unique-sdk 2026.32.0.dev6__tar.gz → 2026.32.0.dev7__tar.gz

{unique_sdk-2026.32.0.dev6 → unique_sdk-2026.32.0.dev7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: unique-sdk
-Version: 2026.32.0.dev6
+Version: 2026.32.0.dev7
 Summary: 
 Author: Martin Fadler, Konstantin Krauss, Andreas Hauri
 Author-email: Martin Fadler <martin.fadler@unique.ch>, Konstantin Krauss <konstantin@unique.ch>, Andreas Hauri <andreas@unique.ch>

{unique_sdk-2026.32.0.dev6 → unique_sdk-2026.32.0.dev7}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "unique_sdk"
-version = "2026.32.0.dev6"
+version = "2026.32.0.dev7"
 description = ""
 readme = "README.md"
 license = { text = "MIT" }

{unique_sdk-2026.32.0.dev6 → unique_sdk-2026.32.0.dev7}/unique_sdk/_api_requestor.py

@@ -194,8 +194,7 @@ class APIRequestor(object):
         )
 
         _util.log_info("Request to Unique", method=method, path=abs_url)
-        _util.log_debug(
-            "Request details",
+        _util.log_request_details(
             data=post_data,
             headers=headers,
             api_version=self.api_version,
@@ -206,7 +205,7 @@ class APIRequestor(object):
         )
 
         _util.log_info("Unique response", path=abs_url, status=rcode)
-        _util.log_debug("Unique response body", body=rcontent)
+        _util.log_response_body(body=rcontent)
 
         if "Request-Id" in rheaders:
             request_id = rheaders["Request-Id"]
@@ -230,11 +229,11 @@ class APIRequestor(object):
         )
 
         _util.log_info("Async request to Unique", method=method, path=abs_url)
-        _util.log_debug(
-            "Async request details",
+        _util.log_request_details(
             data=post_data,
             headers=headers,
             api_version=self.api_version,
+            message="Async request details",
         )
 
         rcontent, rcode, rheaders = await self._client.request_async(
@@ -242,7 +241,7 @@ class APIRequestor(object):
         )
 
         _util.log_info("Unique response", path=abs_url, status=rcode)
-        _util.log_debug("Unique response body", body=rcontent)
+        _util.log_response_body(body=rcontent)
 
         if "Request-Id" in rheaders:
             request_id = rheaders["Request-Id"]
@@ -364,7 +363,8 @@ class APIRequestor(object):
         except Exception as e:
             raise _error.APIError(
                 "Invalid response body from API: %s "
-                "(HTTP response code was %d)" % (rbody, rcode),
+                "(HTTP response code was %d)"
+                % (_util.redacted_body_for_error_message(rbody), rcode),
                 cast(bytes, rbody),
                 rcode,
                 rheaders,
@@ -399,7 +399,7 @@ class APIRequestor(object):
             error_code=status,
             error_type=error_data.get("type"),
             error_message=error_data.get("message"),
-            error_params=error_data.get("params"),
+            error_params=_util.redacted_error_params(error_data.get("params")),
         )
 
         error = cause.get("error", {}) if cause else {}

{unique_sdk-2026.32.0.dev6 → unique_sdk-2026.32.0.dev7}/unique_sdk/_util.py

@@ -9,6 +9,7 @@ import random
 import re
 import sys
 import time
+from collections.abc import Mapping
 from functools import wraps
 from typing import (
     Any,
@@ -33,6 +34,8 @@ UNIQUE_LOG = os.environ.get("UNIQUE_LOG")
 
 logger: logging.Logger = logging.getLogger("unique")
 
+_REDACTED = "<redacted>"
+
 
 def _console_log_level():
     if unique_sdk.log in ["debug", "info"]:
@@ -42,6 +45,42 @@ def _console_log_level():
     return None
 
 
+def _insecure_log_payloads_enabled() -> bool:
+    return os.environ.get("INSECURE_UNIQUE_SDK_LOG_PAYLOADS") == "true"
+
+
+def _payload_byte_size(value: Any) -> int:
+    if value is None:
+        return 0
+    if isinstance(value, (bytes, bytearray)):
+        return len(value)
+    if isinstance(value, str):
+        return len(value.encode("utf-8"))
+    return len(str(value).encode("utf-8"))
+
+
+def _headers_for_log(headers: Mapping[str, str] | None) -> dict[str, str] | str | None:
+    """Return headers for debug logs; Authorization is always redacted."""
+    if not _insecure_log_payloads_enabled():
+        return _REDACTED
+    if headers is None:
+        return None
+    try:
+        sanitized = dict(headers)
+    except (TypeError, ValueError):
+        return _REDACTED
+    for key in list(sanitized):
+        if str(key).lower() == "authorization":
+            sanitized[key] = _REDACTED
+    return sanitized
+
+
+def _body_for_log(body: Any) -> Any:
+    if _insecure_log_payloads_enabled():
+        return body
+    return _REDACTED
+
+
 def log_debug(message, **params):
     msg = logfmt(dict(message=message, **params))
     if _console_log_level() == "debug":
@@ -56,6 +95,65 @@ def log_info(message, **params):
     logger.info(msg)
 
 
+def log_request_details(
+    *,
+    data: Any,
+    headers: Mapping[str, str] | None,
+    api_version: str | None,
+    message: str = "Request details",
+) -> None:
+    if _insecure_log_payloads_enabled():
+        log_debug(
+            message,
+            data=data,
+            headers=_headers_for_log(headers),
+            api_version=api_version,
+        )
+        return
+    log_debug(
+        message,
+        data=_REDACTED,
+        headers=_REDACTED,
+        api_version=api_version,
+        payload_bytes=_payload_byte_size(data),
+    )
+
+
+def log_response_body(*, body: Any) -> None:
+    if _insecure_log_payloads_enabled():
+        log_debug("Unique response body", body=body)
+        return
+    log_debug(
+        "Unique response body",
+        body=_body_for_log(body),
+        payload_bytes=_payload_byte_size(body),
+    )
+
+
+def redacted_body_for_error_message(body: Any) -> Any:
+    """Body representation safe to embed in exception *messages*.
+
+    Exception messages surface at ERROR (retry logs, tracebacks) regardless
+    of LOG_LEVEL, so the raw body must not be embedded unless the insecure
+    opt-in is set. The full body stays available programmatically on the
+    exception's ``http_body`` attribute.
+    """
+    if _insecure_log_payloads_enabled():
+        return body
+    return f"<redacted {_payload_byte_size(body)} bytes>"
+
+
+def redacted_error_params(params: Any) -> Any:
+    """Error ``params`` for the INFO-level 'Unique error received' log.
+
+    API validation errors commonly echo submitted values in ``params``, so
+    they are redacted unless the insecure opt-in is set.
+    """
+    if params is None or _insecure_log_payloads_enabled():
+        return params
+    return _REDACTED
+
+
 def logfmt(props):
     def fmt(key, val):
         # Handle case where val is a bytes or bytesarray