[CRED-2625] Redact ContextAccessToken in debug request dump

[luczhou]

Description

The debug-dump path in CallAPI() (api/datadog/client.go:171-184) redacts api/app key values pulled from ContextAPIKeys before logging the captured request bytes. The Authorization header set from ContextAccessToken (delegated tokens, PATs) is dumped verbatim — any caller running with Cfg.Debug = true and access-token auth leaks the bearer to the global logger.

Surfaced by terraform-provider-datadog#3757, which is the first Terraform code path to set ContextAccessToken. With TF_LOG=DEBUG, the PAT would land in Terraform stderr, CI artifacts, and downstream log shippers — a self-contained bearer is full account-impersonating compromise until rotated.

Tracking ticket: CRED-2625.

Changes

• .generator/src/generator/templates/client.j2:175-189: extend the existing redaction block to also walk ContextAccessToken from the request context. Compile a regexp.QuoteMeta-escaped pattern from the token value and ReplaceAll it with REDACTED in the dump bytes.
• api/datadog/client.go: mirror the same edit in the generated file so the diff matches what the next regen produces.
• tests/api/client_test.go: add TestDebugDumpRedactsAccessToken — drives CallAPI against an httptest.Server with Cfg.Debug = true and a ContextAccessToken-bearing context (plus a matching Authorization header to simulate what PrepareRequest sets in production). Captures the global logger output and asserts the token value does not appear in the dump and REDACTED does.

Out of scope, left for follow-ups:

• The existing api-keys loop has two latent bugs (missing regexp.QuoteMeta, no empty-key guard). Keeping this PR minimal — happy to file a separate cleanup PR.
• The response-dump block (client.go:192-200) has no redaction at all. Lower risk since responses rarely echo auth headers, but worth fixing in a follow-up.

Cross-language

Related work tracked under CRED-2625:

• datadog-api-client-typescript PR: same fix shape (add Authorization to allowlist in isomorphic-fetch.ts:logRequest).
• datadog-api-client-ruby PR: same fix shape (add Authorization to sanitize_request_header's keys_to_redact).
• datadog-api-client-java GH issue: wider gap — Jersey LoggingFeature.PAYLOAD_ANY has no header redaction at all, so api/app keys and bearer leak in debug mode. Tracked as an issue for api-platform guidance on the right shape.
• datadog-api-client-python: no equivalent gap (the rest.j2 debug path logs only response body, not request headers).

Testing

• go test ./tests/api/... -run TestDebugDumpRedactsAccessToken passes
• Existing tests/api/client_test.go suite still passes (4 tests, all green)
• go build ./api/datadog/... clean
• Regen confirms template ↔ generated parity (api-platform CI)

🤖 Generated with Claude Code