fix(oauth): redact the whole of a base64 Bearer token

internal/oauth/logging.go

@@ -137,8 +137,10 @@ var sensitiveParams = []string{
 	"credential",
 }
 
-// tokenPattern matches Bearer tokens and other sensitive token patterns.
-var tokenPattern = regexp.MustCompile(`(?i)(bearer\s+)[a-zA-Z0-9\-_\.]+`)
+// tokenPattern matches Bearer tokens and other sensitive token patterns. The
+// value class is RFC 6750's b64token, so a standard-base64 token is not cut at
+// its first '+' or '/'.
+var tokenPattern = regexp.MustCompile(`(?i)(bearer\s+)[a-zA-Z0-9\-_\.~+/]+=*`)
 
 // secretPattern matches common secret patterns.
 var secretPattern = regexp.MustCompile(`(?i)(secret|password|token|key)["']?\s*[:=]\s*["']?[a-zA-Z0-9\-_\.]+`)

internal/oauth/logging_test.go

@@ -17,6 +17,13 @@ func TestRedactSensitiveData(t *testing.T) {
 		assert.NotContains(t, result, "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9")
 	})
 
+	t.Run("redacts the whole of a base64 bearer token", func(t *testing.T) {
+		// RFC 6750 b64token: '+', '/', '~' and trailing '=' are all legal.
+		input := "upstream rejected Bearer dGhpcy1pcy1h+c2VjcmV0/dG9rZW4~cGFydA== (401)"
+		result := RedactSensitiveData(input)
+		assert.Equal(t, "upstream rejected Bearer ***REDACTED*** (401)", result)
+	})
+
 	t.Run("redacts secrets in key=value format", func(t *testing.T) {
 		input := "client_secret=my-super-secret-value"
 		result := RedactSensitiveData(input)