fix: match body redaction keys case-insensitively

Make redact_body match sensitive keys like "password" regardless of
casing (e.g. "Password", "PASSWORD") to match how redact_headers
already works for header names.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: deviantintegral

src/flameconnect/_http_logging.py

@@ -39,9 +39,17 @@ def redact_headers(headers: Mapping[str, str]) -> dict[str, str]:
     return result
 
 
+_SENSITIVE_BODY_KEYS: frozenset[str] = frozenset({"password"})
+
+
 def redact_body(data: Mapping[str, Any]) -> dict[str, Any]:
-    """Return a copy of *data* with the ``password`` key redacted to ``"***"``."""
-    return {k: ("***" if k == "password" else v) for k, v in data.items()}
+    """Return a copy of *data* with sensitive keys redacted to ``"***"``.
+
+    Keys are matched case-insensitively against :data:`_SENSITIVE_BODY_KEYS`.
+    """
+    return {
+        k: ("***" if k.lower() in _SENSITIVE_BODY_KEYS else v) for k, v in data.items()
+    }
 
 
 def log_request(

tests/test_http_logging.py

@@ -74,6 +74,11 @@ def test_password_redacted(self) -> None:
             "user": "bob",
         }
 
+    def test_password_case_insensitive(self) -> None:
+        for key in ("Password", "PASSWORD", "password"):
+            result = redact_body({key: "s3cret"})
+            assert result[key] == "***"
+
     def test_other_keys_unchanged(self) -> None:
         assert redact_body({"email": "a@b.com"}) == {"email": "a@b.com"}