fix(enphase): keep livestream credentials out of the log

The livestream bootstrap response carries aws_token_value and aws_digest,
the live credentials for the account's AWS IoT stream. Debug API logging
redacted only token/auth_token/access_token, so both were written out in
full - and Predbat logs are routinely shared for debugging. The endpoint
and topic are still logged so the call stays diagnosable.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: springfall2008

apps/predbat/enphase.py

@@ -1625,7 +1625,9 @@ def _log_api_call(self, method, path, params, status, json_data, text):
             return
         if isinstance(json_data, dict):
             redacted = dict(json_data)
-            for key in ("token", "auth_token", "access_token"):
+            # aws_token_value/aws_digest are the livestream's AWS IoT credentials - short-lived,
+            # but Predbat logs get shared for debugging, so they must never be written out.
+            for key in ("token", "auth_token", "access_token", "aws_token_value", "aws_digest"):
                 if key in redacted:
                     redacted[key] = "***redacted***"
             preview = json.dumps(redacted, default=str)

apps/predbat/tests/test_enphase_api.py

@@ -982,6 +982,31 @@ def test_log_api_call_redacts_token():
     assert captured == []
 
 
+def test_log_api_call_redacts_livestream_credentials():
+    """The livestream bootstrap's token and signature must never reach the log.
+
+    Predbat logs are routinely shared for debugging, and this response carries live credentials
+    for the account's AWS IoT stream.
+    """
+    api = MockEnphaseAPI()
+    captured = []
+    api.log = lambda message: captured.append(message)
+    api.debug_api = True
+    api._log_api_call(
+        "GET",
+        "/pv/aws_sigv4/livestream.json",
+        {"serial_num": "122530006866"},
+        200,
+        {"aws_token_value": "token-must-not-be-logged", "aws_digest": "signature-must-not-be-logged", "aws_iot_endpoint": "iot.example.com", "live_stream_topic": "v1/live-stream/abc123"},
+        "",
+    )
+    assert "token-must-not-be-logged" not in captured[0]
+    assert "signature-must-not-be-logged" not in captured[0]
+    # Non-secret fields are still logged, so the call remains diagnosable
+    assert "iot.example.com" in captured[0]
+    assert "v1/live-stream/abc123" in captured[0]
+
+
 def test_login_dedupes_sites():
     """Duplicate sites in the search response collapse to a single entry (no double-publish)."""
     api = MockEnphaseAPI()
@@ -1977,6 +2002,7 @@ def run_enphase_api_tests(my_predbat):
     test_get_battery_status_handles_na()
     test_reads_handle_na_values()
     test_log_api_call_redacts_token()
+    test_log_api_call_redacts_livestream_credentials()
     test_login_dedupes_sites()
     test_run_single_site_publishes_once()
     test_run_no_battery_returns_false_without_raising()