From e6bb26d0a4edde6970504c53ae819fdafd8e40b2 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 9 Mar 2026 18:28:10 +0000
Subject: [PATCH] fix: redact secrets in set_global_setting log line (#8270)

---
 backend/windmill-api-settings/src/lib.rs      |  6 +++++-
 .../windmill-common/src/instance_config.rs    | 21 ++++++++++++++++++-
 2 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/backend/windmill-api-settings/src/lib.rs b/backend/windmill-api-settings/src/lib.rs
index 6b408724fd..4198d82e48 100644
--- a/backend/windmill-api-settings/src/lib.rs
+++ b/backend/windmill-api-settings/src/lib.rs
@@ -316,7 +316,11 @@ pub async fn set_global_setting_internal(
              )
              .execute(db)
              .await?;
-            tracing::info!("Set global setting {} to {}", key, v);
+            tracing::info!(
+                "Set global setting {} to {}",
+                key,
+                instance_config::format_setting_value(&key, &v)
+            );
         }
     };
 
diff --git a/backend/windmill-common/src/instance_config.rs b/backend/windmill-common/src/instance_config.rs
index 0225448668..fb70db90ae 100644
--- a/backend/windmill-common/src/instance_config.rs
+++ b/backend/windmill-common/src/instance_config.rs
@@ -934,7 +934,7 @@ fn redact_string(s: &str) -> String {
     }
 }
 
-fn format_setting_value(key: &str, value: &serde_json::Value) -> String {
+pub fn format_setting_value(key: &str, value: &serde_json::Value) -> String {
     if SENSITIVE_SETTINGS.contains(&key) {
         return match value {
             serde_json::Value::String(s) => format!("\"{}\"", redact_string(s)),
@@ -2219,6 +2219,25 @@ mod tests {
         assert_eq!(v, *"world");
     }
 
+    #[test]
+    fn string_or_secret_ref_debug_masks_literal() {
+        let v = StringOrSecretRef::Literal("super-secret-value".to_string());
+        let debug = format!("{v:?}");
+        assert_eq!(debug, "Literal(****)");
+        assert!(!debug.contains("super-secret-value"));
+    }
+
+    #[test]
+    fn format_setting_value_redacts_oauth_secrets() {
+        let val = serde_json::json!({
+            "google": {"id": "client-id", "secret": "my-super-secret-12345"}
+        });
+        let formatted = format_setting_value("oauths", &val);
+        assert!(!formatted.contains("my-super-secret-12345"));
+        assert!(formatted.contains("client-id"));
+        assert!(formatted.contains("****"));
+    }
+
     #[test]
     #[should_panic(expected = "literal_value() called on unresolved secret ref")]
     fn string_or_secret_ref_literal_value_panics_on_ref() {