REST catalog OAuth2 authentication failure logs the plaintext `ACCESSKEY`

Self Checks

• I have read the Contributing Guide.
• This is only for bug report, if you would like to ask a question, please head to Discussions.
• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report, otherwise it will be closed.
• 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
• Please do not modify this template :) and fill in all the required fields.

OceanBase version

OceanBase CE 5.0.2.0, source revision d128661ca4f5b3d167c1928e556d70d2f901baef, Release+ASan.

Self Hosted

Self Hosted (Source)

Environment

Ubuntu 22.04.5 LTS, x86_64, one-zone loopback observer. Both URIs use the closed local port 127.0.0.1:1, so no external system is accessed. Retained logs were mode 0600.

Steps to reproduce

As root@sys on a disposable cluster, execute:

CREATE EXTERNAL CATALOG edbf_report_catalog
  PROPERTIES=(
    TYPE='REST', URI='http://127.0.0.1:1', AUTH_TYPE='oauth2',
    ACCESSID='EDBF_REPORT_OAUTH_ID', ACCESSKEY='EDBF_REPORT_OAUTH_SECRET',
    SCOPE='EDBF_REPORT_SCOPE', OAUTH2_SVR_URI='http://127.0.0.1:1');
SET CATALOG edbf_report_catalog;
SHOW DATABASES;

The final statement reaches the local OAuth2 client and fails with connection refused. Inspect the new run's observer.log; the complete authoritative log is bundled as artifacts/observer.log:

WDIAG ... fail to curl oauth2 credential(
  oauth2_key={..., accesskey:"EDBF_REPORT_OAUTH_SECRET", ...})

The warning sinks are in src/share/catalog/rest/auth/ob_rest_auth_mgr.cpp:216 and :224, where the full oauth2_key object is logged.

artifacts.zip

✔️ Expected Behavior

OAuth2 failures should log endpoint and error information but never client secrets, access keys, tokens, or authorization headers.

❌ Actual Behavior

The failed local token request writes the complete ACCESSKEY marker to a warning log. No token is issued and the observer remains healthy. This is proof of a diagnostic leak, not proof of unprivileged filesystem access.