Harden endpoint sanitization in backend auth logging (apply to both strategies)

[mdanish98]

Background

Follow-up from the Copilot review on PR #38. Three inline comments flagged logging-safety issues in backend_auth.py. All are low-severity, log-only (no impact on auth correctness), and the endpoint values come from trusted operator-set env vars rather than user input — so none blocked PR #38.

Crucially, as the PR author (@kolyaopahle) noted, the flagged code is copied verbatim from the pre-existing TokenExchangeStrategy. Fixing it in ClientCredentialsStrategy alone would create an inconsistency. This issue tracks fixing it consistently in both strategies (and the shared factory).

Items to address

1. _safe_endpoint sanitizer doesn't handle IPv6 hosts and keeps query/fragment

The current construction in build_backend_token_provider() (both the token_exchange and client_credentials branches):

netloc=_parsed.hostname + (f":{_parsed.port}" if _parsed.port else "")

• IPv6: urlparse('https://[::1]:8080/tok').hostname returns ::1 without brackets, so the reassembled URL becomes https://::1:8080/... — malformed. Wrap IPv6 hosts in brackets.
• Query/fragment: _replace(netloc=...) preserves .query and .fragment, so a 'safe' endpoint can still surface sensitive query params. Strip them for the log form.
• Ref: Add client credential based authentication strategy #38 (comment)

2. RuntimeError messages interpolate the raw token endpoint URL

The error messages in both strategies' get_token() embed the full endpoint. The factory already produces a sanitized _safe_endpoint for its info log — the runtime errors should use the same sanitized form for consistency.

• Refs: Add client credential based authentication strategy #38 (comment) and Add client credential based authentication strategy #38 (comment)

3. logger.debug lines include the full endpoint

The debug logs in both strategies' get_token() include the raw endpoint. Use the sanitized form (or log only host/path).

Suggested approach

• Extract a single _sanitize_endpoint_for_logging(url) helper that: validates the URL, brackets IPv6 hosts, preserves scheme + host + port + path, and drops userinfo, query, and fragment.
• Use it in both TokenExchangeStrategy and ClientCredentialsStrategy — for debug logs and for the RuntimeError messages — and in the factory's info logs.
• Add a small unit test covering IPv6 hosts and URLs carrying query params.

Priority

Low. Log-only hardening; trusted-input endpoints make real-world exposure unlikely. Grouped here so all three Copilot comments are resolved once, across both strategies.

Related

• PR Add client credential based authentication strategy #38 (Copilot review comments)
• Enhancing Security and Auth Flows for Different IASs #9 (Enhancing Security and Auth Flows)
• Add per-subject token caching to TokenExchangeStrategy #40, Revisit backend auth strategy configuration mechanism (scalability) #41 (other PR Add client credential based authentication strategy #38 follow-ups)