unique-search-proxy 2026.26.0.dev10__tar.gz → 2026.26.0.dev12__tar.gz

{unique_search_proxy-2026.26.0.dev10 → unique_search_proxy-2026.26.0.dev12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: unique-search-proxy
-Version: 2026.26.0.dev10
+Version: 2026.26.0.dev12
 Summary: Web Search Proxy implementation
 Author: ThePhilAz
 Author-email: ThePhilAz <rami.azouz@philico.com>
@@ -19,7 +19,7 @@ Requires-Dist: certifi>=2025.11.12,<2027
 Requires-Dist: google-genai>=1.73.0,<2
 Requires-Dist: google-auth>=2.43.0,<3
 Requires-Dist: unique-toolkit[monitoring]>=2026.26.0.dev11,<2026.26.0rc0
-Requires-Dist: unique-search-proxy-core>=2026.26.0.dev6,<2026.26.0rc0
+Requires-Dist: unique-search-proxy-core>=2026.26.0.dev7,<2026.26.0rc0
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 

{unique_search_proxy-2026.26.0.dev10 → unique_search_proxy-2026.26.0.dev12}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "unique-search-proxy"
-version = "2026.26.0.dev10"
+version = "2026.26.0.dev12"
 description = "Web Search Proxy implementation"
 authors = [{ name = "ThePhilAz", email = "rami.azouz@philico.com" }]
 readme = "README.md"
@@ -21,7 +21,7 @@ dependencies = [
     "google-genai>=1.73.0,<2",
     "google-auth>=2.43.0,<3",
     "unique-toolkit[monitoring]>=2026.26.0.dev11,<2026.26.0rc0",
-    "unique-search-proxy-core>=2026.26.0.dev6,<2026.26.0rc0",
+    "unique-search-proxy-core>=2026.26.0.dev7,<2026.26.0rc0",
 ]
 
 [dependency-groups]

{unique_search_proxy-2026.26.0.dev10 → unique_search_proxy-2026.26.0.dev12}/unique_search_proxy_client/web/app.py

@@ -1,7 +1,7 @@
 from __future__ import annotations
 
 import logging
-import os
+import sys
 from contextlib import asynccontextmanager
 
 from dotenv import load_dotenv
@@ -13,22 +13,19 @@ from unique_search_proxy_client.web.api import health_router, v1_router
 from unique_search_proxy_client.web.core.client.service import create_http_client_pool
 from unique_search_proxy_client.web.core.providers import register_builtin_providers
 from unique_search_proxy_client.web.error_handlers import register_exception_handlers
+from unique_search_proxy_client.web.logging_config import (
+    build_logging_config,
+    configure_logging,
+)
 from unique_search_proxy_client.web.monitoring import setup_prometheus
+from unique_search_proxy_client.web.settings.startup_report import (
+    log_startup_settings_report,
+)
 
-load_dotenv()
+if "pytest" not in sys.modules:
+    load_dotenv()
 
-
-def _configure_logging() -> None:
-    level_name = os.getenv("LOG_LEVEL", "INFO").upper()
-    level = getattr(logging, level_name, logging.INFO)
-    logging.basicConfig(
-        level=level,
-        format="%(levelname)s %(name)s: %(message)s",
-        force=True,
-    )
-
-
-_configure_logging()
+configure_logging()
 suppress_httpx_request_logs()
 
 _LOGGER = logging.getLogger(__name__)
@@ -52,6 +49,7 @@ logging.getLogger("uvicorn.access").addFilter(HealthCheckFilter())
 @asynccontextmanager
 async def lifespan(app: FastAPI):
     _LOGGER.info("Starting Unique Search Proxy...")
+    log_startup_settings_report(_LOGGER)
     pool = await create_http_client_pool()
     app.state.http_client_pool = pool
     try:
@@ -95,4 +93,9 @@ app = create_app()
 if __name__ == "__main__":
     import uvicorn
 
-    uvicorn.run(app, host="0.0.0.0", port=2349)
+    uvicorn.run(
+        app,
+        host="0.0.0.0",
+        port=2349,
+        log_config=build_logging_config(),
+    )

{unique_search_proxy-2026.26.0.dev10 → unique_search_proxy-2026.26.0.dev12}/unique_search_proxy_client/web/core/agent_engines/vertexai/client.py

