fix: redact password in database URI when logging

[jeremycline]

Hi,

I think this is a bit of a niche fix since I imagine not tons of people self-host and perhaps it's something those who are running servers do want, so I won't be the least bit bothered if this isn't merged.

Previously, in the event that there was a configuration issue and the atuin server failed to connect to PostgreSQL, it would log the database URI including the password.

For example, if the password authentication failed the following log message would be printed:

Error: failed to connect to db: PostgresSettings { db_uri: "postgres://atuin:definitelymypassword@db.example.com/atuin" }

This change sets the password to "****" when printing it via Debug:

Error: failed to connect to db: PostgresSettings { db_uri: "postgres://atuin:****@db.example.com/atuin" }

Hopefully few people use **** as the actual password.

Checks

• I am happy for maintainers to push small adjustments to this PR, to speed up the review cycle
• I have checked that there are no existing pull requests for the same thing

[tessus]

LGTM.

I have also often seen that the length of the password is kept (just the characters are replaced by *), but the current solution is more secure as it doesn't allow to infer the password length. 👍

Some people also deem the username, hostname, and db name as privileged information, but unless you work for one of the 3 or 4 letter gov orgs, there is no need to entertain that. ;-)

Edit: Can you maybe add the following to your comment above: fixes #2020

[ellie]

Looks good, thank you! 🥳

Seeing as this is your first time contributing, if you would like a holographic contributors-only Atuin sticker, then please fill out this form!

We do also have a Discord if you'd like to ask any questions, or just fancy hanging out!