fix(rpc): redact validator private keys from call receipts and explorer payloads

[kriss39]

What

Receipt.node_config always carries the executing validator's private_key (Node._create_enhanced_node_config). #1731 added _sanitize_rpc_private_keys to the transaction/block getters, but three other paths still hand the raw receipt to the client:

• sim_call (and therefore sim_estimateTransactionFees) returns receipt.to_dict() unredacted;
• gen_call, eth_call and sim_call raise execution failed with data.receipt = receipt.to_dict() unredacted whenever contract execution fails;
• the explorer REST API (/explorer/transactions*, /explorer/address/{addr}) serializes consensus_data / consensus_history verbatim, including leader_receipt[*].node_config.private_key and validators[*].node_config.private_key.

This PR:

• moves the helpers to a small backend/protocol_rpc/redaction.py (so the explorer can use them without importing endpoints), keeping the endpoints._sanitize_rpc_private_keys name for the existing call sites;
• applies the redaction to the sim_call result, the three execution failed error payloads and _serialize_tx;
• adds tests/unit/protocol_rpc/test_receipt_private_key_redaction.py: sim_call result, gen_call / eth_call error data, and explorer _serialize_tx (redacted by default, shown with SHOW_VALIDATOR_PRIVATE_KEYS_IN_RPC=true, matching the fix: redact validator private keys from RPC #1731 tests).

Why

On a hosted Studio anyone can issue an anonymous sim_call against a registered validator, make any gen_call fail, or GET /explorer/transactions?limit=100, and read the validators' signing keys. SHOW_VALIDATOR_PRIVATE_KEYS_IN_RPC keeps working as the local-debug escape hatch.

Testing done

• PYTHONPATH=. pytest tests/unit --ignore=tests/unit/test_rpc_endpoint_manager.py → 1569 passed, 7 skipped.
• The four new negative tests fail on v0.123-dev without the backend change (the sim_call result and the error payloads contain the key; explorer node_config keeps private_key) and pass with it.
• black / ruff clean on the touched files.

Decisions made

• Redaction is applied at the response boundary only; the receipt object used internally (e.g. by sim_estimateTransactionFees for fee accounting) is unchanged.
• No issue was created first (small, self-contained fix; CONTRIBUTING §3.1).

Checks

• I have tested this code
• I have reviewed my own PR
• I have created an issue for this PR
• I have set a descriptive PR title compliant with conventional commits

Reviewing tips

The diff in endpoints.py is mostly the moved helper definitions; the behavioural change is the three _sanitize_rpc_private_keys(receipt.to_dict()) wraps plus the two lines in explorer/queries.py.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 2b3604fb-d9be-4928-a351-45224f646e74

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}