@@ -8,6 +8,7 @@ from google.auth import load_credentials_from_dict
 from google.genai._api_client import BaseApiClient
 from google.genai.client import AsyncClient
 
+from unique_search_proxy_client.web.settings.providers.base import read_secret
 from unique_search_proxy_client.web.settings.providers.vertexai_agent import (
     vertexai_agent_credentials,
 )
@@ -22,9 +23,9 @@ def _get_base_api_client_from_service_account() -> BaseApiClient:
         "https://www.googleapis.com/auth/cloud-platform",
     ]
     service_account_info = json.loads(
-        b64decode(vertexai_agent_credentials.service_account_credentials).decode(
-            "utf-8"
-        ),
+        b64decode(
+            read_secret(vertexai_agent_credentials.service_account_credentials)
+        ).decode("utf-8"),
     )
     credentials, project_id = load_credentials_from_dict(
         service_account_info,

{unique_search_proxy-2026.26.0.dev10 → unique_search_proxy-2026.26.0.dev12}/unique_search_proxy_client/web/core/client/service.py

@@ -14,6 +14,8 @@ from unique_search_proxy_client.web.settings.client import (
     ProxyConfig,
     http_client_settings,
 )
+from unique_search_proxy_client.web.settings.providers.base import read_secret
+from unique_search_proxy_client.web.settings.secret_str import read_secret_headers
 
 if TYPE_CHECKING:
     from fastapi import FastAPI
@@ -51,7 +53,8 @@ def _build_proxy_url_with_username_password(settings: HttpClientSettings) -> str
         raise ValueError("Proxy username and password are required")
     return (
         f"{settings.proxy_protocol}://"
-        f"{proxy_username}:{proxy_password}@{proxy_host}:{proxy_port}"
+        f"{read_secret(proxy_username)}:{read_secret(proxy_password)}"
+        f"@{proxy_host}:{proxy_port}"
     )
 
 
@@ -92,7 +95,7 @@ def _get_username_password_proxy_kwargs(settings: HttpClientSettings) -> ProxyCo
     )
     return ProxyConfig(
         proxy=proxy_url,
-        headers=settings.proxy_headers,
+        headers=read_secret_headers(settings.proxy_headers) or None,
         verify=settings.proxy_ssl_ca_bundle_path or True,
     )
 
@@ -104,7 +107,7 @@ def _get_ssl_tls_proxy_kwargs(settings: HttpClientSettings) -> ProxyConfig:
     return ProxyConfig(
         proxy=proxy_url,
         cert=cert_args,
-        headers=settings.proxy_headers,
+        headers=read_secret_headers(settings.proxy_headers) or None,
         verify=settings.proxy_ssl_ca_bundle_path or True,
     )
 

{unique_search_proxy-2026.26.0.dev10 → unique_search_proxy-2026.26.0.dev12}/unique_search_proxy_client/web/core/crawlers/firecrawl/service.py

@@ -25,6 +25,7 @@ from unique_search_proxy_client.web.core.provider_response import (
     upstream_error_message,
     upstream_response_raw,
 )
+from unique_search_proxy_client.web.settings.providers.base import read_secret
 from unique_search_proxy_client.web.settings.providers.firecrawl import (
     firecrawl_crawl_credentials as credentials,
 )
@@ -90,7 +91,7 @@ class FirecrawlCrawlerService(BaseCrawler[FirecrawlCrawlRequest]):
             response = await client.post(
                 credentials.scrape_endpoint,
                 json=body,
-                headers=_firecrawl_headers(credentials.api_key),
+                headers=_firecrawl_headers(read_secret(credentials.api_key)),
                 timeout=timeout,
             )
         except httpx.TimeoutException as exc:
@@ -149,7 +150,7 @@ class FirecrawlCrawlerService(BaseCrawler[FirecrawlCrawlRequest]):
             start_response = await client.post(
                 credentials.batch_scrape_endpoint,
                 json=body,
-                headers=_firecrawl_headers(credentials.api_key),
+                headers=_firecrawl_headers(read_secret(credentials.api_key)),
                 timeout=timeout,
             )
         except httpx.TimeoutException as exc:
@@ -200,7 +201,7 @@ class FirecrawlCrawlerService(BaseCrawler[FirecrawlCrawlRequest]):
             final_payload = await poll_batch_scrape(
                 client,
                 status_url=status_url,
-                api_key=credentials.api_key,
+                api_key=read_secret(credentials.api_key),
                 deadline=deadline,
             )
         except TimeoutError as exc:

