feat(tracing): enrich tracing records with HTTP headers + secure cURL copy in devtools

[danh91]

Summary

Carrier API tracing records now capture full HTTP request and response headers. Sensitive values are redacted before storage. The devtools Copy as cURL button now generates a complete, reproducible command with all -H flags.

---

Problem

Karrio's tracing system logged carrier API request/response bodies but discarded HTTP headers entirely, creating debugging blind spots:

• Carrier auth failures — could not tell if Authorization was missing or malformed
• Rate limit diagnosis — X-RateLimit-Remaining, Retry-After headers were lost
• cURL copy was incomplete — only hardcoded Content-Type, never the actual auth headers

---

Changes

modules/sdk/karrio/core/utils/redaction.py (new)

Centralised redaction utility:

• redact_headers() — redacts Authorization (keeps scheme: Bearer val_xxx), X-Api-Key, X-Client-Secret, Cookie, and any header containing secret/password/credential/token
• redact_query_params() — redacts client_secret, password, api_key, access_token etc. in both dict and URL-encoded string form

modules/sdk/karrio/core/tests/test_redaction.py (new)

21 unit tests covering all redaction rules, edge cases, and type safety — all passing ✅

modules/sdk/karrio/core/utils/helpers.py

• process_request: adds request_headers (redacted) to the "request" trace payload
• process_response: captures dict(response.headers), redacts, adds response_headers to "response" trace payload
• process_error: captures dict(error.headers), redacts, adds response_headers to "error" trace payload

No migration required — headers stored inside the existing TracingRecord.record JSONField.

modules/graph/karrio/server/graph/schemas/base/types.py

Adds two new fields to TracingRecordType (resolved from record JSONField, no model change):

• request_headers — headers sent to carrier API
• response_headers — headers received from carrier API
• Returns null for older records (backward compatible)

packages/developers/components/views/logs-view.tsx

packages/developers/components/views/tracing-records-view.tsx

• New headersToCurlFlags() helper converts headers dict → -H 'Name: Value' flags
• generateTracingCurlCommand: uses record.request_headers when present, falls back to Content-Type only for older records
• generateLogCurlCommand: uses log.headers/log.request_headers when present
• Safe escapeSingleQuotes() for embedding values in single-quoted curl args

---

Example: cURL before vs after

Before:

curl -X POST \
  'https://apis.fedex.com/rate/v1/rates/quotes' \
  -H 'Content-Type: application/json' \
  -d '{...}'

After:

curl -X POST \
  'https://apis.fedex.com/rate/v1/rates/quotes' \
  -H 'Authorization: Bearer val_xxx' \
  -H 'X-locale: en_US' \
  -H 'Content-Type: application/json' \
  -H 'X-customer-transaction-id: req-abc123' \
  -d '{...}'

---

PRD

See PRDs/TRACING_HTTP_HEADERS_ENRICHMENT.md

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
karrio-web	Ready	Preview, Comment	Mar 2, 2026 7:38pm