fix(logging): distinguish credential labels from secret values

Author: justinwlin

runpod/_logger.py

@@ -109,12 +109,20 @@ def log(self, message, message_level="INFO", job_id=None):
         print(f"{message_level.ljust(7)}| {message}", flush=True)
         return
 
-    def secret(self, secret_name, secret):
-        """Log the secret's name without exposing its value or length."""
+    def secret(self, name=None, secret=None, **kwargs):
+        """Log a credential label without exposing its value or length.
+
+        `secret_name=` remains accepted for compatibility with older callers.
+        """
+        if "secret_name" in kwargs:
+            if name is not None:
+                raise TypeError("Pass either name or secret_name, not both")
+            name = kwargs.pop("secret_name")
+        if kwargs:
+            raise TypeError("Unexpected keyword argument to secret()")
         # Even a one-character value must be completely redacted. Do not call
         # str(secret): custom objects may reveal sensitive data or raise.
-        self.info(f"{secret_name}: [REDACTED]")
-
+        self.info(f"{name}: [REDACTED]")
 
     def debug(self, message, request_id: Optional[str] = None):
         """

tests/test_serverless/test_modules/test_logger.py

@@ -119,6 +119,17 @@ def __str__(self):
                     self.logger.secret("credential", value)
                     mock_log.assert_called_once_with("credential: [REDACTED]", "INFO", None)
 
+    def test_secret_legacy_keyword_label(self):
+        with patch.object(self.logger, "log") as mock_log:
+            self.logger.secret(secret_name="credential", secret="sensitive")
+            mock_log.assert_called_once_with("credential: [REDACTED]", "INFO", None)
+
+    def test_secret_rejects_conflicting_or_unknown_labels(self):
+        with self.assertRaises(TypeError):
+            self.logger.secret("first", "sensitive", secret_name="second")
+        with self.assertRaises(TypeError):
+            self.logger.secret("credential", "sensitive", unexpected="value")
+
     def test_log_tip(self):
         """
         Tests that the tip method logs a tip.