fix(web-api): redact response body in debug logs

[srtaalej]

Summary

• Apply redact() to API response bodies before debug logging, consistent with how request bodies and headers are already handled
• Widen redact() parameter type from Record<string, unknown> to object so it accepts WebAPICallResult without casting
• Prevents tokens returned in API responses (e.g., oauth.v2.access, openid.connect.token, tooling.tokens.rotate) from being written to logs in plaintext when debug logging is enabled

Test plan

• npm run build --workspace=packages/web-api passes
• npm test --workspace=packages/web-api — all 155 tests pass
• Verify manually: enable LogLevel.DEBUG, call oauth.v2.access, confirm access_token shows as [[REDACTED]] in output

Fixes #2651

[changeset-bot]

🦋 Changeset detected

Latest commit: 4fc31ac

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@slack/web-api	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.04%. Comparing base (2b6a0ce) to head (4fc31ac).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2652      +/-   ##
==========================================
- Coverage   89.06%   89.04%   -0.02%     
==========================================
  Files          65       65              
  Lines       10436    10436              
  Branches      471      468       -3     
==========================================
- Hits         9295     9293       -2     
  Misses       1120     1120              
- Partials       21       23       +2     

Flag	Coverage Δ
cli-hooks	89.04% <100.00%> (-0.02%)	⬇️
cli-test	89.04% <100.00%> (-0.02%)	⬇️
logger	89.04% <100.00%> (-0.02%)	⬇️
oauth	89.04% <100.00%> (-0.02%)	⬇️
socket-mode	89.04% <100.00%> (-0.02%)	⬇️
web-api	89.04% <100.00%> (-0.02%)	⬇️
webhook	89.04% <100.00%> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[WilliamBergamin]

This is a solid change 💯

I think we might want to gate the redaction logic behind a try catch so that it does not raise an error if it fails and rather logs the problem 🤔 let me know what you think of this

If we could add some tests for this it would be nice

[srtaalej]

thank you for reviewing @WilliamBergamin! i agree with these changes except that the existing debug lines on 702 and 721 don't include these guards. should we add them there too to stay consistent?

[WilliamBergamin]

Ohh actually by bad, the object we pass to redact was already processed by buildResult it isn't the raw response 😅
I don't think this guard is needed after all

What do you think about just adding a unit test to make sure the redaction works 🙏

[srtaalej]

added unit test and left redact changes as is! can i get a quick approve @WilliamBergamin?

[WilliamBergamin]

Looking good 💯 left one suggestion for the test 🙏

[WilliamBergamin]

Nice fix 💯