PYTHON-5928 Redact AWS session token from client repr

[NguyenCong2k]

[PYTHON-5928]

AWS session tokens passed via authMechanismProperties (e.g. AWS_SESSION_TOKEN) were rendered in plain text inside MongoClient.__repr__, leaking short-lived AWS credentials into logs and error messages. The existing username/password redaction did not cover auth mechanism properties.

This PR also hardens the cached OIDC authenticator path so the ALLOWED_HOSTS validation runs before a cached *_oidc authenticator is returned, not only when a new authenticator is built.

Changes in this PR

• Add shared helper pymongo.common.redact_auth_mechanism_properties_for_repr that redacts any auth mechanism property whose upper-cased name is not in a safe allowlist (ALLOWED_HOSTS, CANONICALIZE_HOST_NAME, ENVIRONMENT, SERVICE_HOST, SERVICE_NAME, SERVICE_REALM, TOKEN_RESOURCE).
• Call the helper from the repr path in both pymongo/synchronous/mongo_client.py and pymongo/asynchronous/mongo_client.py.
• Move the OIDC ALLOWED_HOSTS check in _get_authenticator ahead of the cached-authenticator early return, so a disallowed host is rejected even when a cached authenticator exists.
• Add regression tests covering:
  • AWS_SESSION_TOKEN supplied via the connection URI
  • aws_session_token, custom CUSTOM_API_KEY, and safe TOKEN_RESOURCE supplied via authMechanismProperties kwargs
  • sync (MongoClient) and async (AsyncMongoClient) variants

The allowlist approach (rather than a single-key denylist) addresses the Copilot review comment that other token-like values (GSSAPI/PLAIN PASSWORD, custom OIDC properties) could otherwise leak.

Test Plan

All tests pass on the supported Python versions for the driver:

python -m pytest test/test_client.py::ClientUnitTest::test_repr_redacts_aws_session_token ^
                 test/test_client.py::ClientUnitTest::test_repr_redacts_secret_auth_mechanism_properties ^
                 test/asynchronous/test_client.py::AsyncClientUnitTest::test_repr_redacts_aws_session_token ^
                 test/asynchronous/test_client.py::AsyncClientUnitTest::test_repr_redacts_secret_auth_mechanism_properties -q

python -m pytest test/test_auth_oidc.py -q

Manual verification (before/after):

from pymongo import MongoClient
client = MongoClient(
    "mongodb://AKIA:SECRET@localhost:27017/"
    "?authMechanism=MONGODB-AWS"
    "&authMechanismProperties=AWS_SESSION_TOKEN:SECRET-TOKEN",
    connect=False,
)
print(repr(client))  # before: token visible; after: 'AWS_SESSION_TOKEN': '<redacted>'

Checklist for Author

• Is there test coverage? (sync + async regression tests)
• Did you update the changelog (if necessary)? (no changelog update yet; happy to add once a maintainer confirms the preferred file)
• Is any followup work tracked in a JIRA ticket? PYTHON-5928

Checklist for Reviewer

• Does the title of the PR reference a JIRA Ticket?
• Do you fully understand the implementation?
• Is all relevant documentation (README or docstring) updated?

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR addresses two security/privacy concerns: redacting the AWS session token in MongoClient __repr__ output, and ensuring the OIDC ALLOWED_HOSTS check is performed before reusing a cached authenticator.

Changes:

• Redact AWS_SESSION_TOKEN in authMechanismProperties when generating client __repr__.
• Move the OIDC ALLOWED_HOSTS validation in _get_authenticator to run before returning a cached authenticator.
• Add corresponding tests in both sync and async test suites.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
pymongo/synchronous/mongo_client.py	Adds redaction helper for AWS session token in _repr_helper.
pymongo/asynchronous/mongo_client.py	Mirrors the sync redaction logic for async client.
pymongo/synchronous/auth_oidc.py	Reorders allowed-hosts check to occur before cache reuse.
pymongo/asynchronous/auth_oidc.py	Mirrors the sync OIDC change for the async path.
test/test_client.py	Adds test for AWS session token redaction in repr.
test/asynchronous/test_client.py	Async counterpart for repr redaction test.
test/test_auth_oidc.py	Tests allowed-hosts check happens before cache reuse.
test/asynchronous/test_auth_oidc.py	Async counterpart for allowed-hosts cache test.

[codeowners-service-app]

Assigned aclark4life for team dbx-python because caseyclements is out of office.

[Jibola]

Hi, thanks for your contribution. Please update your pull request to be in line with out pull request template guidelines.

[NguyenCong2k]

Hi @Jibola, I've updated the PR description per the template. Ready for another look when you have a chance.