Harden URL redaction in inventory/review failure output (Issue #171)

tests/test_audit.py

@@ -59,6 +59,33 @@ class TestRedaction(unittest.TestCase):
         self.assertEqual(gitea_audit.redact(42), 42)
         self.assertIsNone(gitea_audit.redact(None))
 
+    def test_redacts_urls(self):
+        # 1. Real service URLs are completely redacted
+        self.assertEqual(
+            gitea_audit._redact_str("failed for http://gitea.prgs.cc/api/v1/repos/x"),
+            "failed for [REDACTED_URL]"
+        )
+        # 2. Hostname is redacted even without full URL prefix
+        self.assertEqual(
+            gitea_audit._redact_str("error contacting gitea.prgs.cc directly"),
+            "error contacting [REDACTED_HOST] directly"
+        )
+        # 3. Synthetic test-only URLs are preserved
+        self.assertEqual(
+            gitea_audit._redact_str("mock URL: https://gitea.example.com/api/v1/repos/x"),
+            "mock URL: https://gitea.example.com/api/v1/repos/x"
+        )
+        # 4. Embedded credentials in synthetic URLs are redacted
+        self.assertEqual(
+            gitea_audit._redact_str("mock creds: https://user:[email protected]/path"),
+            "mock creds: https://[REDACTED_USER]:[REDACTED_PASS]@example.com/path"
+        )
+        # 5. Query secrets in synthetic URLs are redacted
+        self.assertEqual(
+            gitea_audit._redact_str("mock query: https://localhost:3003/api?token=abc-123&other=val"),
+            "mock query: https://localhost:3003/api?token=%5BREDACTED%5D&other=val"
+        )
+
 
 class TestBuildEvent(unittest.TestCase):