fix: address PR review suggestions for redact and tokenbroker

- redact: add "key" and "credential" to sensitive suffix list for
  defense-in-depth (api_key, private_key, signing_key, etc.)
- redact: descend into container-valued sensitive keys instead of
  skipping them — a field like {"token": {"access_token": "..."}}
  now has its nested secrets redacted
- redact: add best-effort doc noting inline secrets should use
  *_file paths; this layer is defense-in-depth
- tokenbroker: TrimSpace the extracted bearer token so whitespace-only
  tokens ("Bearer   ") are treated as missing rather than forwarded
  to the broker

Signed-off-by: Varsha Prasad Narsing <vnarsing@redhat.com>
Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Varsha Prasad Narsing <varshaprasad96@gmail.com>

Author: varshaprasad96

authbridge/authlib/plugins/tokenbroker/plugin.go

@@ -244,8 +244,7 @@ func (p *TokenBroker) OnRequest(ctx context.Context, pctx *pipeline.Context) pip
 		"server_url", serverURL,
 		"broker_url", brokerURL)
 
-	// Extract bearer token
-	subjectToken := auth.ExtractBearer(authHeader)
+	subjectToken := strings.TrimSpace(auth.ExtractBearer(authHeader))
 	if subjectToken == "" {
 		return pctx.DenyAndRecord("missing_subject_token", "auth.missing-token",
 			"broker route requires authorization token")

authbridge/authlib/redact/redact.go

@@ -1,4 +1,7 @@
-// Package redact strips sensitive values from JSON config payloads.
+// Package redact provides best-effort stripping of sensitive values from
+// JSON config payloads served by unauthenticated diagnostic endpoints.
+// The canonical defense is to keep inline secrets out of config entirely
+// (use *_file paths instead); this layer is defense-in-depth.
 package redact
 
 import (
@@ -7,7 +10,7 @@ import (
 )
 
 var sensitiveKeys = []string{
-	"secret", "password", "token", "bearer",
+	"secret", "password", "token", "bearer", "key", "credential",
 }
 
 // JSON redacts values whose keys match sensitive patterns in a
@@ -36,8 +39,8 @@ func redactMap(m map[string]any) {
 		if isSensitiveKey(k) {
 			if _, ok := v.(string); ok {
 				m[k] = "[REDACTED]"
+				continue
 			}
-			continue
 		}
 		switch val := v.(type) {
 		case map[string]any:

authbridge/authlib/redact/redact_test.go

@@ -100,6 +100,37 @@ func TestJSON_NonStringSecretPreserved(t *testing.T) {
 	}
 }
 
+func TestJSON_ContainerValuedSensitiveKey(t *testing.T) {
+	in := json.RawMessage(`{"token":{"access_token":"secret","url":"https://idp"}}`)
+	out := JSON(in)
+	var m map[string]any
+	if err := json.Unmarshal(out, &m); err != nil {
+		t.Fatal(err)
+	}
+	inner := m["token"].(map[string]any)
+	if inner["access_token"] != "[REDACTED]" {
+		t.Errorf("access_token inside container-valued sensitive key = %v, want [REDACTED]", inner["access_token"])
+	}
+	if inner["url"] != "https://idp" {
+		t.Errorf("url inside container-valued sensitive key = %v, want https://idp", inner["url"])
+	}
+}
+
+func TestJSON_RedactsApiKey(t *testing.T) {
+	in := json.RawMessage(`{"api_key":"k3y","endpoint":"https://api"}`)
+	out := JSON(in)
+	var m map[string]any
+	if err := json.Unmarshal(out, &m); err != nil {
+		t.Fatal(err)
+	}
+	if m["api_key"] != "[REDACTED]" {
+		t.Errorf("api_key = %v, want [REDACTED]", m["api_key"])
+	}
+	if m["endpoint"] != "https://api" {
+		t.Errorf("endpoint = %v, want https://api", m["endpoint"])
+	}
+}
+
 func TestJSON_NestedArrayRedaction(t *testing.T) {
 	in := json.RawMessage(`{"data":[[{"client_secret":"xyz","url":"https://a"}]]}`)
 	out := JSON(in)