JSON body. Non-JSON bodies are not echoed.
+func JSON(body []byte) string {
+	var v interface{}
+	if err := json.Unmarshal(body, &v); err != nil {
+		return fmt.Sprintf("<non-JSON body omitted, %d bytes>", len(body))
+	}
+	out, err := json.Marshal(Any(v))
+	if err != nil {
+		return fmt.Sprintf("<body omitted, %d bytes>", len(body))
+	}
+	return string(out)
+}
+
+// Headers returns a copy of h with credential-bearing headers masked.
+func Headers(h http.Header) http.Header {
+	out := h.Clone()
+	for k := range out {
+		if _, ok := sensitiveHeaders[strings.ToLower(k)]; ok {
+			out[k] = []string{Mask}
+		}
+	}
+	return out
+}
+
+// URL returns u as a string with credential-bearing query parameters masked.
+func URL(u *url.URL) string {
+	if u == nil {
+		return ""
+	}
+	c := *u
+	if c.RawQuery != "" {
+		q := c.Query()
+		for k := range q {
+			if isSensitiveQueryParam(k) {
+				q[k] = []string{Mask}
+			}
+		}
+		c.RawQuery = q.Encode()
+	}
+	// Redacted replaces a userinfo password with "xxxxx".
+	return c.Redacted()
+}
+
+// body echoes a JSON body (masked) and replaces *rc so it can still be read.
+// Non-JSON bodies (file uploads, downloads) are never read.
+func body(rc *io.ReadCloser, contentType string, contentLength int64) string {
+	if rc == nil || *rc == nil || *rc == http.NoBody {
+		return ""
+	}
+	if !strings.Contains(strings.ToLower(contentType), "json") {
+		return fmt.Sprintf("<%s body omitted, %d bytes>", contentType, contentLength)
+	}
+	data, err := io.ReadAll(*rc)
+	(*rc).Close()
+	*rc = io.NopCloser(bytes.NewReader(data))
+	if err != nil {
+		return fmt.Sprintf("<body unreadable: %v>", err)
+	}
+	return JSON(data)
+}
+
+// DumpRequest renders r with credentials masked.
+func DumpRequest(r *http.Request) string {
+	var b strings.Builder
+	fmt.Fprintf(&b, "%s %s %s\n", r.Method, URL(r.URL), r.Proto)
+	host := r.Host
+	if host == "" && r.URL != nil {
+		host = r.URL.Host
+	}
+	fmt.Fprintf(&b, "Host: %s\n", host)
+	_ = Headers(r.Header).Write(&b)
+	b.WriteString("\n")
+	b.WriteString(body(&r.Body, r.Header.Get("Content-Type"), r.ContentLength))
+	b.WriteString("\n")
+	return b.String()
+}
+
+// DumpResponse renders resp with credentials masked.
+func DumpResponse(resp *http.Response) string {
+	var b strings.Builder
+	fmt.Fprintf(&b, "%s %s\n", resp.Proto, resp.Status)
+	_ = Headers(resp.Header).Write(&b)
+	b.WriteString("\n")
+	b.WriteString(body(&resp.Body, resp.Header.Get("Content-Type"), resp.ContentLength))
+	b.WriteString("\n")
+	return b.String()
+}
+
+// DebugTransport prints masked request/response dumps to stdout when Debug is set.
+type DebugTransport struct {
+	Inner http.RoundTripper
+	Debug bool
+}
+
+func NewDebugTransport(inner http.RoundTripper, debug bool) http.RoundTripper {
+	if inner == nil {
+		inner = http.DefaultTransport
+	}
+	return &DebugTransport{Inner: inner, Debug: debug}
+}
+
+func (dt *DebugTransport) RoundTrip(r *http.Request) (*http.Response, error) {
+	if dt.Debug {
+		fmt.Printf("\n%s", DumpRequest(r))
+	}
+	resp, err := dt.Inner.RoundTrip(r)
+	if err != nil {
+		return resp, err
+	}
+	if dt.Debug {
+		fmt.Printf("%s\n", DumpResponse(resp))
+	}
+	return resp, err
+}