dotenvmodel 0.3.0__tar.gz → 0.3.2__tar.gz

{dotenvmodel-0.3.0 → dotenvmodel-0.3.2}/.github/workflows/ci.yml

@@ -133,7 +133,7 @@ jobs:
           cd /tmp && $GITHUB_WORKSPACE/test-src-env/bin/python -c "import dotenvmodel; print(dotenvmodel.__version__)"
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: dist
           path: dist/

dotenvmodel-0.3.2/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.3.2"
+}

{dotenvmodel-0.3.0 → dotenvmodel-0.3.2}/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.2](https://github.com/AZX-PBC-OSS/dotenvmodel/compare/v0.3.1...v0.3.2) (2026-07-15)
+
+
+### Bug Fixes
+
+* resolve nested DotEnvConfig field defaults not being loaded ([#34](https://github.com/AZX-PBC-OSS/dotenvmodel/issues/34)) ([4a3bb88](https://github.com/AZX-PBC-OSS/dotenvmodel/commit/4a3bb8864dad044977d7b72be41e15307fff8f4d))
+
+## [0.3.1](https://github.com/AZX-PBC-OSS/dotenvmodel/compare/v0.3.0...v0.3.1) (2026-07-13)
+
+
+### Bug Fixes
+
+* redact credentials in DSN repr, errors, docs, and secret exception chains ([#29](https://github.com/AZX-PBC-OSS/dotenvmodel/issues/29)) ([cfdd218](https://github.com/AZX-PBC-OSS/dotenvmodel/commit/cfdd218ff157d41f7af06c1beaf4c539080fa2dd))
+
 ## [0.3.0](https://github.com/AZX-PBC-OSS/dotenvmodel/compare/v0.2.0...v0.3.0) (2026-07-09)
 
 

{dotenvmodel-0.3.0 → dotenvmodel-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dotenvmodel
-Version: 0.3.0
+Version: 0.3.2
 Summary: Type-safe environment configuration with automatic .env file loading
 Project-URL: Homepage, https://github.com/AZX-PBC-OSS/dotenvmodel
 Project-URL: Repository, https://github.com/AZX-PBC-OSS/dotenvmodel
@@ -1036,6 +1036,30 @@ redis = RedisConfig.load()      # Reads REDIS_HOST, REDIS_PORT
 app = AppConfig.load()          # Reads APP_NAME, APP_VERSION
 ```
 
+### Nested Configuration
+
+A field typed as another `DotEnvConfig` subclass is loaded as a nested config, resolving its own fields (including defaults) from its own `env_prefix` — independently of the parent's prefix:
+
+```python
+class OIDCSettings(DotEnvConfig):
+    env_prefix = "WARDEN_OIDC_"
+    issuer: str = Field(default="")
+    session_max_age_seconds: int = Field(default=28800)
+
+class Settings(DotEnvConfig):
+    env_prefix = "WARDEN_"
+    service_name: str = Field(default="warden")
+    oidc: OIDCSettings = Field(default_factory=OIDCSettings)
+
+settings = Settings.load_from_dict({
+    "WARDEN_OIDC_SESSION_MAX_AGE_SECONDS": "3600",
+})
+settings.oidc.session_max_age_seconds  # 3600 (overridden)
+settings.oidc.issuer                   # "" (nested default, not the parent's prefix)
+```
+
+Nested `env_prefix` values are **absolute, not concatenated** with the parent's — `OIDCSettings.env_prefix` above is `WARDEN_OIDC_` in full, not appended to `Settings.env_prefix`. `.load()`, `.load_from_dict()`, and `.reload()` all resolve nested fields the same way. See [Known Limitations](#known-limitations) for `Optional[NestedConfig]` and `describe()` caveats.
+
 ## Error Handling
 
 ### Missing Required Field
@@ -1264,6 +1288,25 @@ config = Config.load()
 value_as_int = int(config.value) if config.value.isdigit() else config.value
 ```
 
