log_redaction

Logging filter that redacts API keys in log output.

Attaches to the root logger so all loggers (including httpx/httpcore) have keys partially censored: first 4 chars + ... + last 4 chars.

log_redaction.redact_api_keys(text)[source]

Replace API key values in text with a partially-masked form.

Scans the input for key=<secret> patterns via _KEY_RE and rewrites each one through _redact_match() so the secret survives in logs only as its first four and last four characters joined by an ellipsis. This keeps log lines correlatable without ever exposing a full credential. Pure string transformation with no I/O or side effects.

Called by ApiKeyRedactionFilter.filter() for every log record routed through the handler the filter is attached to, and exercised directly by tests/core/test_enhanced_logging.py.

Parameters:: text (str) – The fully-formatted log message that may embed one or more key= secrets.
Returns:: The same text with every matched key value partially masked; the original string is returned unchanged when no key pattern is present.
Return type:: str

class log_redaction.ApiKeyRedactionFilter(name='')[source]

Bases: Filter

Logging filter that censors API keys before they reach the handler.

A logging.Filter subclass that sanitizes rather than suppresses: every record passing through is allowed onward, but any embedded key= secret is partially masked first via redact_api_keys(). Installing it on the root/console handler means downstream-library noise (httpx, httpcore) is scrubbed alongside the bot’s own log lines.

Instantiated and attached to a handler by core/log_config.py (which calls addFilter on the console handler), and asserted to be present by tests/core/test_enhanced_logging.py. The actual per-record work lives in filter().

filter(record)[source]

Redact API keys in a log record in place before it is emitted.

Implements the logging.Filter contract. Renders the record’s fully-formatted message via record.getMessage() (which interpolates record.args), passes it through redact_api_keys(), and — only when redaction actually changed the text — overwrites record.msg with the censored string and clears record.args to None so the handler does not attempt a second %-format pass against the already-substituted message. The record is always allowed through (returns True); this filter sanitizes rather than suppresses.

Registered on a handler (typically the root/console handler) by core/log_config.py, which constructs an ApiKeyRedactionFilter and calls ch.addFilter(...); the standard logging machinery invokes this method for every record routed through that handler. It is also asserted to be present by tests/core/test_enhanced_logging.py.

Parameters:: record (LogRecord) – The log record about to be handled; record.msg and record.args may be mutated in place when a key is found.
Returns:: Always True so the (possibly redacted) record continues to the handler.
Return type:: bool