fix(compliance): redact extra provider API keys (#10521)

changelog.d/fixes/10521-audit-extra-api-keys-redaction.md

@@ -0,0 +1 @@
+- **fix(compliance):** redact additional provider API keys from audit-log payloads ([#10521](https://github.com/diegosouzapw/OmniRoute/pull/10521)) — thanks @Zartharas

src/lib/compliance/index.ts

@@ -111,6 +111,7 @@ const AUDIT_LOG_REQUIRED_COLUMNS: Record<string, string> = {
 
 const SENSITIVE_AUDIT_KEYS = new Set([
   "apikey",
+  "extraapikeys",
   "accesstoken",
   "refreshtoken",
   "idtoken",

tests/unit/compliance-index.test.ts

@@ -92,6 +92,12 @@ test("compliance audit log supports structured filters, totals and secret redact
       nested: {
         refreshToken: "refresh-secret",
       },
+      providerSpecificData: {
+        extraApiKeys: ["sk-extra-1", "sk-extra-2"],
+        token: "token-secret",
+        userToken: "user-token-secret",
+        cookie: "cookie-secret",
+      },
       changedFields: ["defaultModel"],
     },
     ipAddress: "10.0.0.4",
@@ -133,6 +139,12 @@ test("compliance audit log supports structured filters, totals and secret redact
     nested: {
       refreshToken: "[redacted]",
     },
+    providerSpecificData: {
+      extraApiKeys: "[redacted]",
+      token: "[redacted]",
+      userToken: "[redacted]",
+      cookie: "[redacted]",
+    },
     changedFields: ["defaultModel"],
   });
   assert.deepEqual(updatedEntry.metadata, updatedEntry.details);