Access log: the pairing poll's ?secret= and a socket's ?ticket= are masked too

backend/tests/test_access_log.py

@@ -1,4 +1,4 @@
-"""A token in a query string stays out of uvicorn's request lines."""
+"""A credential in a query string stays out of uvicorn's request lines."""
 
 import logging
 
@@ -26,3 +26,29 @@ def test_a_token_in_the_query_is_not_logged() -> None:
     assert [record.getMessage() for record in records] == [
         '192.0.2.1:0 - "WebSocket /api/v1/flows/ws?token=***&x=1" [accepted]'
     ]
+
+
+def test_the_pairing_secret_is_not_logged() -> None:
+    records: list[logging.LogRecord] = []
+    handler = logging.Handler()
+    handler.emit = records.append  # type: ignore[method-assign]
+    log = logging.getLogger("uvicorn.access")
+    level = log.level
+    log.addHandler(handler)
+    log.setLevel(logging.INFO)
+    try:
+        log.info(
+            '%s - "%s %s HTTP/%s" %d',
+            "192.0.2.1:0",
+            "GET",
+            "/api/v1/devices/pair/ABCD2345?secret=s3cr3t",
+            "1.1",
+            202,
+        )
+    finally:
+        log.removeHandler(handler)
+        log.setLevel(level)
+
+    assert [record.getMessage() for record in records] == [
+        '192.0.2.1:0 - "GET /api/v1/devices/pair/ABCD2345?secret=*** HTTP/1.1" 202'
+    ]