[PR #139] [MERGED] [debug-log] Keep query keys in logged URLs, mask only the values #142

New issue

Closed

opened 2026-10-13 19:47:55 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 19:47:55 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Glitchy-Sheep/boosty-downloader/pull/139
Author: @Glitchy-Sheep
Created: 8/13/2026
Status: ✅ Merged
Merged: 8/13/2026
Merged by: @Glitchy-Sheep

Base: main ← Head: feat/redact-keep-query-keys

📝 Commits (1)

1cef854 feat: Keep query keys in debug log URLs, mask only their values

📊 Changes

3 files changed (+17 additions, -8 deletions)

View changed files

📝 CHANGELOG.md (+4 -0)
📝 boosty_downloader/src/infrastructure/loggers/request_tracing.py (+10 -5)
📝 test/unit/loggers/request_tracing_test.py (+3 -3)

📄 Description

Summary

The debug log used to cut the whole query string off every logged URL. Now it keeps the keys and masks only the values: ?sig=...&expire=... instead of nothing. The log stays safe to attach to public issues, but a failing request can finally be matched to a concrete endpoint call shape.

Problem

redacted_url dropped everything after the path, so two different requests to the same path looked identical in the log
For paginated API calls (?offset=...&limit=...) the query keys are the only thing that tells one page request from another
The keys themselves carry no secrets - only the values do (signatures, expiry timestamps)

Fix

redacted_url now parses the query and rewrites every pair as key=..., preserving key order and duplicates
URLs without a query are returned unchanged, same as before

Before / After

Before: GET https://api.boosty.to/v1/blog/boosty/post/
After: GET https://api.boosty.to/v1/blog/boosty/post/?offset=...&limit=...

Verification

Live run: --debug check --username boosty - the log shows ?limit=... and ?offset=...&limit=... lines, no values anywhere
Updated unit test asserts a signed CDN link keeps sig and expire keys but not the SECRET value; the plain-URL test still passes
task check green (ruff, format, pyright), all 73 unit tests pass

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Glitchy-Sheep/boosty-downloader/pull/139 **Author:** [@Glitchy-Sheep](https://github.com/Glitchy-Sheep) **Created:** 8/13/2026 **Status:** ✅ Merged **Merged:** 8/13/2026 **Merged by:** [@Glitchy-Sheep](https://github.com/Glitchy-Sheep) **Base:** `main` ← **Head:** `feat/redact-keep-query-keys` --- ### 📝 Commits (1) - [`1cef854`](https://github.com/Glitchy-Sheep/boosty-downloader/commit/1cef85487d09aa7db1e9e7ffe2b70abe18145c44) feat: Keep query keys in debug log URLs, mask only their values ### 📊 Changes **3 files changed** (+17 additions, -8 deletions) <details> <summary>View changed files</summary> 📝 `CHANGELOG.md` (+4 -0) 📝 `boosty_downloader/src/infrastructure/loggers/request_tracing.py` (+10 -5) 📝 `test/unit/loggers/request_tracing_test.py` (+3 -3) </details> ### 📄 Description ## Summary The debug log used to cut the whole query string off every logged URL. Now it keeps the keys and masks only the values: `?sig=...&expire=...` instead of nothing. The log stays safe to attach to public issues, but a failing request can finally be matched to a concrete endpoint call shape. ## Problem - `redacted_url` dropped everything after the path, so two different requests to the same path looked identical in the log - For paginated API calls (`?offset=...&limit=...`) the query keys are the only thing that tells one page request from another - The keys themselves carry no secrets - only the values do (signatures, expiry timestamps) ## Fix - `redacted_url` now parses the query and rewrites every pair as `key=...`, preserving key order and duplicates - URLs without a query are returned unchanged, same as before ## Before / After **Before:** `GET https://api.boosty.to/v1/blog/boosty/post/` **After:** `GET https://api.boosty.to/v1/blog/boosty/post/?offset=...&limit=...` ## Verification - Live run: `--debug check --username boosty` - the log shows `?limit=...` and `?offset=...&limit=...` lines, no values anywhere - Updated unit test asserts a signed CDN link keeps `sig` and `expire` keys but not the `SECRET` value; the plain-URL test still passes - `task check` green (ruff, format, pyright), all 73 unit tests pass --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-13 19:47:55 +00:00