fix(db): do not log the database password

src/database/session.py

@@ -8,8 +8,9 @@
 logger = logging.getLogger(__name__)
 
 connection_string = settings.database.assemble_db_connection(async_=True)
-logger.debug(f"Database connection string: {connection_string}")
 async_engine = create_async_engine(connection_string, poolclass=NullPool)
+# repr() of a SQLAlchemy URL masks the password.
+logger.debug(f"Database URL: {async_engine.url!r}")
 AsyncSessionLocal: async_sessionmaker[AsyncSession] = async_sessionmaker(
     async_engine, autoflush=True, expire_on_commit=False, class_=AsyncSession
 )

tests/src/database/test_session.py

@@ -0,0 +1,16 @@
+import importlib
+import logging
+
+from src.core import settings
+from src.database import session
+
+
+def test_creating_the_engine_does_not_log_the_password(caplog, monkeypatch):
+    # The alembic migration tests call logging.config.fileConfig, which disables existing loggers.
+    monkeypatch.setattr(logging.getLogger("src.database.session"), "disabled", False)
+    monkeypatch.setattr(settings.database, "PASSWORD", "not-in-the-logs")
+
+    with caplog.at_level(logging.DEBUG):
+        importlib.reload(session)
+
+    assert "not-in-the-logs" not in caplog.text