{unique_search_proxy-2026.26.0.dev10 → unique_search_proxy-2026.26.0.dev12}/unique_search_proxy_client/web/core/crawlers/jina/service.py

@@ -18,6 +18,7 @@ from unique_search_proxy_client.web.core.provider_response import (
     transport_error_raw,
     upstream_response_raw,
 )
+from unique_search_proxy_client.web.settings.providers.base import read_secret
 from unique_search_proxy_client.web.settings.providers.jina import (
     jina_crawl_credentials as credentials,
 )
@@ -70,7 +71,7 @@ class JinaCrawlerService(BaseCrawler[JinaCrawlRequest]):
 
         urls = list(request.urls)
         timeout = request.timeout
-        headers = _jina_headers(credentials.api_key)
+        headers = _jina_headers(read_secret(credentials.api_key))
         semaphore = asyncio.Semaphore(request.max_concurrent_requests)
 
         async def crawl_one(url: str) -> CrawlUrlResult:

{unique_search_proxy-2026.26.0.dev10 → unique_search_proxy-2026.26.0.dev12}/unique_search_proxy_client/web/core/crawlers/tavily/service.py

@@ -19,6 +19,7 @@ from unique_search_proxy_client.web.core.provider_response import (
     upstream_error_message,
     upstream_response_raw,
 )
+from unique_search_proxy_client.web.settings.providers.base import read_secret
 from unique_search_proxy_client.web.settings.providers.tavily import (
     tavily_crawl_credentials as credentials,
 )
@@ -132,7 +133,7 @@ class TavilyCrawlerService(BaseCrawler[TavilyCrawlRequest]):
             response = await client.post(
                 credentials.extract_endpoint,
                 json=body,
-                headers=_tavily_headers(credentials.api_key),
+                headers=_tavily_headers(read_secret(credentials.api_key)),
                 timeout=timeout,
             )
         except httpx.TimeoutException as exc:

{unique_search_proxy-2026.26.0.dev10 → unique_search_proxy-2026.26.0.dev12}/unique_search_proxy_client/web/core/search_engines/brave/service.py

@@ -37,6 +37,7 @@ from unique_search_proxy_client.web.core.search_engines.pagination import PageRe
 from unique_search_proxy_client.web.core.search_engines.service_base import (
     SearchEngineService,
 )
+from unique_search_proxy_client.web.settings.providers.base import read_secret
 from unique_search_proxy_client.web.settings.providers.brave import (
     brave_search_credentials as credentials,
 )
@@ -71,7 +72,7 @@ class BraveSearchService(SearchEngineService[BraveSearchRequest]):
                 break
             page = await self._fetch_page(
                 request=request,
-                api_key=credentials.api_key,
+                api_key=read_secret(credentials.api_key),
                 api_endpoint=credentials.api_endpoint,
                 page=page_request,
                 timeout=timeout,

{unique_search_proxy-2026.26.0.dev10 → unique_search_proxy-2026.26.0.dev12}/unique_search_proxy_client/web/core/search_engines/google/service.py

@@ -37,6 +37,7 @@ from unique_search_proxy_client.web.core.search_engines.pagination import PageRe
 from unique_search_proxy_client.web.core.search_engines.service_base import (
     SearchEngineService,
 )
+from unique_search_proxy_client.web.settings.providers.base import read_secret
 from unique_search_proxy_client.web.settings.providers.google import (
     google_search_credentials as credentials,
 )
@@ -71,7 +72,7 @@ class GoogleSearchService(SearchEngineService[GoogleSearchRequest]):
         for page_request in iter_google_page_requests(fetch_size):
             page = await self._fetch_page(
                 request=request,
-                api_key=credentials.api_key,
+                api_key=read_secret(credentials.api_key),
                 search_engine_id=search_engine_id,
                 api_endpoint=credentials.api_endpoint,
                 page=page_request,

{unique_search_proxy-2026.26.0.dev10 → unique_search_proxy-2026.26.0.dev12}/unique_search_proxy_client/web/core/search_engines/perplexity/service.py

