fix: redact credentials in client config log output

tests/test_utils.py

@@ -109,3 +109,21 @@ def test_use_shuffled(self, use_shuffled):
             for t in trains:
                 assert "shuffle" not in t
                 assert "train" in t
+
+
+class TestRedactSensitive:
+    @pytest.mark.parametrize("key", ["password", "Password", "api_key", "token"])
+    def test_sensitive_keys_are_masked(self, key):
+        assert utils.redact_sensitive({"host": "h", key: "s3cret"}) == {"host": "h", key: utils.MASK}
+
+    def test_http_auth_keeps_user_and_masks_secret(self):
+        assert utils.redact_sensitive({"http_auth": ("admin", "s3cret")}) == {"http_auth": ("admin", utils.MASK)}
+        # serverless OpenSearch passes an opaque auth object (e.g. AWS4Auth) instead of a pair
+        assert utils.redact_sensitive({"http_auth": object()}) == {"http_auth": utils.MASK}
+
+    def test_nested_values_and_non_sensitive_keys(self):
+        config = {"hosts": [{"host": "h", "port": 443, "password": "s3cret"}], "use_ssl": True}
+        assert utils.redact_sensitive(config) == {
+            "hosts": [{"host": "h", "port": 443, "password": utils.MASK}],
+            "use_ssl": True,
+        }

vectordb_bench/backend/clients/adbpg/adbpg.py

@@ -12,6 +12,7 @@
 from psycopg import Connection, Cursor, sql
 
 from vectordb_bench.backend.filter import Filter, FilterOp
+from vectordb_bench.backend.utils import redact_sensitive
 
 from ..api import VectorDB
 from .config import AdbpgConfigDict, AdbpgIndexConfig
@@ -68,7 +69,7 @@ def __init__(
         # construct basic units
         self.conn, self.cursor = self._create_connection(**self.connect_config)
 
-        log.info(f"{self.name} config values: {self.connect_config}\n{self.case_config}")
+        log.info(f"{self.name} config values: {redact_sensitive(self.connect_config)}\n{self.case_config}")
         if not any(
             (
                 self.case_config.create_index_before_load,
@@ -77,7 +78,7 @@ def __init__(
         ):
             msg = (
                 f"{self.name} config must create an index using create_index_before_load or create_index_after_load"
-                f"{self.name} config values: {self.connect_config}\n{self.case_config}"
+                f"{self.name} config values: {redact_sensitive(self.connect_config)}\n{self.case_config}"
             )
             log.error(msg)
             raise RuntimeError(msg)

vectordb_bench/backend/clients/aliyun_opensearch/aliyun_opensearch.py

@@ -7,6 +7,7 @@
 from alibabacloud_ha3engine_vector.client import Client
 from alibabacloud_ha3engine_vector.models import QueryRequest
 
+from ...utils import redact_sensitive
 from ..api import MetricType, VectorDB
 from .config import AliyunOpenSearchIndexConfig
 
@@ -52,7 +53,7 @@ def __init__(
             ),
         )
 
-        log.info(f"Aliyun_OpenSearch client config: {self.db_config}")
+        log.info(f"Aliyun_OpenSearch client config: {redact_sensitive(self.db_config)}")
 
         if drop_old:
             log.info(f"aliyun_OpenSearch client drop old index: {self.collection_name}")

vectordb_bench/backend/clients/alloydb/alloydb.py

@@ -10,6 +10,7 @@
 from pgvector.psycopg import register_vector
 from psycopg import Connection, Cursor, sql
 
+from ...utils import redact_sensitive
 from ..api import VectorDB
 from .config import AlloyDBConfigDict, AlloyDBIndexConfig
 
@@ -51,7 +52,7 @@ def __init__(
         self.cursor.execute("CREATE EXTENSION IF NOT EXISTS alloydb_scann CASCADE")
         self.conn.commit()
 
-        log.info(f"{self.name} config values: {self.db_config}\n{self.case_config}")
+        log.info(f"{self.name} config values: {redact_sensitive(self.db_config)}\n{self.case_config}")
         if not any(
             (
                 self.case_config.create_index_before_load,

vectordb_bench/backend/clients/aws_opensearch/aws_opensearch.py

@@ -7,6 +7,7 @@
 
 from vectordb_bench import config
 from vectordb_bench.backend.filter import Filter, FilterOp
+from vectordb_bench.backend.utils import redact_sensitive
 
 from ..api import VectorDB
 from .config import AWSOpenSearchIndexConfig, AWSOS_Engine
@@ -48,7 +49,7 @@ def __init__(
         self.with_scalar_labels = with_scalar_labels
         self._insert_batch_size = kwargs.get("insert_batch_size", config.DEFAULT_INSERT_BATCH_SIZE)
 