+### Optional Nested Configuration
+
+`Optional[NestedConfig]` / `NestedConfig | None` fields are **not** supported the way a plain `nested: NestedConfig = Field(default_factory=NestedConfig)` field is — an Optional-typed nested field falls through to ordinary Optional-scalar handling and silently resolves to `None`, discarding any env vars set at the nested prefix:
+
+```python
+class Config(DotEnvConfig):
+    env_prefix = "APP_"
+    nested: NestedConfig | None = Field(default=None)
+
+config = Config.load_from_dict({"APP_NESTED_PORT": "8080"})
+config.nested  # None — the override above is silently ignored
+```
+
+**Workaround**: give the nested field a non-Optional type with `default_factory`, as in [Nested Configuration](#nested-configuration) above. If the nested config is conditionally absent in your app, model that with a `bool`/enum field inside the nested config itself rather than making the field Optional.
+
+### `describe()` / `generate_env_example()` and Nested Configuration
+
+`describe()` and `generate_env_example()` do not recurse into nested config fields — a nested field renders as an opaque, non-functional placeholder (e.g. `APP_NESTED=<NestedConfig()>`) rather than expanding to the nested class's real, settable env vars (e.g. `APP_NESTED_PORT`). Don't rely on generated `.env.example` output to discover a nested config's real variables — read the nested class's own fields (or its own `describe()` output) directly.
+
 ## License
 
 MIT License - see [LICENSE](LICENSE) for details.

{dotenvmodel-0.3.0 → dotenvmodel-0.3.2}/README.md

@@ -1008,6 +1008,30 @@ redis = RedisConfig.load()      # Reads REDIS_HOST, REDIS_PORT
 app = AppConfig.load()          # Reads APP_NAME, APP_VERSION
 ```
 
+### Nested Configuration
+
+A field typed as another `DotEnvConfig` subclass is loaded as a nested config, resolving its own fields (including defaults) from its own `env_prefix` — independently of the parent's prefix:
+
+```python
+class OIDCSettings(DotEnvConfig):
+    env_prefix = "WARDEN_OIDC_"
+    issuer: str = Field(default="")
+    session_max_age_seconds: int = Field(default=28800)
+
+class Settings(DotEnvConfig):
+    env_prefix = "WARDEN_"
+    service_name: str = Field(default="warden")
+    oidc: OIDCSettings = Field(default_factory=OIDCSettings)
+
+settings = Settings.load_from_dict({
+    "WARDEN_OIDC_SESSION_MAX_AGE_SECONDS": "3600",
+})
+settings.oidc.session_max_age_seconds  # 3600 (overridden)
+settings.oidc.issuer                   # "" (nested default, not the parent's prefix)
+```
+
+Nested `env_prefix` values are **absolute, not concatenated** with the parent's — `OIDCSettings.env_prefix` above is `WARDEN_OIDC_` in full, not appended to `Settings.env_prefix`. `.load()`, `.load_from_dict()`, and `.reload()` all resolve nested fields the same way. See [Known Limitations](#known-limitations) for `Optional[NestedConfig]` and `describe()` caveats.
+
 ## Error Handling
 
 ### Missing Required Field
@@ -1236,6 +1260,25 @@ config = Config.load()
 value_as_int = int(config.value) if config.value.isdigit() else config.value
 ```
 
+### Optional Nested Configuration
+
+`Optional[NestedConfig]` / `NestedConfig | None` fields are **not** supported the way a plain `nested: NestedConfig = Field(default_factory=NestedConfig)` field is — an Optional-typed nested field falls through to ordinary Optional-scalar handling and silently resolves to `None`, discarding any env vars set at the nested prefix:
+
+```python
+class Config(DotEnvConfig):
+    env_prefix = "APP_"
+    nested: NestedConfig | None = Field(default=None)
+
+config = Config.load_from_dict({"APP_NESTED_PORT": "8080"})
+config.nested  # None — the override above is silently ignored
+```
+
+**Workaround**: give the nested field a non-Optional type with `default_factory`, as in [Nested Configuration](#nested-configuration) above. If the nested config is conditionally absent in your app, model that with a `bool`/enum field inside the nested config itself rather than making the field Optional.
+
+### `describe()` / `generate_env_example()` and Nested Configuration
+
+`describe()` and `generate_env_example()` do not recurse into nested config fields — a nested field renders as an opaque, non-functional placeholder (e.g. `APP_NESTED=<NestedConfig()>`) rather than expanding to the nested class's real, settable env vars (e.g. `APP_NESTED_PORT`). Don't rely on generated `.env.example` output to discover a nested config's real variables — read the nested class's own fields (or its own `describe()` output) directly.
+
 ## License
 
 MIT License - see [LICENSE](LICENSE) for details.

