fix: redact sensitive data from debug logs

Reclassify the self-healing full-login path as debug and install scoped log redaction for aiounifi and integration debug output. Redact structured auth data, JSON websocket payloads, URLs, IPs, MACs, entity IDs, and raw response bodies before log formatting.

Bump the manifest version to 4.4.4.

Author: sirkirby

custom_components/unifi_network_rules/__init__.py

@@ -30,12 +30,15 @@
 
 # Import the modular API implementation
 from .udm.api import UDMAPI
+from .utils.logger import install_aiounifi_log_redaction
 
 CONFIG_SCHEMA = cv.config_entry_only_config_schema(DOMAIN)
 
 
 async def async_setup(hass: HomeAssistant, config: dict) -> bool:
     """Set up UniFi Network Rules component."""
+    install_aiounifi_log_redaction()
+
     # Initialize domain data if not already done
     hass.data.setdefault(DOMAIN, {})
     # Store shared data
@@ -52,6 +55,8 @@ async def async_setup(hass: HomeAssistant, config: dict) -> bool:
 
 async def async_setup_entry(hass: HomeAssistant, entry: ConfigEntry) -> bool:
     """Set up UniFi Network Rules from a config entry."""
+    install_aiounifi_log_redaction()
+
     try:
         # Initialize API
         api = UDMAPI(

custom_components/unifi_network_rules/config_flow.py

@@ -32,6 +32,7 @@
     LOGGER,
 )
 from .udm import UDMAPI, CannotConnect, InvalidAuth
+from .utils.logger import install_aiounifi_log_redaction
 
 # Display the update interval in minutes for better UX
 DEFAULT_UPDATE_INTERVAL_MINUTES = DEFAULT_UPDATE_INTERVAL // 60
@@ -52,6 +53,8 @@
 
 async def validate_input(hass: HomeAssistant, data: dict[str, Any]) -> None:
     """Validate the user input allows us to connect."""
+    install_aiounifi_log_redaction()
+
     api = UDMAPI(
         data[CONF_HOST],
         data[CONF_USERNAME],

custom_components/unifi_network_rules/manifest.json

@@ -15,5 +15,5 @@
         "aiounifi>=87.0.0",
         "orjson>=3.8.0"
     ],
-    "version": "4.4.3"
-}
+    "version": "4.4.4"
+}

custom_components/unifi_network_rules/udm/api.py

@@ -6,6 +6,7 @@
 
 from ..const import LOGGER
 from ..queue import ApiOperationQueue
+from ..utils.logger import sanitize_auth_data
 from .api_base import UDMAPI as BaseAPI
 from .api_handlers import ApiHandlerMixin
 from .authentication import AuthenticationMixin
@@ -322,19 +323,7 @@ def create_api_request(self, method: str, path: str, data: Any = None, is_v2: bo
 
     def _sanitize_data_for_logging(self, data: Any) -> Any:
         """Remove sensitive information from data before logging."""
-        if not isinstance(data, dict):
-            return data
-
-        # Create a copy to avoid modifying the original
-        safe_data = data.copy()
-
-        # Remove sensitive fields (passwords, tokens, etc.)
-        sensitive_fields = ["password", "key", "psk", "secret", "token", "auth"]
-        for field in sensitive_fields:
-            if field in safe_data:
-                safe_data[field] = "***REDACTED***"
-
-        return safe_data
+        return sanitize_auth_data(data)
 
     async def refresh_all(self) -> None:
         """Refresh all API data from the controller."""

custom_components/unifi_network_rules/udm/authentication.py

@@ -278,7 +278,7 @@ async def refresh_session(self, force: bool = False) -> bool:
             )
 
             if not has_session:
-                LOGGER.warning("No valid session token, performing full login")
+                LOGGER.debug("No valid session token, performing full login")
                 login_success = await self._try_login()
 
                 # After login, ensure proxy prefix is in base path

custom_components/unifi_network_rules/udm/firewall.py

@@ -55,7 +55,7 @@ async def get_firewall_policies(
 
     async def add_firewall_policy(self, policy_data: dict[str, Any]) -> FirewallPolicy | None:
         """Add a new firewall policy."""
-        LOGGER.debug("Adding firewall policy: %s", policy_data)
+        LOGGER.debug("Adding firewall policy: %s", policy_data.get("name", "unnamed"))
         try:
             # Using is_v2=True because this is a v2 API endpoint
             request = self.create_api_request("POST", API_PATH_FIREWALL_POLICIES, data=policy_data, is_v2=True)
@@ -193,7 +193,7 @@ async def get_legacy_firewall_rules(self) -> list[FirewallRule]:
 
     async def add_legacy_firewall_rule(self, rule_data: dict[str, Any]) -> FirewallRule | None:
         """Add a new legacy firewall rule."""
-        LOGGER.debug("Adding legacy firewall rule: %s", rule_data)
+        LOGGER.debug("Adding legacy firewall rule: %s", rule_data.get("name", "unnamed"))
         try:
             # Using the correct path constant
             request = self.create_api_request("POST", API_PATH_LEGACY_FIREWALL_RULES, data=rule_data)

custom_components/unifi_network_rules/udm/network.py

@@ -235,16 +235,12 @@ async def get_device_led_states(self) -> list[Device]:
                             device = Device(device_data)
                             led_capable_devices.append(device)
                             LOGGER.debug(
-                                "Created LED-capable device: %s (%s) - LED state: %s",
-                                device_data.get("name", "Unknown"),
-                                mac,
+                                "Created LED-capable device - LED state: %s",
                                 device_data.get("led_override", "unknown"),
                             )
                         except Exception as device_err:
                             LOGGER.warning(
-                                "Error creating Device object for %s (%s): %s",
-                                device_data.get("name", "unknown"),
-                                mac,
+                                "Error creating Device object: %s",
                                 str(device_err),
                             )
                             continue

custom_components/unifi_network_rules/udm/port_forward.py

@@ -38,7 +38,7 @@ async def get_port_forwards(self) -> list[PortForward]:
 
     async def add_port_forward(self, forward_data: dict[str, Any]) -> PortForward | None:
         """Add a new port forward."""
-        LOGGER.debug("Adding port forward: %s", forward_data)
+        LOGGER.debug("Adding port forward: %s", forward_data.get("name", "unnamed"))
         try:
             # Using the path constant from const.py
             request = self.create_api_request("POST", API_PATH_PORT_FORWARDS, data=forward_data)

custom_components/unifi_network_rules/udm/qos.py

@@ -73,7 +73,7 @@ async def add_qos_rule(self, rule_data: dict[str, Any]) -> QoSRule | None:
         Returns:
             QoSRule object if successful, None otherwise
         """
-        LOGGER.debug("Adding QoS rule: %s", rule_data)
+        LOGGER.debug("Adding QoS rule: %s", rule_data.get("name", "unnamed"))
         try:
             # Using is_v2=True because this is a v2 API endpoint
             request = self.create_api_request("POST", API_PATH_QOS_RULES, data=rule_data, is_v2=True)

custom_components/unifi_network_rules/udm/routes.py

@@ -42,7 +42,7 @@ async def get_traffic_routes(self) -> list[TrafficRoute]:
 
     async def add_traffic_route(self, route_data: dict[str, Any]) -> TrafficRoute | None:
         """Add a new traffic route."""
-        LOGGER.debug("Adding traffic route: %s", route_data)
+        LOGGER.debug("Adding traffic route: %s", route_data.get("name", "unnamed"))
         try:
             # Using is_v2=True because this is a v2 API endpoint
             request = self.create_api_request("POST", API_PATH_TRAFFIC_ROUTES, data=route_data, is_v2=True)