-        log.info(f"AWS_OpenSearch client config: {self.db_config}")
+        log.info(f"AWS_OpenSearch client config: {redact_sensitive(self.db_config)}")
         log.info(f"AWS_OpenSearch db case config : {self.case_config}")
         self._is_serverless = ".aoss." in self.db_config.get("hosts", [{}])[0].get("host", "")
         client = OpenSearch(**self.db_config)

vectordb_bench/backend/clients/cockroachdb/cockroachdb.py

@@ -12,6 +12,7 @@
 from psycopg_pool import ConnectionPool
 
 from vectordb_bench.backend.filter import Filter, FilterOp
+from vectordb_bench.backend.utils import redact_sensitive
 
 from ..api import VectorDB
 from .config import CockroachDBIndexConfig
@@ -91,7 +92,7 @@ def __init__(  # noqa: PLR0915
         self.conn: Connection | None = None
         self.cursor: Cursor | None = None
 
-        log.info(f"{self.name} config: {self.connect_config}, pool_size={self.pool_size}")
+        log.info(f"{self.name} config: {redact_sensitive(self.connect_config)}, pool_size={self.pool_size}")
 
         # Allow manual index creation (both flags can be False)
         # This is useful when CREATE INDEX times out in subprocess on multi-node clusters

vectordb_bench/backend/clients/hologres/hologres.py

@@ -14,6 +14,7 @@
 from psycopg.adapt import Dumper
 from psycopg.pq import Format
 
+from ...utils import redact_sensitive
 from ..api import VectorDB
 from .config import HologresConfig, HologresIndexConfig
 
@@ -89,7 +90,7 @@ def __init__(
             cursor.execute("CREATE EXTENSION proxima;")
             conn.commit()
 
-        log.info(f"{self.name} config values: {self.db_config}\n{self.case_config}")
+        log.info(f"{self.name} config values: {redact_sensitive(self.db_config)}\n{self.case_config}")
         if not any(
             (
                 self.case_config.create_index_before_load,
@@ -98,7 +99,7 @@ def __init__(
         ):
             msg = (
                 f"{self.name} config must create an index using create_index_before_load or create_index_after_load"
-                f"{self.name} config values: {self.db_config}\n{self.case_config}"
+                f"{self.name} config values: {redact_sensitive(self.db_config)}\n{self.case_config}"
             )
             log.error(msg)
             raise RuntimeError(msg)

vectordb_bench/backend/clients/lindorm/lindorm_search.py

@@ -8,6 +8,7 @@
 from opensearchpy import OpenSearch
 
 from vectordb_bench.backend.filter import Filter, FilterOp
+from vectordb_bench.backend.utils import redact_sensitive
 
 from ..api import IndexType, VectorDB
 from .config import LindormConfig, LindormIndexConfig
@@ -50,7 +51,7 @@ def __init__(
         self.vector_col_name = vector_col_name
         self.with_scalar_labels = with_scalar_labels
         self._pending_post_optimize_sleep = False  # need sleep after optimize
-        log.debug(f"Lindorm client config: {self.db_config}")
+        log.debug(f"Lindorm client config: {redact_sensitive(self.db_config)}")
         log.debug(f"index name: {self.index_name}")
         log.debug(f"Lindorm index config: {self.case_config}")
         client = OpenSearch(**self.db_config)

vectordb_bench/backend/clients/memorydb/memorydb.py

@@ -12,6 +12,7 @@
 from redis.commands.search.indexDefinition import IndexDefinition, IndexType
 from redis.commands.search.query import Query
 
+from ...utils import redact_sensitive
 from ..api import VectorDB
 from .config import MemoryDBIndexConfig
 
@@ -36,7 +37,7 @@ def __init__(
         self.dbsize = kwargs.get("num_rows")
 