{dotenvmodel-0.3.0 → dotenvmodel-0.3.2}/dotenvmodel/__init__.py

@@ -31,7 +31,7 @@ Public API:
       Exception hierarchy
 """
 
-__version__ = "0.3.0"
+__version__ = "0.3.2"
 __author__ = "AZX, PBC."
 __email__ = "oss@azx.io"
 __license__ = "MIT"

dotenvmodel-0.3.2/dotenvmodel/_redaction.py

@@ -0,0 +1,260 @@
+"""Credential-redaction helpers shared across display paths.
+
+Kept dependency-free (stdlib only) so both ``exceptions`` and ``types`` can
+import it without creating an import cycle.
+
+Masking philosophy — deliberately asymmetric. These helpers run only on
+error/describe/``repr`` display paths, where over-masking a benign value
+(``sort_key=name`` shown as ``sort_key=***``) costs a little debug context,
+while under-masking leaks a credential. So the classifier keeps NO benign
+carve-out lists: any key with a secret-word token is masked, and the word
+list is the single place to maintain.
+
+Known, documented non-goals (use ``SecretStr`` for these):
+- secrets embedded in a URL *path* segment (Slack webhooks, ``/bot<token>/``);
+- plain non-URL secret values and secrets inside containers/JSON bodies;
+- ``user:pw@host`` shapes buried mid-string (only a leading one is masked).
+"""
+
+import re
+from urllib.parse import unquote_plus, urlparse
+
+__all__ = ["redact_url_password"]
+
+_MASK = "***"
+
+# A key is sensitive when ANY of its separator/camelCase tokens is one of
+# these words, or the separator-stripped whole key matches (``session_id`` ->
+# ``sessionid``, ``connection_string`` -> ``connectionstring``). Exact token
+# equality keeps lookalikes benign: ``keyword``/``monkey``/``authors``/
+# ``oauth``/``bypass``/``passwordless`` never match.
+_SECRET_WORDS = frozenset(
+    {
+        "password",
+        "passwd",
+        "pwd",
+        "pass",
+        "passphrase",
+        "passcode",
+        "secret",
+        "credential",
+        "credentials",
+        "apikey",
+        "key",
+        "token",
+        "auth",
+        "authorization",
+        "assertion",
+        "signature",
+        "sig",
+        "hmac",
+        "jwt",
+        "bearer",
+        "sessionid",
+        "jsessionid",
+        "phpsessid",
+        "sid",
+        "session",
+        "otp",
+        "totp",
+        "sas",
+        "saml",
+        "verifier",
+        "challenge",
+        "pin",
+        "cvv",
+        "cvc",
+        "pat",
+        "license",
+        "dsn",
+        "connectionstring",
+        "connstr",
+    }
+)
+
+# Credential only as the ENTIRE key: OAuth's bare ``?code=`` masks, while
+# ``status_code``/``error_code`` (debug-critical) stay visible.
+_SECRET_WHOLE_ONLY = frozenset({"code"})
+
+# Glued (separator-less) suffixes, e.g. ``sslpassword`` / ``xapikey``.
+_SECRET_SUFFIXES = (
+    "password",
+    "passphrase",
+    "passcode",
+    "signature",
+    "apikey",
+    "connectionstring",
+    "connstr",
+)
+
+# Prefixes that make a glued (separator-less) ``*key``/``*token``/``*secret``
+# compound a credential: ``secretkey``, ``accesstoken``, ``clientsecret``.
+_CREDENTIAL_PREFIXES = frozenset(
+    {
+        "secret",
+        "access",
+        "private",
+        "api",
+        "client",
+        "signing",
+        "encryption",
+        "refresh",
+        "session",
+        "shared",
+        "master",
+        "auth",
+        "bearer",
