fix(phase-1): redact API key query params from log output and add mutex thread-safety to providers map

internal/server/providers_admin.go

@@ -82,7 +82,7 @@ func (s *Server) handleGetProviders(c *gin.Context) {
 
 		status := "disabled"
 		if enabled {
-			if _, ok := s.providers[id]; ok {
+			if _, ok := s.getProvider(id); ok {
 				status = "online"
 			} else {
 				status = "error"
@@ -203,7 +203,7 @@ func (s *Server) handleUpdateProvider(c *gin.Context) {
 
 func (s *Server) handleTestProvider(c *gin.Context) {
 	name := c.Param("name")
-	provider, ok := s.providers[name]
+	provider, ok := s.getProvider(name)
 	if !ok {
 		c.JSON(http.StatusNotFound, ErrorResponse(fmt.Sprintf("Provider %s not found or not enabled", name)))
 		return

internal/server/server.go

@@ -24,15 +24,16 @@ import (
 )
 
 type Server struct {
-	router     *gin.Engine
-	cfg        *config.Config
-	database   *db.DB
-	providers  map[string]providers.Provider
-	sessions   *SessionManager
-	hub        *Hub
-	logger     *RequestLogger
-	registry   *models.ModelRegistry
-	registryMu sync.RWMutex
+	router      *gin.Engine
+	cfg         *config.Config
+	database    *db.DB
+	providers   map[string]providers.Provider
+	providersMu sync.RWMutex
+	sessions    *SessionManager
+	hub         *Hub
+	logger      *RequestLogger
+	registry    *models.ModelRegistry
+	registryMu  sync.RWMutex
 	modelRouter *router.Router
 }
 
@@ -88,6 +89,8 @@ func (s *Server) RefreshProviders() error {
 		dbMap[cfg.ID] = cfg
 	}
 
+	newProviders := make(map[string]providers.Provider)
+
 	providerIDs := []string{"openai", "gemini", "deepseek", "moonshot", "grok", "ollama", "xiaomi"}
 	for _, id := range providerIDs {
 		// Default values from config
@@ -143,7 +146,6 @@ func (s *Server) RefreshProviders() error {
 		}
 
 		if !enabled {
-			delete(s.providers, id)
 			continue
 		}
 
@@ -181,10 +183,14 @@ func (s *Server) RefreshProviders() error {
 		}
 
 		if p != nil {
-			s.providers[id] = providers.NewCircuitBreakerProvider(p)
+			newProviders[id] = providers.NewCircuitBreakerProvider(p)
 		}
 	}
 
+	s.providersMu.Lock()
+	s.providers = newProviders
+	s.providersMu.Unlock()
+
 	s.refreshRouter()
 	return nil
 }
@@ -368,7 +374,7 @@ func (s *Server) handleResponses(c *gin.Context) {
 		providerName = "ollama"
 	}
 
-	provider, ok := s.providers[providerName]
+	provider, ok := s.getProvider(providerName)
 	if !ok {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": fmt.Sprintf("Provider %s not enabled or supported", providerName)})
 		return
@@ -520,6 +526,13 @@ func (s *Server) handleListModels(c *gin.Context) {
 	})
 }
 
+func (s *Server) getProvider(name string) (providers.Provider, bool) {
+	s.providersMu.RLock()
+	defer s.providersMu.RUnlock()
+	p, ok := s.providers[name]
+	return p, ok
+}
+
 func (s *Server) selectProvider(modelID string) (providers.Provider, string, error) {
 	providerName := "openai" // default
 	modelLower := strings.ToLower(modelID)
@@ -546,7 +559,7 @@ func (s *Server) selectProvider(modelID string) (providers.Provider, string, err
 		providerName = "xiaomi"
 	}
 
-	p, ok := s.providers[providerName]
+	p, ok := s.getProvider(providerName)
 	if !ok {
 		return nil, "", fmt.Errorf("Provider %s not enabled or supported", providerName)
 	}