Potential fix for code scanning alert no. 62: Clear-text logging of sensitive information

[zehnm]

Potential fix for https://github.com/unfoldedcircle/integration-node-library/security/code-scanning/62

At a high level, the fix is to avoid logging sensitive values in clear text. Since #log_json_message is a generic helper used for all message types, the best approach is to centralize redaction there: before stringifying the JSON, sanitize known sensitive fields (particularly the OAuth2-related ones) so that tokens, token IDs and similar secrets are replaced with placeholders. That way, we keep the useful structural logging (message kind, IDs, non-sensitive attributes) without risking credential leakage, and we avoid having to special-case every call site.

Concretely, within index.ts, we should update #log_json_message so it:

1. Clones the json object to avoid mutating the original payload being sent/processed.
2. Applies the existing filterBase64Images on the clone.
3. Applies an additional redaction step that:
   • Masks token, access_token, refresh_token, id_token, authorization_code, and similar fields when they appear in:
     • msg_data.token (for CreateOauth2Cfg etc., where token: api.Oauth2Token is passed).
     • msg_data.token_id.
     • Any top-level token, token_id, or nested under oauth / credentials objects, to be robust.
4. Logs the sanitized object instead of the original.

Because we must not assume unshown files, the redaction logic should be implemented inline in index.ts as a small helper inside #log_json_message (or immediately above it) using plain TypeScript/JavaScript and no new imports. We do not need to touch lib/utils.ts; it already only handles base64 images and is not responsible for secrets.

We will therefore modify the #log_json_message method in index.ts (around lines 485–500) to introduce a sanitizeForLogging step that performs a shallow clone and recursive redaction of common secret-looking keys, and then log sanitizeForLogging(filterBase64Images(clone)). This single change will address all four variants of the alert because every affected request uses #sendRequest, which in turn calls #log_json_message.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.