+        "consumer",
+        "sas",
+        "ssl",
+        "account",
+        "storage",
+    }
+)
+
+# Split camelCase and ACRONYMBoundaries (HMACKey -> HMAC, Key).
+_CAMEL = re.compile(r"(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])")
+_SEPARATORS = re.compile(r"[-_.]+")
+# Fallback for unparseable URLs: mask the userinfo password (scheme://user:PW@).
+# The password class allows '@'/':' and backtracks to the last '@' before the
+# path, so an unescaped '@' in the password is still fully masked.
+_USERINFO_PW = re.compile(r"(://[^:/?#@\s]*:)[^/?#\s]+(@)")
+# Scheme-less userinfo (the forgot-the-scheme typo: ``dbuser:pw@host/db``).
+# urlparse reads ``dbuser`` as the scheme there, so the netloc path never
+# fires; anchored at the start so prose with colons is left alone.
+_SCHEMELESS_PW = re.compile(r"^([^:/?#@\s]+:)[^/?#\s]+(@)(?=[^/?#\s@]*[/:])")
+
+
+def _is_sensitive_key(key: str) -> bool:
+    """True if a query/fragment/params key names a credential.
+
+    Any secret-word token masks (``access_token``, ``db_pass``,
+    ``api_key_v2beta`` — the qualifier tokens don't hide the match), plus a
+    stripped-whole-key check for separator-spanning words and a suffix/prefix
+    check for glued forms like ``sslpassword``/``secretkey``. No benign
+    carve-outs: ``sort_key``/``page_token`` mask too, by design (see module
+    docstring).
+    """
+    raw = unquote_plus(key).strip()
+    if not raw:
+        return False
+
+    k = _CAMEL.sub("_", raw).lower()
+    tokens = [t for t in _SEPARATORS.split(k) if t]
+    if not tokens:
+        return False
+    stripped = "".join(tokens)
+
+    if stripped in _SECRET_WHOLE_ONLY:
+        return True
+    # A secret-word token (or its plural: passwords/tokens/keys).
+    if any(t in _SECRET_WORDS or (t.endswith("s") and t[:-1] in _SECRET_WORDS) for t in tokens):
+        return True
+    # A secret word spanning separators (session_id -> sessionid).
+    if stripped in _SECRET_WORDS:
+        return True
+    if _is_glued_credential(stripped):
+        return True
+    return any(stripped.endswith(sfx) for sfx in _SECRET_SUFFIXES)
+
+
+def _is_glued_credential(stripped: str) -> bool:
+    """True for separator-less compounds like ``secretkey`` / ``accesstoken``."""
+    for suffix in ("key", "token", "secret", "password"):
+        if stripped.endswith(suffix) and len(stripped) > len(suffix):
+            prefix = stripped[: -len(suffix)]
+            # ``secretaccesskey`` -> prefix ``secretaccess`` starts with ``secret``.
+            if any(prefix.startswith(p) for p in _CREDENTIAL_PREFIXES):
+                return True
+    return False
+
+
+def _redact_pairs(component: str) -> tuple[str, bool]:
+    """Mask sensitive values in an ``&``-separated key=value string.
+
+    Per the WHATWG URL standard, ``&`` is the only separator; a ``;`` is data
+    and stays inside its value. A sensitive key masks its whole value
+    (including any ``;`` tail). Defensively, a legacy ``;``-glued sub-pair
+    inside a *benign* key's value (``db=0;password=x``) is also masked, pair
+    by pair. Non-sensitive pairs are preserved byte-for-byte. Returns the
+    (possibly rewritten) component and whether anything changed.
+    """
+    changed = False
+    parts = component.split("&")
+    for i, part in enumerate(parts):
+        key, sep, value = part.partition("=")