@@ -36,6 +36,7 @@ from unique_search_proxy_client.web.core.search_engines.service_base import (
 from unique_search_proxy_client.web.settings.providers import (
     perplexity_search_credentials as credentials,
 )
+from unique_search_proxy_client.web.settings.providers.base import read_secret
 
 _LOGGER = logging.getLogger(__name__)
 _PERPLEXITY_PROVIDER_LABEL = "Perplexity Search API"
@@ -67,7 +68,7 @@ class PerplexitySearchService(SearchEngineService[PerplexitySearchRequest]):
             response = await client.post(
                 credentials.api_endpoint,
                 json=body,
-                headers=_perplexity_headers(credentials.api_key),
+                headers=_perplexity_headers(read_secret(credentials.api_key)),
                 timeout=timeout,
             )
         except httpx.TimeoutException as exc:

unique_search_proxy-2026.26.0.dev12/unique_search_proxy_client/web/logging_config.py

@@ -0,0 +1,39 @@
+from __future__ import annotations
+
+import copy
+import logging
+import logging.config
+import os
+from typing import Any
+
+from uvicorn.config import LOG_LEVELS, LOGGING_CONFIG
+
+_APP_LOGGER_NAMES = (
+    "unique_search_proxy_client",
+    "unique_search_proxy_core",
+)
+
+
+def build_logging_config(log_level: str | None = None) -> dict[str, Any]:
+    """Extend Uvicorn's logging config with application loggers."""
+    level_key = (log_level or os.getenv("LOG_LEVEL", "info")).lower()
+    if level_key not in LOG_LEVELS:
+        level_key = "info"
+    level_name = level_key.upper()
+
+    config = copy.deepcopy(LOGGING_CONFIG)
+    for logger_name in _APP_LOGGER_NAMES:
+        config["loggers"][logger_name] = {
+            "handlers": ["default"],
+            "level": level_name,
+            "propagate": False,
+        }
+    config["loggers"]["uvicorn"]["level"] = level_name
+    config["loggers"]["uvicorn.error"]["level"] = level_name
+    config["loggers"]["uvicorn.access"]["level"] = level_name
+    return config
+
+
+def configure_logging(log_level: str | None = None) -> None:
+    """Configure app and Uvicorn loggers with Uvicorn's colored formatter."""
+    logging.config.dictConfig(build_logging_config(log_level))

{unique_search_proxy-2026.26.0.dev10 → unique_search_proxy-2026.26.0.dev12}/unique_search_proxy_client/web/settings/base.py

@@ -36,9 +36,8 @@ def _is_test_runtime() -> bool:
 
 def get_settings(cls: type[T], *, env_prefix: str) -> T:
     """Load a settings model from env; uses ``tests/test.env`` under pytest."""
-    config = _settings_config(env_prefix=env_prefix)
-    if _is_test_runtime():
-        config = _settings_config(env_prefix=env_prefix, test=True)
+    use_test_env = _is_test_runtime()
+    config = _settings_config(env_prefix=env_prefix, test=use_test_env)
 
     class Settings(cls):
         model_config = config

{unique_search_proxy-2026.26.0.dev10 → unique_search_proxy-2026.26.0.dev12}/unique_search_proxy_client/web/settings/client.py

@@ -1,9 +1,10 @@
 from typing import Literal
 
-from pydantic import BaseModel
+from pydantic import BaseModel, Field
 from pydantic_settings import BaseSettings
 
 from unique_search_proxy_client.web.settings.base import get_settings
+from unique_search_proxy_client.web.settings.secret_str import LogSecretStr
 
 HTTP_CLIENT_ENV_PREFIX = "HTTP_CLIENT_"
 
@@ -30,10 +31,10 @@ class HttpClientSettings(BaseSettings):
     proxy_protocol: ProxyProtocol = "http"
     proxy_host: str | None = None
     proxy_port: int | None = None
-    proxy_headers: dict[str, str] = {}
+    proxy_headers: dict[str, LogSecretStr] = Field(default_factory=dict)
     proxy_ssl_ca_bundle_path: str | None = None
-    proxy_username: str | None = None
-    proxy_password: str | None = None
+    proxy_username: LogSecretStr | None = None
+    proxy_password: LogSecretStr | None = None
     proxy_ssl_cert_path: str | None = None
     proxy_ssl_key_path: str | None = None
 

