fix(pyth-lazer-agent) Stop logging the access_token (#2882)

Cargo.lock

@@ -5611,7 +5611,7 @@ dependencies = [
 
 [[package]]
 name = "pyth-lazer-agent"
-version = "0.3.1"
+version = "0.3.2"
 dependencies = [
  "anyhow",
  "backoff",

apps/pyth-lazer-agent/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "pyth-lazer-agent"
-version = "0.3.1"
+version = "0.3.2"
 edition = "2024"
 
 [dependencies]

apps/pyth-lazer-agent/src/config.rs

@@ -1,10 +1,11 @@
-use std::net::SocketAddr;
-use std::path::PathBuf;
-use std::time::Duration;
-
 use config::{Environment, File};
 use derivative::Derivative;
 use serde::Deserialize;
+use std::cmp::min;
+use std::fmt::{Debug, Formatter};
+use std::net::SocketAddr;
+use std::path::PathBuf;
+use std::time::Duration;
 use url::Url;
 
 #[derive(Deserialize, Derivative, Clone, PartialEq)]
@@ -12,7 +13,7 @@ use url::Url;
 pub struct Config {
     pub listen_address: SocketAddr,
     pub relayer_urls: Vec<Url>,
-    pub authorization_token: Option<String>,
+    pub authorization_token: Option<AuthorizationToken>,
     #[derivative(Debug = "ignore")]
     pub publish_keypair_path: PathBuf,
     #[serde(with = "humantime_serde", default = "default_publish_interval")]
@@ -20,6 +21,18 @@ pub struct Config {
     pub history_service_url: Option<Url>,
 }
 
+#[derive(Deserialize, Derivative, Clone, PartialEq)]
+pub struct AuthorizationToken(pub String);
+
+impl Debug for AuthorizationToken {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        let token_string = self.0.to_ascii_lowercase();
+        #[allow(clippy::string_slice, reason = "false positive")]
+        let last_chars = &token_string[token_string.len() - min(4, token_string.len())..];
+        write!(f, "\"...{last_chars}\"")
+    }
+}
+
 fn default_publish_interval() -> Duration {
     Duration::from_micros(500)
 }

apps/pyth-lazer-agent/src/lazer_publisher.rs

@@ -62,7 +62,7 @@ impl LazerPublisher {
         let authorization_token =
             if let Some(authorization_token) = config.authorization_token.clone() {
                 // If authorization_token is configured, use it.
-                authorization_token
+                authorization_token.0
             } else {
                 // Otherwise, use the base64 pubkey.
                 BASE64_STANDARD.encode(signing_key.verifying_key().to_bytes())