         # Create a MemoryDB connection, if db has password configured, add it to the connection here and in init():
-        log.info(f"Establishing connection to: {self.db_config}")
+        log.info(f"Establishing connection to: {redact_sensitive(self.db_config)}")
         conn = self.get_client(primary=True)
         log.info(f"Connection established: {conn}")
         log.info(conn.execute_command("INFO server"))

vectordb_bench/backend/clients/oceanbase/oceanbase.py

@@ -9,6 +9,7 @@
 import mysql.connector as mysql
 
 from vectordb_bench.backend.filter import Filter, FilterOp
+from vectordb_bench.backend.utils import redact_sensitive
 
 from ..api import IndexType, VectorDB
 from .config import OceanBaseConfigDict, OceanBaseHNSWConfig
@@ -47,7 +48,9 @@ def __init__(
         self._vector_field = "embedding"
 
         log.info(
-            f"{self.name} initialized with config:\nDatabase: {self.db_config}\nCase Config: {self.db_case_config}"
+            f"{self.name} initialized with config:\n"
+            f"Database: {redact_sensitive(self.db_config)}\n"
+            f"Case Config: {self.db_case_config}"
         )
 
         self._conn = None

vectordb_bench/backend/clients/oss_opensearch/oss_opensearch.py

@@ -10,6 +10,7 @@
 
 from vectordb_bench.backend.filter import Filter, FilterOp
 from vectordb_bench.backend.payload import PayloadProfile
+from vectordb_bench.backend.utils import redact_sensitive
 
 from ..api import VectorDB
 from .config import OSSOpenSearchFtsConfig, OSSOpenSearchIndexConfig, OSSOS_Engine
@@ -226,7 +227,7 @@ def __init__(
         self.filter: dict[str, Any] | None = None
         self.routing_key: str | None = None
 
-        log.info(f"OSS_OpenSearch client config: {self.db_config}")
+        log.info(f"OSS_OpenSearch client config: {redact_sensitive(self.db_config)}")
         log.info(f"OSS_OpenSearch db case config: {self.case_config}")
         client = OpenSearch(**self.db_config)
         self._handle_index_initialization(client, drop_old)

vectordb_bench/backend/clients/pgdiskann/pgdiskann.py

@@ -11,6 +11,7 @@
 from psycopg import Connection, Cursor, sql
 
 from vectordb_bench.backend.filter import Filter, FilterOp
+from vectordb_bench.backend.utils import redact_sensitive
 
 from ..api import VectorDB
 from .config import PgDiskANNConfigDict, PgDiskANNIndexConfig
@@ -57,7 +58,7 @@ def __init__(
 
         self.conn, self.cursor = self._create_connection(**self.db_config)
 
-        log.info(f"{self.name} config values: {self.db_config}\n{self.case_config}")
+        log.info(f"{self.name} config values: {redact_sensitive(self.db_config)}\n{self.case_config}")
         if not any(
             (
                 self.case_config.create_index_before_load,
@@ -66,7 +67,7 @@ def __init__(
         ):
             msg = (
                 f"{self.name} config must create an index using create_index_before_load or create_index_after_load"
-                f"{self.name} config values: {self.db_config}\n{self.case_config}"
+                f"{self.name} config values: {redact_sensitive(self.db_config)}\n{self.case_config}"
             )
             log.error(msg)
             raise RuntimeError(msg)

vectordb_bench/backend/clients/pgvecto_rs/pgvecto_rs.py

@@ -10,6 +10,7 @@
 from pgvecto_rs.psycopg import register_vector
 from psycopg import Connection, Cursor, sql
 
+from ...utils import redact_sensitive
 from ..api import VectorDB
 from .config import PgVectoRSConfig, PgVectoRSIndexConfig
 
@@ -46,7 +47,7 @@ def __init__(
         # construct basic units
         self.conn, self.cursor = self._create_connection(**self.db_config)
 
-        log.info(f"{self.name} config values: {self.db_config}\n{self.case_config}")
+        log.info(f"{self.name} config values: {redact_sensitive(self.db_config)}\n{self.case_config}")
         if not any(
             (
                 self.case_config.create_index_before_load,
@@ -55,7 +56,7 @@ def __init__(
         ):
             msg = (
                 f"{self.name} config must create an index using create_index_before_load or create_index_after_load"
-                f"{self.name} config values: {self.db_config}\n{self.case_config}"
+                f"{self.name} config values: {redact_sensitive(self.db_config)}\n{self.case_config}"
             )
             log.error(msg)
             raise RuntimeError(msg)

vectordb_bench/backend/clients/pgvector/pgvector.py

@@ -12,6 +12,7 @@
 from psycopg import Connection, Cursor, sql
 
 from vectordb_bench.backend.filter import Filter, FilterOp
+from vectordb_bench.backend.utils import redact_sensitive
 
 from ..api import VectorDB
 from .config import PgVectorConfigDict, PgVectorIndexConfig
@@ -62,7 +63,7 @@ def __init__(
         self.cursor.execute("CREATE EXTENSION IF NOT EXISTS vector")
         self.conn.commit()
 