{unique_search_proxy-2026.26.0.dev10 → unique_search_proxy-2026.26.0.dev12}/unique_search_proxy_client/web/settings/providers/base.py

@@ -4,7 +4,7 @@ from collections.abc import Callable, Sequence
 from functools import lru_cache
 from typing import ClassVar, TypeVar
 
-from pydantic import BaseModel
+from pydantic import BaseModel, SecretStr
 from pydantic_settings import BaseSettings
 from unique_search_proxy_core.errors import EngineNotConfiguredError
 
@@ -36,10 +36,25 @@ def provider_credentials(env_prefix: str) -> Callable[[T], T]:
     return decorate
 
 
-def _is_secret_configured(value: str | None) -> bool:
+def read_secret(value: str | SecretStr | None) -> str:
     if value is None:
-        return False
-    normalized = value.strip()
+        return ""
+    if isinstance(value, SecretStr):
+        return value.get_secret_value()
+    return value
+
+
+def _field_has_not_provided_default(field_info: object) -> bool:
+    default = getattr(field_info, "default", None)
+    if default is NOT_PROVIDED:
+        return True
+    if isinstance(default, SecretStr):
+        return default.get_secret_value() == NOT_PROVIDED
+    return False
+
+
+def _is_secret_configured(value: str | SecretStr | None) -> bool:
+    normalized = read_secret(value).strip()
     if not normalized:
         return False
     return normalized != NOT_PROVIDED
@@ -53,7 +68,7 @@ def _iter_not_provided_credential_fields(model_cls: type[BaseModel]) -> tuple[st
     return tuple(
         name
         for name, field_info in model_cls.model_fields.items()
-        if field_info.default is NOT_PROVIDED
+        if _field_has_not_provided_default(field_info)
     )
 
 

{unique_search_proxy-2026.26.0.dev10 → unique_search_proxy-2026.26.0.dev12}/unique_search_proxy_client/web/settings/providers/brave.py

@@ -8,6 +8,7 @@ from unique_search_proxy_client.web.settings.providers.base import (
     ProviderCredentials,
     provider_credentials,
 )
+from unique_search_proxy_client.web.settings.secret_str import LogSecretStr
 
 _DEFAULT_BRAVE_API_ENDPOINT = "https://api.search.brave.com/res/v1/web/search"
 _ENV_PREFIX = "BRAVE_SEARCH_"
@@ -17,7 +18,7 @@ _ENV_PREFIX = "BRAVE_SEARCH_"
 class _BraveCredentials(ProviderCredentials):
     """Environment-backed credentials for Brave Web Search."""
 
-    api_key: str = Field(default=NOT_PROVIDED)
+    api_key: LogSecretStr = Field(default=LogSecretStr(NOT_PROVIDED))
     api_endpoint: str = Field(default=_DEFAULT_BRAVE_API_ENDPOINT)
 
 

{unique_search_proxy-2026.26.0.dev10 → unique_search_proxy-2026.26.0.dev12}/unique_search_proxy_client/web/settings/providers/firecrawl.py

@@ -10,6 +10,7 @@ from unique_search_proxy_client.web.settings.providers.base import (
     ProviderCredentials,
     provider_credentials,
 )
+from unique_search_proxy_client.web.settings.secret_str import LogSecretStr
 from unique_search_proxy_client.web.utils.url import join_url_path
 
 _FIRECRAWL_API_BASE = "https://api.firecrawl.dev"
@@ -28,7 +29,7 @@ _ENV_PREFIX = "FIRECRAWL_"
 class _FirecrawlCredentials(ProviderCredentials):
     """Environment-backed credentials for Firecrawl v2 APIs."""
 
-    api_key: str = Field(default=NOT_PROVIDED)
+    api_key: LogSecretStr = Field(default=LogSecretStr(NOT_PROVIDED))
     api_endpoint: str = Field(default=_FIRECRAWL_API_BASE)
     api_version: FirecrawlApiVersion = Field(default=_DEFAULT_FIRECRAWL_API_VERSION)
 

{unique_search_proxy-2026.26.0.dev10 → unique_search_proxy-2026.26.0.dev12}/unique_search_proxy_client/web/settings/providers/google.py

@@ -8,6 +8,7 @@ from unique_search_proxy_client.web.settings.providers.base import (
     ProviderCredentials,
     provider_credentials,
 )
+from unique_search_proxy_client.web.settings.secret_str import LogSecretStr
 
 _DEFAULT_GOOGLE_API_ENDPOINT = "https://www.googleapis.com/customsearch/v1"
 _ENV_PREFIX = "GOOGLE_SEARCH_"
@@ -17,7 +18,7 @@ _ENV_PREFIX = "GOOGLE_SEARCH_"
 class _GoogleCredentials(ProviderCredentials):
     """Environment-backed credentials for Google Custom Search."""
 
