fix(langchain): handle secret str api keys

[albertjan]

Currently the anthropic chain implementation in langchain uses a pydantic SecretStr as an api key this is causing errors in our pipeline when ddtrace tries to format the api key.

With this PR: langchain-ai/langchain#12542 the OpenAI implementation will also start using a SecretStr. I'm sure at that point there will be a few more people asking why things are broken.

I'm struggling setting up and running the tests, riot doesn't print anything. And I have no experience with the cassettes testing methods. Can someone help with this? I think if we add a test that uses the Anthropic LLM we will see the failure before. And this will fix it.

I've updated the type comment to the function, but the env doesn't know about Pydantic so I don't know if this is a valid thing to do.

Checklist

• Change(s) are motivated and described in the PR description.
• Testing strategy is described if automated tests are not included in the PR.
• Risk is outlined (performance impact, potential for breakage, maintainability, etc).
• Change is maintainable (easy to change, telemetry, documentation).
• Library release note guidelines are followed. If no release note is required, add label changelog/no-changelog.
• Documentation is included (in-code, generated user docs, public corp docs).
• Backport labels are set (if applicable)

Reviewer Checklist

• Title is accurate.
• No unnecessary changes are introduced.
• Description motivates each change.
• Avoids breaking API changes unless absolutely necessary.
• Testing strategy adequately addresses listed risk(s).
• Change is maintainable (easy to change, telemetry, documentation).
• Release note makes sense to a user of the library.
• Reviewer has explicitly acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment.
• Backport labels are set in a manner that is consistent with the release branch maintenance policy
• If this PR touches code that signs or publishes builds or packages, or handles credentials of any kind, I've requested a review from @DataDog/security-design-and-guidance.
• This PR doesn't touch any of that.

[Yun-Kim]

Hi @albertjan, thanks for your contribution! I can take over testing and formatting and getting this merged.

[Yun-Kim]

The existing test cases should be sufficient since we continue to test latest versions of langchain - we'll be receiving SecretStr api keys (already are for AI21) once langchain continues to make these api key changes. Thanks again @albertjan for your contribution!

[albertjan]

You're welcome @Yun-Kim ☺️.

The existing test cases should be sufficient since we continue to test latest versions of langchain

A test using the ChatAnthropic would already exercise the SecretStr bit of the _format_api_key function. But yeah the tests will eventually exercise it. 👍

[majorgreys]

Do the existing tests cover the fixed case? I don't see any change to a span tag check.

[ZStriker19]

Agreeing with Tahir, can we add a test for span.set_tag_str(API_KEY, _format_api_key(api_key)) # override api_key for Pinecone to verify the tag is changed as we expect?

[Yun-Kim]

@majorgreys @ZStriker19 the existing test cases cover this fixed case - langchain is in the process of switching over to use SecretStr api keys and already has been using SecretStr keys for the AI21 provider, which we already have a test case for.

can we add a test for span.set_tag_str(API_KEY, _format_api_key(api_key)) # override api_key for Pinecone to verify the tag is changed as we expect?

That change is just a refactor, no functionality change as we're not getting that information through langchain.

[albertjan]

Thanks all! 😄