[HeZzz (HeZ2z)]

Motivation & Context

DevUI's Azure deployment flow logs the full az containerapp up command at INFO level, including the generated DEVUI_AUTH_TOKEN in plaintext. This exposes the deployment credential on the normal success path in both the existing-environment and new-environment branches.

Azure CLI output is also reused in DEBUG logs, deployment events, failure exceptions, and FQDN extraction diagnostics. If the CLI echoes the token, those outputs can expose the same credential.

Description & Review Guide

• What are the major changes?

  • Added a private helper that replaces exact matches of the current deployment token with [REDACTED], leaving text unchanged when the token is empty.
  • The command log now uses a redacted text representation while preserving the original argument list passed to Azure CLI.
  • CLI output is redacted before it is stored or used for events, exceptions, and diagnostic logs.
  • Added regression tests for both command branches, repeated CLI echoes, deployment failures, FQDN extraction failures, empty tokens, and successful token delivery.

• What is the impact of these changes?

  • The current deployment token no longer appears in command logs or CLI-derived diagnostics. Azure CLI still receives the real token, and the successful deployment event still returns it to the user. No public API change or new dependency.

• What do you want reviewers to focus on?

  • Whether redacting CLI output before storage and event handling covers the diagnostic paths without losing useful deployment context.
  • Whether the regression tests adequately protect both token confidentiality and unchanged authentication behavior.

Related Issue

Fixes #9116

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible — the DevUI suite passes (208 passed, 4 skipped), including all 9 deployment tests; the full CI matrix is pending.
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

Copilot review overview

🟢 Approval recommended

The focused security fix covers the identified disclosure paths with comprehensive regression tests.

Review effort: Balanced
Findings: None

What changed in this PR

Redacts DevUI Azure deployment tokens from commands and CLI-derived diagnostics without changing Azure CLI authentication.

Changes:

• Adds exact-token redaction for command and CLI output.
• Adds regression coverage for success, failure, environment, and empty-token paths.

File	Description
_deployment.py	Redacts tokens before logging, storing, or propagating CLI output.
test_deployment.py	Verifies confidentiality while preserving token delivery.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[Patel Namraa (Namraa310806)]

I’ve opened #9149 with a focused fix for the original issue: redact DEVUI_AUTH_TOKEN from the Running: ... command log while keeping the real token in the command passed to Azure CLI.

I think this keeps the fix narrowly scoped to the confirmed disclosure path. The additional redaction of CLI output, events, exceptions, and FQDN diagnostics in this PR seems broader than the original issue unless we have a demonstrated case where Azure CLI echoes DEVUI_AUTH_TOKEN into those outputs.

I’d suggest keeping the original fix minimal and handling broader CLI-output redaction separately if we confirm that exposure path.

[HeZzz (HeZ2z)]

I’ve opened #9149 with a focused fix for the original issue: redact DEVUI_AUTH_TOKEN from the Running: ... command log while keeping the real token in the command passed to Azure CLI.

I think this keeps the fix narrowly scoped to the confirmed disclosure path. The additional redaction of CLI output, events, exceptions, and FQDN diagnostics in this PR seems broader than the original issue unless we have a demonstrated case where Azure CLI echoes DEVUI_AUTH_TOKEN into those outputs.

I’d suggest keeping the original fix minimal and handling broader CLI-output redaction separately if we confirm that exposure path.

Thanks for raising this. I agree that the confirmed disclosure is the INFO command log, and the CLI echo tests do not establish that Azure CLI currently echoes the token.

I kept the CLI-output redaction as a small defensive safeguard. It is applied once at the subprocess output boundary, so later debug logs, events, exceptions, and FQDN diagnostics reuse the redacted text without separate mechanisms. The actual Azure CLI arguments and the token returned on successful deployment remain unchanged.

I’ll keep this distinction clear: the command log is the reproduced issue, while CLI-output redaction is conditional defense-in-depth. If maintainers prefer the PR to stay strictly limited to the reproduced path, I’m happy to split that safeguard into a follow-up.