-    api_key: str = Field(default=NOT_PROVIDED)
+    api_key: LogSecretStr = Field(default=LogSecretStr(NOT_PROVIDED))
     api_endpoint: str = Field(default=_DEFAULT_GOOGLE_API_ENDPOINT)
     engine_id: str = Field(default=NOT_PROVIDED)
 

{unique_search_proxy-2026.26.0.dev10 → unique_search_proxy-2026.26.0.dev12}/unique_search_proxy_client/web/settings/providers/jina.py

@@ -10,6 +10,7 @@ from unique_search_proxy_client.web.settings.providers.base import (
     ProviderCredentials,
     provider_credentials,
 )
+from unique_search_proxy_client.web.settings.secret_str import LogSecretStr
 
 _JINA_DOMAIN = "jina.ai"
 _JINA_SUBDOMAINS: dict[str, dict[str, str]] = {
@@ -25,7 +26,7 @@ _ENV_PREFIX = "JINA_"
 class _JinaCredentials(ProviderCredentials):
     """Environment-backed credentials for Jina Reader and Search."""
 
-    api_key: str = Field(default=NOT_PROVIDED)
+    api_key: LogSecretStr = Field(default=LogSecretStr(NOT_PROVIDED))
     deployment: JinaDeployment = Field(default=_DEFAULT_JINA_DEPLOYMENT)
     api_domain: str = Field(default=_JINA_DOMAIN)
 

{unique_search_proxy-2026.26.0.dev10 → unique_search_proxy-2026.26.0.dev12}/unique_search_proxy_client/web/settings/providers/perplexity.py

@@ -8,6 +8,7 @@ from unique_search_proxy_client.web.settings.providers.base import (
     ProviderCredentials,
     provider_credentials,
 )
+from unique_search_proxy_client.web.settings.secret_str import LogSecretStr
 
 _DEFAULT_PERPLEXITY_API_ENDPOINT = "https://api.perplexity.ai/search"
 _ENV_PREFIX = "PERPLEXITY_SEARCH_"
@@ -17,7 +18,7 @@ _ENV_PREFIX = "PERPLEXITY_SEARCH_"
 class _PerplexityCredentials(ProviderCredentials):
     """Environment-backed credentials for Perplexity Search."""
 
-    api_key: str = Field(default=NOT_PROVIDED)
+    api_key: LogSecretStr = Field(default=LogSecretStr(NOT_PROVIDED))
     api_endpoint: str = Field(default=_DEFAULT_PERPLEXITY_API_ENDPOINT)
 
 

{unique_search_proxy-2026.26.0.dev10 → unique_search_proxy-2026.26.0.dev12}/unique_search_proxy_client/web/settings/providers/tavily.py

@@ -10,6 +10,7 @@ from unique_search_proxy_client.web.settings.providers.base import (
     ProviderCredentials,
     provider_credentials,
 )
+from unique_search_proxy_client.web.settings.secret_str import LogSecretStr
 from unique_search_proxy_client.web.utils.url import join_url_path
 
 _TAVILY_API_BASE = "https://api.tavily.com"
@@ -25,7 +26,7 @@ _ENV_PREFIX = "TAVILY_"
 class _TavilyCredentials(ProviderCredentials):
     """Environment-backed credentials for Tavily APIs."""
 
-    api_key: str = Field(default=NOT_PROVIDED)
+    api_key: LogSecretStr = Field(default=LogSecretStr(NOT_PROVIDED))
     api_endpoint: str = Field(default=_TAVILY_API_BASE)
 
     def _endpoint(self, operation: TavilyOperation) -> str:

{unique_search_proxy-2026.26.0.dev10 → unique_search_proxy-2026.26.0.dev12}/unique_search_proxy_client/web/settings/providers/vertexai_agent.py

@@ -7,6 +7,7 @@ from unique_search_proxy_client.web.settings.providers.base import (
     ProviderCredentials,
     provider_credentials,
 )
+from unique_search_proxy_client.web.settings.secret_str import LogSecretStr
 
 _ENV_PREFIX = "VERTEXAI_AGENT_"
 
@@ -15,7 +16,7 @@ _ENV_PREFIX = "VERTEXAI_AGENT_"
 class _VertexAIAgentCredentials(ProviderCredentials):
     """Environment-backed credentials for Vertex AI grounding (Google GenAI)."""
 
