feat: keep secret length in logs

Author: evgeniy-scherbina

bridge.go

@@ -247,6 +247,7 @@ func newInterceptionProcessor(p provider.Provider, cbs *circuitbreaker.ProviderC
 			slog.F("streaming", interceptor.Streaming()),
 			slog.F("credential_kind", string(cred.Kind)),
 			slog.F("credential_hint", cred.Hint),
+			slog.F("credential_length", cred.Length),
 		)
 
 		log.Debug(ctx, "interception started")

intercept/credential.go

@@ -14,16 +14,18 @@ const (
 
 // CredentialInfo holds credential metadata for an interception.
 type CredentialInfo struct {
-	Kind CredentialKind
-	Hint string
+	Kind   CredentialKind
+	Hint   string
+	Length int
 }
 
 // NewCredentialInfo creates a CredentialInfo from a raw credential.
 // The credential is automatically masked before storage so that the
 // original secret is never retained.
 func NewCredentialInfo(kind CredentialKind, credential string) CredentialInfo {
 	return CredentialInfo{
-		Kind: kind,
-		Hint: utils.MaskSecret(credential),
+		Kind:   kind,
+		Hint:   utils.MaskSecret(credential),
+		Length: len(credential),
 	}
 }