-        log.info(f"{self.name} config values: {self.connect_config}\n{self.case_config}")
+        log.info(f"{self.name} config values: {redact_sensitive(self.connect_config)}\n{self.case_config}")
         if not any(
             (
                 self.case_config.create_index_before_load,
@@ -71,7 +72,7 @@ def __init__(
         ):
             msg = (
                 f"{self.name} config must create an index using create_index_before_load or create_index_after_load"
-                f"{self.name} config values: {self.connect_config}\n{self.case_config}"
+                f"{self.name} config values: {redact_sensitive(self.connect_config)}\n{self.case_config}"
             )
             log.error(msg)
             raise RuntimeError(msg)

vectordb_bench/backend/clients/pgvectorscale/pgvectorscale.py

@@ -10,6 +10,7 @@
 from pgvector.psycopg import register_vector
 from psycopg import Connection, Cursor, sql
 
+from ...utils import redact_sensitive
 from ..api import VectorDB
 from .config import PgVectorScaleConfigDict, PgVectorScaleIndexConfig
 
@@ -46,7 +47,7 @@ def __init__(
 
         self.conn, self.cursor = self._create_connection(**self.db_config)
 
-        log.info(f"{self.name} config values: {self.db_config}\n{self.case_config}")
+        log.info(f"{self.name} config values: {redact_sensitive(self.db_config)}\n{self.case_config}")
         if not any(
             (
                 self.case_config.create_index_before_load,
@@ -55,7 +56,7 @@ def __init__(
         ):
             msg = (
                 f"{self.name} config must create an index using create_index_before_load or create_index_after_load"
-                f"{self.name} config values: {self.db_config}\n{self.case_config}"
+                f"{self.name} config values: {redact_sensitive(self.db_config)}\n{self.case_config}"
             )
             log.error(msg)
             raise RuntimeError(msg)

vectordb_bench/backend/clients/seekdb/seekdb.py

@@ -9,6 +9,7 @@
 import mysql.connector as mysql
 
 from vectordb_bench.backend.filter import Filter, FilterOp
+from vectordb_bench.backend.utils import redact_sensitive
 
 from ..api import IndexType, VectorDB
 from .config import SeekDBConfigDict, SeekDBHNSWConfig
@@ -71,7 +72,9 @@ def __init__(
         self.expr = ""
 
         log.info(
-            f"{self.name} initialized with config:\nDatabase: {self.db_config}\nCase Config: {self.db_case_config}"
+            f"{self.name} initialized with config:\n"
+            f"Database: {redact_sensitive(self.db_config)}\n"
+            f"Case Config: {self.db_case_config}"
         )
 
         self._conn = None

vectordb_bench/backend/clients/vectorchord/vectorchord.py

@@ -12,6 +12,7 @@
 from psycopg import Connection, Cursor, sql
 
 from ...filter import Filter, FilterOp
+from ...utils import redact_sensitive
 from ..api import VectorDB
 from .config import VectorChordConfigDict, VectorChordIndexConfig
 
@@ -62,7 +63,7 @@ def __init__(
         self.cursor.execute("CREATE EXTENSION IF NOT EXISTS vchord CASCADE")
         self.conn.commit()
 
-        log.info(f"{self.name} config values: {self.db_config}\n{self.case_config}")
+        log.info(f"{self.name} config values: {redact_sensitive(self.db_config)}\n{self.case_config}")
         if not any(
             (
                 self.case_config.create_index_before_load,
@@ -71,7 +72,7 @@ def __init__(
         ):
             msg = (
                 f"{self.name} config must create an index using create_index_before_load or create_index_after_load"
-                f"{self.name} config values: {self.db_config}\n{self.case_config}"
+                f"{self.name} config values: {redact_sensitive(self.db_config)}\n{self.case_config}"
             )
             log.error(msg)
             raise RuntimeError(msg)