-    service_account_credentials: str | None = Field(default=None)
+    service_account_credentials: LogSecretStr | None = Field(default=None)
     service_account_scopes: list[str] | None = Field(default=None)
 
 

unique_search_proxy-2026.26.0.dev12/unique_search_proxy_client/web/settings/secret_str.py

@@ -0,0 +1,41 @@
+from __future__ import annotations
+
+from collections.abc import Mapping
+
+from pydantic import SecretStr
+
+_NOT_PROVIDED = "NOT_PROVIDED"
+
+
+def _secret_log_suffix_len() -> int:
+    from unique_search_proxy_client.web.settings.startup_log import (
+        startup_log_settings,
+    )
+
+    return startup_log_settings.secret_suffix_len
+
+
+def _mask_secret_for_display(value: str) -> str:
+    if not value:
+        return ""
+    if value == _NOT_PROVIDED:
+        return _NOT_PROVIDED
+    suffix_len = _secret_log_suffix_len()
+    if suffix_len <= 0:
+        return "*" * 10
+    # 20% of the value length is the max suffix length
+    if len(value) * 0.10 <= suffix_len:
+        return "*" * 10
+    return f"**********{value[-suffix_len:]}"
+
+
+class LogSecretStr(SecretStr):
+    """SecretStr that masks values in str()/repr() with a configurable suffix."""
+
+    def _display(self) -> str:
+        return _mask_secret_for_display(self._secret_value)
+
+
+def read_secret_headers(headers: Mapping[str, LogSecretStr]) -> dict[str, str]:
+    """Unwrap proxy header secrets for httpx."""
+    return {name: value.get_secret_value() for name, value in headers.items()}

unique_search_proxy-2026.26.0.dev12/unique_search_proxy_client/web/settings/startup_log.py

@@ -0,0 +1,29 @@
+from __future__ import annotations
+
+from pydantic import Field
+from pydantic_settings import BaseSettings
+
+from unique_search_proxy_client.web.settings.base import get_settings
+
+STARTUP_LOG_ENV_PREFIX = "STARTUP_LOG_"
+
+
+class StartupLogSettings(BaseSettings):
+    """Startup log formatting options."""
+
+    secret_suffix_len: int = Field(
+        default=0,
+        ge=0,
+        le=32,
+        description=(
+            "Number of trailing characters to show when logging secret values "
+            "at startup (0 hides the secret entirely)."
+        ),
+    )
+
+
+def _get_startup_log_settings() -> StartupLogSettings:
+    return get_settings(StartupLogSettings, env_prefix=STARTUP_LOG_ENV_PREFIX)
+
+
+startup_log_settings = _get_startup_log_settings()

unique_search_proxy-2026.26.0.dev12/unique_search_proxy_client/web/settings/startup_report.py

