src/safe_logging.py

"""Small helpers for operational logs that must not expose credentials."""

from urllib.parse import urlsplit


def redacted_endpoint(value) -> str:
    """Return only scheme and host/port, dropping credentials/path/query."""
    raw = str(value or "").strip()
    if not raw:
        return "missing"
    try:
        parsed = urlsplit(raw)
        if not parsed.scheme or not parsed.hostname:
            return "configured (details redacted)"
        host = parsed.hostname
        if ":" in host and not host.startswith("["):
            host = f"[{host}]"
        port = f":{parsed.port}" if parsed.port is not None else ""
        return f"{parsed.scheme}://{host}{port}"
    except (TypeError, ValueError):
        return "configured (details redacted)"