Spaces:
Paused
Paused
Commit History
-
fix(logging): strip API keys from upstream error URLs before logging
PNRxAreqwest embeds the full request URL — query string included — in both the Display and Debug of its errors. TMDB, OMDb, MDBList and fanart all pass their API key as a query parameter (`?api_key=…` / `?apikey=…`), so an upstream 404/timeout/decode error logged via `AppError::Api` leaked the key into the logs, e.g.: mdblist rating fetch failed: API error: HTTP status client error (404 Not Found) for url (https://api.mdblist.com/imdb/show/tt…?apikey=<KEY>) Sanitize the error object itself at the only two `AppError::Api` construction sites — the `From<reqwest::Error>` conversion (every `?`/`error_for_status()?`) and the direct build in `services::retry` — by dropping the URL's query string (`set_query(None)`). Scrubbing the stored error rather than one Display site also protects Debug output and the moka `Arc<AppError>` → `Other(_.to_string())` laundering paths in image::serve. Scheme/host/path are kept for debugging; the key is never in them. Trakt sends its key as a header, whic…937da1f
-
initial trakt implementation
PNRxA7f22b24
-
add service request retries
PNRxA65c3047