@@ -0,0 +1,138 @@
+from __future__ import annotations
+
+import logging
+import os
+from collections import defaultdict
+from collections.abc import Iterable
+
+from pydantic import BaseModel
+from unique_search_proxy_core.url_safety.settings import url_safety_settings
+
+from unique_search_proxy_client.web.settings.client import http_client_settings
+from unique_search_proxy_client.web.settings.monitoring import prometheus_settings
+from unique_search_proxy_client.web.settings.providers.base import (
+    _field_has_not_provided_default,
+    _is_secret_configured,
+)
+from unique_search_proxy_client.web.settings.providers.bing_agent import (
+    bing_agent_credentials,
+)
+from unique_search_proxy_client.web.settings.providers.brave import (
+    brave_search_credentials,
+)
+from unique_search_proxy_client.web.settings.providers.firecrawl import (
+    firecrawl_crawl_credentials,
+)
+from unique_search_proxy_client.web.settings.providers.google import (
+    google_search_credentials,
+)
+from unique_search_proxy_client.web.settings.providers.jina import (
+    jina_crawl_credentials,
+)
+from unique_search_proxy_client.web.settings.providers.perplexity import (
+    perplexity_search_credentials,
+)
+from unique_search_proxy_client.web.settings.providers.tavily import (
+    tavily_crawl_credentials,
+)
+from unique_search_proxy_client.web.settings.providers.vertexai_agent import (
+    vertexai_agent_credentials,
+)
+
+_LOGGER = logging.getLogger(__name__)
+
+SettingsGroup = tuple[str, BaseModel, str]
+
+
+def _env_var_name(field_name: str, env_prefix: str) -> str:
+    return f"{env_prefix}{field_name.upper()}"
+
+
+def _field_status(
+    model: BaseModel,
+    field_name: str,
+    env_prefix: str,
+) -> str:
+    value = getattr(model, field_name)
+    field_info = model.model_fields[field_name]
+    env_var = _env_var_name(field_name, env_prefix)
+
+    if _field_has_not_provided_default(field_info):
+        return "configured" if _is_secret_configured(value) else "missing"
+
+    if value is None:
+        return "unset"
+
+    if env_var in os.environ:
+        return "set"
+
+    return "default"
+
+
+def _group_fields_by_status(
+    model: BaseModel,
+    env_prefix: str,
+) -> dict[str, list[str]]:
+    grouped: dict[str, list[str]] = defaultdict(list)
+    for field_name in model.model_fields:
+        env_var = _env_var_name(field_name, env_prefix)
+        status = _field_status(model, field_name, env_prefix)
+        grouped[status].append(env_var)
+    return grouped
+
+
+def _group_summary(grouped: dict[str, list[str]]) -> str:
+    missing = grouped.get("missing", [])
+    if missing:
+        return f"incomplete ({len(missing)} missing)"
+    return "ready"
+
+
+def _format_settings_value(value: object) -> str:
+    if isinstance(value, dict):
+        if not value:
+            return "{}"
+        pairs = ", ".join(f"{key!r}: {secret}" for key, secret in value.items())
+        return "{" + pairs + "}"
+    return str(value)
+
+
+def _format_group(title: str, model: BaseModel, env_prefix: str) -> list[str]:
+    grouped = _group_fields_by_status(model, env_prefix)
+    lines = [f"  [{title}] {_group_summary(grouped)}"]
+    for field_name in model.model_fields:
+        env_var = _env_var_name(field_name, env_prefix)
+        value = getattr(model, field_name)
+        lines.append(f"    {env_var}={_format_settings_value(value)}")
+    return lines
+
+
+def _settings_groups() -> Iterable[SettingsGroup]:
+    return (
+        ("Google Search", google_search_credentials, "GOOGLE_SEARCH_"),
+        ("Brave Search", brave_search_credentials, "BRAVE_SEARCH_"),
+        ("Perplexity Search", perplexity_search_credentials, "PERPLEXITY_SEARCH_"),
+        ("Bing Agent", bing_agent_credentials, "BING_AGENT_"),
+        ("VertexAI Agent", vertexai_agent_credentials, "VERTEXAI_AGENT_"),
+        ("Tavily", tavily_crawl_credentials, "TAVILY_"),
+        ("Jina", jina_crawl_credentials, "JINA_"),
+        ("Firecrawl", firecrawl_crawl_credentials, "FIRECRAWL_"),
+        ("HTTP Client", http_client_settings, "HTTP_CLIENT_"),
+        ("Prometheus", prometheus_settings, "PROMETHEUS_"),
+        ("URL Safety", url_safety_settings, "URL_SAFETY_"),
+    )
+
+
+def build_startup_settings_report() -> str:
+    """Build a multi-line startup settings summary for logging."""
+    lines = ["Search Proxy settings at startup:"]
+    for title, model, env_prefix in _settings_groups():
+        lines.extend(_format_group(title, model, env_prefix))
+    lines.append(f"  [Runtime] LOG_LEVEL={os.getenv('LOG_LEVEL', 'INFO')}")
+    return "\n".join(lines)
+
+
+def log_startup_settings_report(logger: logging.Logger | None = None) -> None:
+    """Log configured vs missing/default env-backed settings at pod startup."""
+    log = logger or _LOGGER
+    log.info("%s", build_startup_settings_report())