chore(logging): bring redactPii() coverage and tests up to date with current log sites

[ten9876]

Summary

redactPii() in src/core/AsyncLogWriter.cpp has grown one regex at a time as log sites were added. Its coverage and its tests should be brought in line with the fields the app now logs, and the rule set should be easier to extend than hand-written lookbehinds.

Follow-up from the review discussion on #5130 (the exe= path line), which noted that the redactor has no rule for filesystem paths and that the existing path-logging sites predate it.

Scope

Rules to add, each with a case in tests/async_log_writer_test.cpp:

• Home-directory prefix → ~ (handle both slash styles on Windows, and a /home/<user> or C:\Users\<user> segment when QDir::homePath() differs from the path's actual root, e.g. Flatpak or elevated runs)
• IPv6 literals, same last-group treatment as the IPv4 rule
• Email addresses (SmartLinkClient currently truncates by hand at the call site; move the guarantee into the redactor)
• user <name> / username= style fields (see IcomSession.cpp control-stream login line)
• Hostnames following connecting to / connected to / pin for keywords (WanConnection, MqttClient, PgxlConnection)
• Maidenhead grid fields alongside the existing lat/lon rule

Structure:

• Replace the per-rule regex literals with a small {keyword, keep-prefix} table the patterns are generated from, mirroring how SettingsSanitizer keys off SettingsCredentialPolicy, so a new field is one table row and one test
• Negative corpus test: feed a fixture of representative status/protocol lines (Flex status, SmartLink WAN frames, MQTT, Icom login) through the redactor and assert none of the fixture values survive
• Short section in docs/ listing what the redactor does and does not scrub, so reviewers can check a new log site against it

Not in scope

• Changing any individual log site; the fix belongs in the redactor so existing sites are covered together
• SettingsSanitizer (already policy-driven)

Verification

• async_log_writer_test and issue_report_test pass with the new cases
• A support bundle generated on a Windows per-user install shows ~\AppData\... for the feat(tci): log the process behind local TCI clients. Principle VIII. #5130 exe= line

[Ozy311]

Additional logging-redaction audit at main e60c3bea2ac8e5b762be9a3c6f52aa1bab8fb9ad (Codex, on behalf of @Ozy311). The current checklist is useful, but the following gaps should be included or explicitly tracked as follow-ups.

Credential leaks to prioritize

• Icom control-packet hex dumps contain session authentication material. IcomStream.cpp:338–340 logs the first 64 bytes of every non-ping inbound datagram when that debug category is enabled. Login, renewal and stream-grant parsers extract the six-byte AuthId at offset 0x1a, inside that logged prefix (codec). A synthetic renewal reply accepted by the production parser retained all six planted auth bytes after production redactPii(). A keyword table will not identify these hex bytes. Suppress/sanitize authentication-bearing packet dumps before formatting, retaining safe packet metadata, and add a socket-free regression. This requires an explicit exception to the “no individual log-site changes” scope, or a separate prioritized fix.
• Cover passwords/API keys and complete credential values, including short ones. Current rules omit password, passwd, api_key/apiKey and the credential names already recorded in SettingsCredentialPolicy (without changing SettingsSanitizer). token=abcd survives completely; token=abcde+AuditTail/123= becomes token=abcd***REDACTED***+AuditTail/123=. Basic credentials containing +// leak suffixes too; Digest parameter lists are only partially consumed. Test punctuation, padding, whitespace inside quoted values, lengths 1–4, and complete Basic/Digest headers. Fully remove secrets; do not retain a prefix that can equal the entire short secret.
• Cover plain JSON and Qt-escaped JSON, not only protocol key=value text. MqttClient.cpp logs arbitrary payloads through QDebug's QByteArray formatting (also at publish, line 256). A fixture formatted using real QDebug left access_token, first_name, latitude and grid_square values intact. Plain {"access_token":"AuditJsonSecret"} also survives. Generate fixtures through Qt formatting, including escaped quotes/backslashes and truncated values; do not rely solely on hand-written unescaped strings.
• URLs need credential-aware handling. RemoteAsrBackend.cpp:43 logs the configured URL verbatim. URL userinfo, private hostname and credential query values all survived a synthetic URL probe. Network-error messages are another path: QRZ login puts username/password in the URL and logs errorString(). Include percent-encoded values and endpoint-specific session parameters (QRZ uses s); avoid a global bare s= rule.

Expand the existing PII cases

• Hostname contexts also include reconnecting to, disconnected from, connect to … timed out, URL authorities, and the bare host before a socket error. Examples: MqttClient line 27 and GreenHeronModel lines 159–205. Test quoted names, single-label LAN names and host/port separation.
• Grid rules need whitespace-separated grid <value> as actually logged by FreeDvClient line 525, plus grid_square/camelCase variants and quoted/Qt-escaped forms. Existing coordinate-pair handling also misses location="47.6205,-122.3493". Preserve the existing intentional callsign/model/firmware policy and avoid treating ordinary prose as a grid field.
• Path fixtures should include macOS /Users/<name>, Windows names containing spaces, both native and Qt-doubled backslashes, different process/user home roots, and home-prefix boundary checks. IPv6 fixtures should include compressed forms, bracketed ports, IPv4-mapped addresses and %scope suffixes; ensure rule ordering cannot expose part of an address after IPv4/MAC processing.

Output boundaries requiring a scope decision

• Historical support logs are copied without re-scrubbing. SupportBundle.cpp:109–129 copies up to three existing logs with QFile::copy. A new capture-time rule does not protect older logs included after upgrading. Re-scrub into the bundle destination while preserving source logs; test an archive containing a planted pre-fix log. IssueReport already re-scrubs its tail at rendering.
• SpotHub files bypass AsyncLogWriter. DxClusterClient.cpp writes raw outbound commands; lines 126 and 258 write the host and received lines directly. Startup commands pass through the same function. Other direct feed writers include N1MMSpotClient, SpotCollectorClient, WsjtxClient and FreeDvClient. Inventory their guarantees explicitly and route sensitive diagnostic writes through shared sanitization. These are separate feed logs, not the timestamped logs currently bundled; their contents are not fixed by modifying redactPii() alone.

Verification to add

Exercise the negative corpus through actual writer output, mirrored stderr, issue-report rendering and bundle export; verify repeated redaction is idempotent and diagnostic fields remain readable. The automation log-event serializer already invokes redactPii() on egress. Document startup/fallback stderr, raw binary diagnostics, arbitrary user-authored text and direct feed files as limitations until covered. Do not claim all project logs are sanitized solely from a passing redactor unit test.

Observed validation: built and ran the existing async_log_writer_test (33 checks) and issue_report_test (23 checks) against the current production sources in an isolated macOS Qt Core harness; both passed. Separate socket-free production-code probes reproduced the leaks above, including Qt-formatted MQTT JSON and an accepted Icom auth reply. No live radio traffic, real credentials, Windows support-bundle run, or source changes were used. This is an audit/scope addition, not an implemented fix.