fix: redact auth headers case-insensitively (+ Proxy-Authorization)

HTTP header names are case-insensitive and HashWithIndifferentAccess does not
normalize case, so a consumer-set 'authorization' (non-canonical case) leaked
through Error#to_h. Match Authorization/Proxy-Authorization case-insensitively.

HELDENPMI-132

Author: mitnal

lib/nxt_http_client/error.rb

@@ -6,6 +6,7 @@ class Error < StandardError
     ].freeze
 
     REDACTED = '[REDACTED]'
+    SENSITIVE_HEADERS = %w[Authorization Proxy-Authorization].freeze
 
     def self.from_response(response, message = nil)
       error_class_for(response).new(response, message)
@@ -132,9 +133,13 @@ def redact_credentials(options)
     end
 
     def redact_authorization(headers)
-      return headers unless headers.respond_to?(:key?) && headers.key?('Authorization')
+      return headers unless headers.respond_to?(:keys)
 
-      headers.merge('Authorization' => REDACTED)
+      # HTTP header names are case-insensitive, and HashWithIndifferentAccess does not normalize case.
+      sensitive = headers.keys.select { |key| SENSITIVE_HEADERS.any? { |name| key.to_s.casecmp?(name) } }
+      return headers if sensitive.empty?
+
+      headers.merge(sensitive.index_with { REDACTED })
     end
 
     public

spec/error_spec.rb

@@ -163,6 +163,12 @@ def to_h_for(&setup)
 
       expect(hash[:request_options]['userpwd']).to eq('[REDACTED]')
     end
+
+    it 'redacts a non-canonically-cased authorization header' do
+      hash = to_h_for { |config| config.request_options = { headers: { 'authorization' => 'Bearer secret' } } }
+
+      expect(hash[:request_headers]['authorization']).to eq('[REDACTED]')
+    end
   end
 
   describe '.from_response' do