fix(api): keep error URLs readable and mask host paths in dashboard logs

tests/core/test_debug_logging.py

@@ -16,7 +16,14 @@ from unshackle.core.utilities import (
     log_event,
     timed_operation,
 )
-from unshackle.core.utils.redact import redact_all, redact_path, redact_text, redact_url, safe_display_url
+from unshackle.core.utils.redact import (
+    redact_all,
+    redact_path,
+    redact_secrets,
+    redact_text,
+    redact_url,
+    safe_display_url,
+)
 from unshackle.core.utils.subprocess import log_tool_run
 
 pytestmark = pytest.mark.unit
@@ -266,6 +273,15 @@ def test_redact_all_composes_secrets_urls_and_paths():
     assert "<unshackle>/temp" in out
 
 
+def test_redact_secrets_keeps_the_url_but_drops_credentials_and_paths():
+    root = str(Path(__import__("unshackle.core.utils.redact", fromlist=["x"]).__file__).resolve().parents[3])
+    out = redact_secrets(f"404 Not Found: https://u:p@cdn.x/a/b.mpd?token=t (cwd {root}/temp)")
+    assert "cdn.x/a/b.mpd" in out
+    assert "u:p@" not in out
+    assert "token=t" not in out
+    assert "<unshackle>/temp" in out
+
+
 def test_logged_output_dir_is_path_redacted(debug_log: Path):
     root = str(Path(__import__("unshackle.core.utils.redact", fromlist=["x"]).__file__).resolve().parents[3])
     log_event("downloader_start", context={"output_dir": f"{root}/temp", "filename": "Audio_3eeab4ed.mp4"})

tests/remote/unit/test_dashboard.py

@@ -69,6 +69,28 @@ def test_ring_since_and_level() -> None:
     assert ring.seq == 5
     assert [r["msg"] for r in ring.since(3)] == ["m3", "m4"]
     assert [r["msg"] for r in ring.since(0, "warning")] == ["m3"]
+
+
+def test_ring_masks_host_paths_and_secrets_in_records() -> None:
+    """The ring feeds both /api/logs and the SSE stream, so it must mask on the way in."""
+    from pathlib import Path
+
+    import unshackle.core.utils.redact as redact_mod
+
+    root = str(Path(redact_mod.__file__).resolve().parents[3])
+    ring = RingLogHandler(maxlen=3)
+    ring.setFormatter(logging.Formatter("%(message)s"))
+    logger = logging.getLogger("test.ring.redact")
+    logger.setLevel(logging.INFO)
+    logger.addHandler(ring)
+    logger.error(f'File "{root}/unshackle/services/HMAX/__init__.py" 404: https://api.x/y?token=abc')
+    logger.removeHandler(ring)
+
+    msg = ring.records[-1]["msg"]
+    assert root not in msg
+    assert "<unshackle>/unshackle/services/HMAX" in msg
+    assert "token=abc" not in msg
+    assert "https://api.x/y" in msg
     assert ring.since(0, logger="test") and not ring.since(0, logger="other")