Avoid logging async request payloads

Author: marandaneto

posthog/async_request.py

@@ -94,7 +94,7 @@ async def async_post(
     url = trimmed_host + cast(str, path)
     body["api_key"] = api_key
     data: str | bytes = json.dumps(body, cls=DatetimeSerializer)
-    log.debug("making async request: %s to url: %s", data, url)
+    log.debug("making async request to url: %s", url)
     headers = {"Content-Type": "application/json", "User-Agent": USER_AGENT}
     if gzip:
         try:
@@ -167,7 +167,7 @@ def _process_async_response(
 
     try:
         payload = _response_json(res)
-        log.debug("received response: %s", payload)
+        log.debug("received response with status: %s", res.status_code)
         raise APIError(res.status_code, payload["detail"], retry_after=retry_after)
     except (KeyError, ValueError):
         raise APIError(res.status_code, _response_text(res), retry_after=retry_after)

posthog/test/test_async_request.py

@@ -0,0 +1,53 @@
+from __future__ import annotations
+
+import logging
+
+import pytest
+
+from posthog.async_request import async_post, _process_async_response
+from posthog.request import APIError
+
+
+class FakeAsyncClient:
+    async def post(self, *args, **kwargs):
+        return FakeResponse(200, {"ok": True})
+
+
+class FakeResponse:
+    def __init__(self, status_code, payload):
+        self.status_code = status_code
+        self._payload = payload
+        self.headers = {}
+        self.text = str(payload)
+
+    def json(self):
+        return self._payload
+
+
+@pytest.mark.asyncio
+async def test_async_post_debug_log_does_not_include_payload_or_api_key(caplog):
+    caplog.set_level(logging.DEBUG, logger="posthog")
+
+    await async_post(
+        "test-secret-key",
+        "https://example.com",
+        "/batch/",
+        client=FakeAsyncClient(),
+        batch=[{"properties": {"password": "super-secret"}}],
+    )
+
+    logs = caplog.text
+    assert "making async request to url: https://example.com/batch/" in logs
+    assert "test-secret-key" not in logs
+    assert "super-secret" not in logs
+
+
+def test_process_async_response_debug_log_does_not_include_response_payload(caplog):
+    caplog.set_level(logging.DEBUG, logger="posthog")
+
+    with pytest.raises(APIError):
+        _process_async_response(FakeResponse(400, {"detail": "password=secret"}), "ok")
+
+    logs = caplog.text
+    assert "received response with status: 400" in logs
+    assert "password=secret" not in logs