fix(redaction): preserve workflow state tokens

Author: Bill Leoutsakos

apps/sim/lib/core/security/redaction.test.ts

@@ -53,6 +53,10 @@ describe('isSensitiveKey', () => {
       expect(isSensitiveKey('refresh_token')).toBe(true)
       expect(isSensitiveKey('auth_token')).toBe(true)
       expect(isSensitiveKey('accessToken')).toBe(true)
+      expect(isSensitiveKey('sessionToken')).toBe(true)
+      expect(isSensitiveKey('webIdentityToken')).toBe(true)
+      expect(isSensitiveKey('verificationToken')).toBe(true)
+      expect(isSensitiveKey('githubToken')).toBe(true)
     })
 
     it.concurrent('should match secret variations', () => {
@@ -110,6 +114,22 @@ describe('isSensitiveKey', () => {
   })
 
   describe('non-sensitive keys (no false positives)', () => {
+    it.concurrent('should preserve workflow-state tokens that do not grant access', () => {
+      expect(isSensitiveKey('syncToken')).toBe(false)
+      expect(isSensitiveKey('SyncToken')).toBe(false)
+      expect(isSensitiveKey('nextSyncToken')).toBe(false)
+      expect(isSensitiveKey('pageToken')).toBe(false)
+      expect(isSensitiveKey('nextPageToken')).toBe(false)
+      expect(isSensitiveKey('scroll_token')).toBe(false)
+      expect(isSensitiveKey('continuationToken')).toBe(false)
+      expect(isSensitiveKey('nextContinuationToken')).toBe(false)
+      expect(isSensitiveKey('cursorToken')).toBe(false)
+      expect(isSensitiveKey('nextToken')).toBe(false)
+      expect(isSensitiveKey('clientRequestToken')).toBe(false)
+      expect(isSensitiveKey('idempotencyToken')).toBe(false)
+      expect(isSensitiveKey('subjectFromWebIdentityToken')).toBe(false)
+    })
+
     it.concurrent('should not match keys with sensitive words as prefix only', () => {
       expect(isSensitiveKey('tokenCount')).toBe(false)
       expect(isSensitiveKey('tokenizer')).toBe(false)
@@ -230,6 +250,32 @@ describe('redactApiKeys', () => {
       expect(result.config.normalField).toBe('normal-value')
     })
 
+    it.concurrent('should preserve non-secret token fields while redacting credentials', () => {
+      const result = redactApiKeys({
+        syncToken: '3',
+        nextPageToken: 'page-2',
+        nextToken: 'next-page',
+        continuationToken: 'continue-page',
+        clientRequestToken: 'idempotency-key',
+        record: { Id: '42', SyncToken: '3' },
+        accessToken: 'access-secret',
+        sessionToken: 'session-secret',
+        verificationToken: 'verification-secret',
+      })
+
+      expect(result).toEqual({
+        syncToken: '3',
+        nextPageToken: 'page-2',
+        nextToken: 'next-page',
+        continuationToken: 'continue-page',
+        clientRequestToken: 'idempotency-key',
+        record: { Id: '42', SyncToken: '3' },
+        accessToken: REDACTED_MARKER,
+        sessionToken: REDACTED_MARKER,
+        verificationToken: REDACTED_MARKER,
+      })
+    })
+
     it.concurrent('should redact sensitive keys in arrays', () => {
       const arr = [{ apiKey: 'secret-key-1' }, { apiKey: 'secret-key-2' }]
 

apps/sim/lib/core/security/redaction.ts

@@ -7,7 +7,19 @@ import { filterUserFileForDisplay, isUserFile } from '@/lib/core/utils/user-file
 export const REDACTED_MARKER = '[REDACTED]'
 export const TRUNCATED_MARKER = '[TRUNCATED]'
 
-const BYPASS_REDACTION_KEYS = new Set(['nextPageToken'])
+/**
+ * Token-named fields that carry workflow state rather than authorization.
+ *
+ * Keep this allowlist semantic and narrow: unknown `*token` fields remain
+ * redacted by default, while pagination cursors, synchronization versions, and
+ * idempotency keys stay visible so users can pass them into subsequent steps.
+ */
+const NON_SENSITIVE_TOKEN_KEY_PATTERNS: RegExp[] = [
+  /(?:page|pagination|continuation|cursor|scroll|sync)[_-]?token$/i,
+  /^(?:next|previous|after|before)[_-]?token$/i,
+  /^(?:client[_-]?request|idempotency)[_-]?token$/i,
+  /^subjectFromWebIdentityToken$/i,
+]
 
 /** Keys that contain large binary/encoded data that should be truncated in logs */
 const LARGE_DATA_KEYS = new Set(['base64'])
@@ -74,7 +86,7 @@ const SENSITIVE_VALUE_PATTERNS: Array<{
 ]
 
 export function isSensitiveKey(key: string): boolean {
-  if (BYPASS_REDACTION_KEYS.has(key)) {
+  if (NON_SENSITIVE_TOKEN_KEY_PATTERNS.some((pattern) => pattern.test(key))) {
     return false
   }
   const lowerKey = key.toLowerCase()