feat: add missing sensitive fields to redactSensitiveData (#24121)

- Add private_key, encrypted_credentials, tenant_id, client_email, serviceAccountKey to SENSITIVE_FIELDS array
- Add comprehensive test cases for delegation credential sensitive fields
- Prevents logging of sensitive delegation credential data including private keys

Fixes security issue where delegation credential sensitive fields were not being redacted from logs

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: morgan@cal.com <morgan@cal.com>
Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>

packages/lib/redactSensitiveData.test.ts

@@ -150,7 +150,7 @@ describe("redactSensitiveData", () => {
   });
 
   it("should handle circular references gracefully", () => {
-    const input: any = { name: "test" };
+    const input: Record<string, unknown> = { name: "test" };
     input.self = input;
     expect(redactSensitiveData(input)).toMatchInlineSnapshot(`
       {
@@ -175,4 +175,51 @@ describe("redactSensitiveData", () => {
       }
     `);
   });
+
+  it("should redact delegation credential sensitive fields", () => {
+    const input = {
+      serviceAccountKey: {
+        client_id: "client123",
+        client_email: "service@example.com",
+        private_key: "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC...",
+        tenant_id: "tenant123",
+      },
+      encrypted_credentials: "encrypted_data_here",
+      normalField: "value",
+    };
+    expect(redactSensitiveData(input)).toMatchInlineSnapshot(`
+      {
+        "encrypted_credentials": "[REDACTED]",
+        "normalField": "value",
+        "serviceAccountKey": "[REDACTED]",
+      }
+    `);
+  });
+
+  it("should redact nested delegation credential fields", () => {
+    const input = {
+      credential: {
+        delegatedTo: {
+          serviceAccountKey: {
+            private_key: "sensitive_key",
+            client_email: "service@example.com",
+            tenant_id: "tenant123",
+          },
+        },
+      },
+      config: {
+        private_key: "another_private_key",
+        client_email: "another@example.com",
+      },
+    };
+    expect(redactSensitiveData(input)).toMatchInlineSnapshot(`
+      {
+        "config": {
+          "client_email": "[REDACTED]",
+          "private_key": "[REDACTED]",
+        },
+        "credential": "[REDACTED]",
+      }
+    `);
+  });
 });

packages/lib/redactSensitiveData.ts

@@ -7,14 +7,19 @@ const SENSITIVE_FIELDS = [
   "apiKey",
   "auth",
   "authorization",
+  "client_email",
   "client_id",
   "client_secret",
   "credential",
+  "encrypted_credentials",
   "hash",
   "key",
   "password",
+  "private_key",
   "refreshToken",
   "secret",
+  "serviceAccountKey",
+  "tenant_id",
   "token",
 ];