+        if sep and value and _is_sensitive_key(key):
+            parts[i] = f"{key}={_MASK}"
+            changed = True
+            continue
+        if ";" in part:
+            subs = part.split(";")
+            sub_changed = False
+            for j, sub in enumerate(subs):
+                skey, ssep, svalue = sub.partition("=")
+                if ssep and svalue and _is_sensitive_key(skey):
+                    subs[j] = f"{skey}={_MASK}"
+                    sub_changed = True
+            if sub_changed:
+                parts[i] = ";".join(subs)
+                changed = True
+    return ("&".join(parts), changed) if changed else (component, False)
+
+
+def redact_url_password(value: str) -> str:
+    """Return ``value`` with any URL credential replaced by ``***``.
+
+    Masks the userinfo password (``user:pass@host`` -> ``user:***@host``,
+    including the scheme-less typo form ``user:pass@host`` with no ``//``)
+    and the value of any sensitive key in the query string, fragment, or
+    ``;``-params component (e.g. ``?password=`` / ``#access_token=`` /
+    ``/path;password=``). Host, port, and non-sensitive parameters are
+    preserved verbatim. A string without any credential-shaped part is
+    returned unchanged, so this is safe to call on arbitrary values.
+    """
+    # Scheme-less userinfo: urlparse would read the username as the scheme, so
+    # mask a leading `user:pw@host/…` up front (anchored + a path/port lookahead
+    # so `https://…` and email-shaped `cc:john@example.com` are left alone). Done
+    # unconditionally so a later `://` (e.g. in a redirect param) can't skip it.
+    prefix_masked = _SCHEMELESS_PW.sub(rf"\1{_MASK}\2", value)
+
+    try:
+        parsed = urlparse(prefix_masked)
+    except ValueError:
+        # Malformed URL (e.g. bad IPv6). urlparse can't help, but neither the
+        # userinfo password nor a query/fragment secret may leak, so mask the
+        # userinfo by regex and redact the (splittable) query and fragment.
+        masked = _USERINFO_PW.sub(rf"\1{_MASK}\2", prefix_masked)
+        head, hsep, frag = masked.partition("#")
+        head, qsep, query = head.partition("?")
+        head, psep, params = head.partition(";")
+        if psep:
+            params = _redact_pairs(params)[0]
+        if qsep:
+            query = _redact_pairs(query)[0]
+        if hsep:
+            frag = _redact_pairs(frag)[0]
+        return head + psep + params + qsep + query + hsep + frag
+
+    netloc = parsed.netloc
+    changed = prefix_masked != value
+
+    if parsed.password:
+        userinfo, _, hostpart = netloc.rpartition("@")
+        username = userinfo.partition(":")[0]
+        netloc = f"{username}:{_MASK}@{hostpart}"
+        changed = True
+
+    params, params_changed = (
+        _redact_pairs(parsed.params) if parsed.params else (parsed.params, False)
+    )
+    query, query_changed = _redact_pairs(parsed.query) if parsed.query else (parsed.query, False)
+    fragment, frag_changed = (
+        _redact_pairs(parsed.fragment) if parsed.fragment else (parsed.fragment, False)
+    )
+    changed = changed or params_changed or query_changed or frag_changed
+
+    if not changed:
+        return value
+
+    return parsed._replace(netloc=netloc, params=params, query=query, fragment=fragment).geturl()

