fix: redact sensitive data from debug logs (#150)

Author: sirkirby

custom_components/unifi_network_rules/__init__.py

@@ -30,12 +30,15 @@
 
 # Import the modular API implementation
 from .udm.api import UDMAPI
+from .utils.logger import install_aiounifi_log_redaction
 
 CONFIG_SCHEMA = cv.config_entry_only_config_schema(DOMAIN)
 
 
 async def async_setup(hass: HomeAssistant, config: dict) -> bool:
     """Set up UniFi Network Rules component."""
+    install_aiounifi_log_redaction()
+
     # Initialize domain data if not already done
     hass.data.setdefault(DOMAIN, {})
     # Store shared data
@@ -52,6 +55,8 @@ async def async_setup(hass: HomeAssistant, config: dict) -> bool:
 
 async def async_setup_entry(hass: HomeAssistant, entry: ConfigEntry) -> bool:
     """Set up UniFi Network Rules from a config entry."""
+    install_aiounifi_log_redaction()
+
     try:
         # Initialize API
         api = UDMAPI(

custom_components/unifi_network_rules/config_flow.py

@@ -32,6 +32,7 @@
     LOGGER,
 )
 from .udm import UDMAPI, CannotConnect, InvalidAuth
+from .utils.logger import install_aiounifi_log_redaction
 
 # Display the update interval in minutes for better UX
 DEFAULT_UPDATE_INTERVAL_MINUTES = DEFAULT_UPDATE_INTERVAL // 60
@@ -52,6 +53,8 @@
 
 async def validate_input(hass: HomeAssistant, data: dict[str, Any]) -> None:
     """Validate the user input allows us to connect."""
+    install_aiounifi_log_redaction()
+
     api = UDMAPI(
         data[CONF_HOST],
         data[CONF_USERNAME],

custom_components/unifi_network_rules/manifest.json

@@ -15,5 +15,5 @@
         "aiounifi>=87.0.0",
         "orjson>=3.8.0"
     ],
-    "version": "4.4.3"
-}
+    "version": "4.4.4"
+}

custom_components/unifi_network_rules/udm/api.py

@@ -6,6 +6,7 @@
 
 from ..const import LOGGER
 from ..queue import ApiOperationQueue
+from ..utils.logger import sanitize_auth_data
 from .api_base import UDMAPI as BaseAPI
 from .api_handlers import ApiHandlerMixin
 from .authentication import AuthenticationMixin
@@ -322,19 +323,7 @@ def create_api_request(self, method: str, path: str, data: Any = None, is_v2: bo
 
     def _sanitize_data_for_logging(self, data: Any) -> Any:
         """Remove sensitive information from data before logging."""
-        if not isinstance(data, dict):
-            return data
-
-        # Create a copy to avoid modifying the original
-        safe_data = data.copy()
-
-        # Remove sensitive fields (passwords, tokens, etc.)
-        sensitive_fields = ["password", "key", "psk", "secret", "token", "auth"]
-        for field in sensitive_fields:
-            if field in safe_data:
-                safe_data[field] = "***REDACTED***"
-
-        return safe_data
+        return sanitize_auth_data(data)
 
     async def refresh_all(self) -> None:
         """Refresh all API data from the controller."""

custom_components/unifi_network_rules/udm/authentication.py

@@ -278,7 +278,7 @@ async def refresh_session(self, force: bool = False) -> bool:
             )
 
             if not has_session:
-                LOGGER.warning("No valid session token, performing full login")
+                LOGGER.debug("No valid session token, performing full login")
                 login_success = await self._try_login()
 
                 # After login, ensure proxy prefix is in base path

custom_components/unifi_network_rules/udm/firewall.py

@@ -55,7 +55,7 @@ async def get_firewall_policies(
 
     async def add_firewall_policy(self, policy_data: dict[str, Any]) -> FirewallPolicy | None:
         """Add a new firewall policy."""
-        LOGGER.debug("Adding firewall policy: %s", policy_data)
+        LOGGER.debug("Adding firewall policy: %s", policy_data.get("name", "unnamed"))
         try:
             # Using is_v2=True because this is a v2 API endpoint
             request = self.create_api_request("POST", API_PATH_FIREWALL_POLICIES, data=policy_data, is_v2=True)
@@ -193,7 +193,7 @@ async def get_legacy_firewall_rules(self) -> list[FirewallRule]:
 
     async def add_legacy_firewall_rule(self, rule_data: dict[str, Any]) -> FirewallRule | None:
         """Add a new legacy firewall rule."""
-        LOGGER.debug("Adding legacy firewall rule: %s", rule_data)
+        LOGGER.debug("Adding legacy firewall rule: %s", rule_data.get("name", "unnamed"))
         try:
             # Using the correct path constant
             request = self.create_api_request("POST", API_PATH_LEGACY_FIREWALL_RULES, data=rule_data)

custom_components/unifi_network_rules/udm/network.py

@@ -235,16 +235,12 @@ async def get_device_led_states(self) -> list[Device]:
                             device = Device(device_data)
                             led_capable_devices.append(device)
                             LOGGER.debug(
-                                "Created LED-capable device: %s (%s) - LED state: %s",
-                                device_data.get("name", "Unknown"),
-                                mac,
+                                "Created LED-capable device - LED state: %s",
                                 device_data.get("led_override", "unknown"),
                             )
                         except Exception as device_err:
                             LOGGER.warning(
-                                "Error creating Device object for %s (%s): %s",
-                                device_data.get("name", "unknown"),
-                                mac,
+                                "Error creating Device object: %s",
                                 str(device_err),
                             )
                             continue

custom_components/unifi_network_rules/udm/port_forward.py

@@ -38,7 +38,7 @@ async def get_port_forwards(self) -> list[PortForward]:
 
     async def add_port_forward(self, forward_data: dict[str, Any]) -> PortForward | None:
         """Add a new port forward."""
-        LOGGER.debug("Adding port forward: %s", forward_data)
+        LOGGER.debug("Adding port forward: %s", forward_data.get("name", "unnamed"))
         try:
             # Using the path constant from const.py
             request = self.create_api_request("POST", API_PATH_PORT_FORWARDS, data=forward_data)

custom_components/unifi_network_rules/udm/qos.py

@@ -73,7 +73,7 @@ async def add_qos_rule(self, rule_data: dict[str, Any]) -> QoSRule | None:
         Returns:
             QoSRule object if successful, None otherwise
         """
-        LOGGER.debug("Adding QoS rule: %s", rule_data)
+        LOGGER.debug("Adding QoS rule: %s", rule_data.get("name", "unnamed"))
         try:
             # Using is_v2=True because this is a v2 API endpoint
             request = self.create_api_request("POST", API_PATH_QOS_RULES, data=rule_data, is_v2=True)

custom_components/unifi_network_rules/udm/routes.py

@@ -42,7 +42,7 @@ async def get_traffic_routes(self) -> list[TrafficRoute]:
 
     async def add_traffic_route(self, route_data: dict[str, Any]) -> TrafficRoute | None:
         """Add a new traffic route."""
-        LOGGER.debug("Adding traffic route: %s", route_data)
+        LOGGER.debug("Adding traffic route: %s", route_data.get("name", "unnamed"))
         try:
             # Using is_v2=True because this is a v2 API endpoint
             request = self.create_api_request("POST", API_PATH_TRAFFIC_ROUTES, data=route_data, is_v2=True)