{dotenvmodel-0.3.0 → dotenvmodel-0.3.2}/dotenvmodel/config.py

@@ -78,6 +78,7 @@ class DotEnvConfig(metaclass=ConfigMeta):
         raw_value: str | None,
         env_var_name: str,
         *,
+        env_source: builtins.dict[str, str] | None = None,
         validate: bool = True,
     ) -> Any:
         """
@@ -89,6 +90,10 @@ class DotEnvConfig(metaclass=ConfigMeta):
             field_info: Field metadata
             raw_value: Raw string value from environment (or None)
             env_var_name: Environment variable name for error messages
+            env_source: The source passed to the enclosing `_load_fields` call
+                (None for real env vars, or a dict for `load_from_dict`).
+                Forwarded to nested `DotEnvConfig` fields so they resolve
+                from the same source as their parent.
             validate: Whether to perform validation (default: True)
 
         Returns:
@@ -98,6 +103,33 @@ class DotEnvConfig(metaclass=ConfigMeta):
             MissingFieldError: If required field is missing
             ValidationError: If validation fails
         """
+        # Nested DotEnvConfig fields (e.g. `oidc: OIDCSettings`) are not a
+        # scalar to coerce — a nested config resolves its own fields from
+        # the same env_source using its own env_prefix, so it must always
+        # go through _load_fields() regardless of whether raw_value (the
+        # value of an env var literally named after the field, which no
+        # one sets) is present. A bare `field_type()` here would silently
+        # produce an unloaded instance whose fields never got populated.
+        #
+        # Note: this only matches a plain `type` — `Optional[Nested]` /
+        # `Nested | None` is a Union, not a `type`, so it does NOT take
+        # this branch and instead falls through to the Optional handling
+        # in coerce_value(), which just returns None for a missing literal
+        # env var without trying the nested prefix. See
+        # TestOptionalNestedConfigLimitation below — tracked as a known
+        # follow-up, not fixed here.
+        #
+        # Note: field_info.required is deliberately not consulted here —
+        # a `Field()`-required (no default) nested config now always
+        # resolves successfully using the nested class's own defaults,
+        # rather than raising MissingFieldError. "Required" is expressed
+        # on the nested class's own fields instead. See
+        # TestRequiredNestedConfigField below for the pinned behavior.
+        if isinstance(field_type, type) and issubclass(field_type, DotEnvConfig):
+            nested = field_type()
+            nested._load_fields(env_source, validate=validate)
+            return nested
+
         # Handle missing values
         if raw_value is None:
             if field_info.required:
@@ -164,11 +196,18 @@ class DotEnvConfig(metaclass=ConfigMeta):
                     field_info,
                     raw_value,
                     env_var_name,
+                    env_source=env_source,
                     validate=validate,
                 )
                 setattr(self, field_name, value)
             except ValidationError as e:
                 errors.append(e)
+            except MultipleValidationErrors as e:
+                # Raised when a nested DotEnvConfig field (see
+                # _process_field) has multiple invalid fields of its own —
+                # flatten into this level's collection instead of letting
+                # it escape uncaught past the aggregation loop.
+                errors.extend(e.errors)
 
         if errors:
             if len(errors) == 1:

{dotenvmodel-0.3.0 → dotenvmodel-0.3.2}/dotenvmodel/describe/formatters.py

@@ -13,8 +13,9 @@ from typing import Any, Union, get_args, get_origin
 
 from typing_extensions import TypeForm
 
+from dotenvmodel._redaction import redact_url_password
 from dotenvmodel.fields import _MISSING, FieldInfo
-from dotenvmodel.types import SecretStr
+from dotenvmodel.types import BaseDsn, SecretStr
 
 # Maximum column widths to prevent unbounded table growth
 MAX_WIDTHS = {
@@ -317,6 +318,23 @@ def format_constraints(
     return ", ".join(constraints) if constraints else "-"
 
 
+def _union_members(field_type: TypeForm[Any]) -> list[Any]:
+    """Return the non-None members of an Optional/Union, else ``[field_type]``.
+
+    Handles multi-member unions (``PostgresDsn | RedisDsn | None``) so a DSN or
+    SecretStr anywhere in the union is still recognised for redaction.
+    """
+    origin = get_origin(field_type)
+    if origin is types.UnionType or origin is Union:
+        return [a for a in get_args(field_type) if a is not type(None)]
+    return [field_type]
+
+
+def _is_type_in_union(field_type: TypeForm[Any], target: type) -> bool:
+    """True if any member of ``field_type`` is a subclass of ``target``."""
+    return any(isinstance(m, type) and issubclass(m, target) for m in _union_members(field_type))
+
+
 def format_default(field_info: FieldInfo, field_type: TypeForm[Any], truncate: bool = True) -> str:
     """Format default value for display."""
     if field_info.default is _MISSING and field_info.default_factory is None:
@@ -340,9 +358,15 @@ def format_default(field_info: FieldInfo, field_type: TypeForm[Any], truncate: b
     if isinstance(default, Enum):
         return str(default.value)
 
-    if isinstance(field_type, type) and issubclass(field_type, SecretStr):
+    # Recognise DSN/SecretStr even inside an Optional/multi-member Union
+    # (e.g. `PostgresDsn | RedisDsn | None`) so nested defaults are redacted.
+    if _is_type_in_union(field_type, SecretStr):
         return "<secret>"
 
+    # DSN defaults may embed credentials; redact the password before display.
+    if _is_type_in_union(field_type, BaseDsn) and isinstance(default, str):
+        return f'"{redact_url_password(str.__str__(default))}"'
+
     if isinstance(default, str):
         if truncate and len(default) > TRUNCATE_THRESHOLD_SHORT:
             return f'"{default[: TRUNCATE_THRESHOLD_SHORT - 3]}..."'

{dotenvmodel-0.3.0 → dotenvmodel-0.3.2}/dotenvmodel/exceptions.py

@@ -4,6 +4,15 @@ from typing import Any
 
 from typing_extensions import TypeForm
 
+from dotenvmodel._redaction import redact_url_password
+
+
+def _value_repr(value: Any) -> str:
+    """Repr a field value for error messages, redacting URL passwords."""
+    if isinstance(value, str):
+        return repr(redact_url_password(str.__str__(value)))
+    return repr(value)
+
 
 class DotEnvModelError(Exception):
     """Base exception for all dotenvmodel errors.
@@ -83,7 +92,7 @@ class ValidationError(DotEnvModelError):
     def _format_message(self) -> str:
         """Format a detailed error message."""
         msg = f"Field '{self.field_name}' validation failed:\n"
-        msg += f"  Value: {self.value!r}\n"
+        msg += f"  Value: {_value_repr(self.value)}\n"
         if self.field_type:
             type_name = getattr(self.field_type, "__name__", str(self.field_type))
             msg += f"  Expected type: {type_name}\n"
@@ -182,7 +191,7 @@ class TypeCoercionError(ValidationError):
         if self.field_type:
             type_name = getattr(self.field_type, "__name__", str(self.field_type))
         msg = f"TypeCoercionError: Failed to coerce field '{self.field_name}' to type {type_name}.\n\n"
-        msg += f"Value: {self.value!r}\n"
+        msg += f"Value: {_value_repr(self.value)}\n"
         msg += f"Environment variable: {self.env_var_name}\n"
         msg += f"Error: {self.error_msg}\n"
         msg += f"Hint: Ensure {self.env_var_name} contains a valid {type_name}"
@@ -239,7 +248,7 @@ class ConstraintViolationError(ValidationError):
     def _format_message(self) -> str:
         """Format a detailed error message for constraint violations."""
         msg = f"ConstraintViolationError: Field '{self.field_name}' violates constraint.\n\n"
-        msg += f"Value: {self.value!r}\n"
+        msg += f"Value: {_value_repr(self.value)}\n"
         msg += f"Constraint: {self.constraint}\n"
         msg += f"Error: {self.error_msg}\n"
         msg += f"Hint: Set {self.env_var_name} to a value that satisfies the constraint"
@@ -284,7 +293,7 @@ class MultipleValidationErrors(DotEnvModelError):
             msg += f"{i}. {error.__class__.__name__}: {error.error_msg}\n"
             msg += f"   Field: {error.field_name}\n"
             if error.value is not None:
-                msg += f"   Value: {error.value!r}\n"
+                msg += f"   Value: {_value_repr(error.value)}\n"
             msg += f"   Environment variable: {error.env_var_name}\n"
             if hasattr(error, "constraint") and error.constraint is not None:  # type: ignore[attr-defined]
                 msg += f"   Constraint: {error.constraint}\n"  # type: ignore[attr-defined]

{dotenvmodel-0.3.0 → dotenvmodel-0.3.2}/dotenvmodel/types.py

@@ -8,6 +8,7 @@ from typing import TYPE_CHECKING, TypeVar
 from urllib.parse import ParseResult, unquote, urlparse
 from uuid import UUID
 
+from dotenvmodel._redaction import redact_url_password
 from dotenvmodel.exceptions import TypeCoercionError
 
 _T = TypeVar("_T")
@@ -146,6 +147,19 @@ class BaseDsn(str):
 
         return str.__new__(cls, value)
 
+    def __repr__(self) -> str:
+        """Return a redacted ``repr`` with any password masked.
+
+        Only ``repr`` is overridden. ``str(dsn)`` and the raw buffer remain the
+        real connection string so the DSN stays usable with database drivers
+        (``create_engine(str(url))``, ``redis.from_url(str(url))``, etc.). This
+        masks the accidental-display path (``repr(config)``, debuggers, ``%r``
+        logging) without breaking functionality. Values that must never appear
+        in serialized output (``json.dumps``, ``.encode()``) should use
+        ``SecretStr`` instead.
+        """
+        return repr(redact_url_password(str.__str__(self)))
+
     @property
     def parsed(self) -> ParseResult:
         """Get the parsed URL components."""