From b7e91112543018b3fc37b5ba20533a1ff324f92f Mon Sep 17 00:00:00 2001
From: kronecker <2026692687@qq.com>
Date: Fri, 9 Oct 2026 07:55:15 +0800
Subject: [PATCH] fix(messaging): suppress credential-bearing transport logs

---
 .../src/kf_oj/infra/messaging/publisher.py    |  3 ++
 backend/tests/test_outbox.py                  | 28 +++++++++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/backend/src/kf_oj/infra/messaging/publisher.py b/backend/src/kf_oj/infra/messaging/publisher.py
index 558dab3..07d8a18 100644
--- a/backend/src/kf_oj/infra/messaging/publisher.py
+++ b/backend/src/kf_oj/infra/messaging/publisher.py
@@ -67,6 +67,9 @@ class OutboxRepository:
 
 class ConfirmedBroker:
     def __init__(self, url):
+        # Parent disabled does not suppress descendant loggers; set their inherited level.
+        for name in ("aio_pika", "aiormq", "pamqp"):
+            logging.getLogger(name).setLevel(logging.CRITICAL)
         self.url = url
         self.connection = None
         self.channel = None
diff --git a/backend/tests/test_outbox.py b/backend/tests/test_outbox.py
index 5ad1b68..541f6f9 100644
--- a/backend/tests/test_outbox.py
+++ b/backend/tests/test_outbox.py
@@ -217,3 +217,31 @@ asyncio.run(main())
     finally:
         await broker.close()
         await connection.close()
+
+
+def test_actual_transport_failure_does_not_log_connection_credentials(caplog):
+    """Local protocol refusal exercises descendant client loggers without a broker/DB."""
+
+    async def refused_connection():
+        touched = asyncio.Event()
+
+        async def refuse(reader, writer):
+            touched.set()
+            writer.close()
+            await writer.wait_closed()
+
+        listener = await asyncio.start_server(refuse, "127.0.0.1", 0)
+        port = listener.sockets[0].getsockname()[1]
+        broker = ConfirmedBroker(f"amqp://fixture:private-sentinel@127.0.0.1:{port}/")
+        try:
+            with pytest.raises(aio_pika.exceptions.AMQPConnectionError):
+                await broker.publish((uuid4(), uuid4(), uuid4()))
+            assert touched.is_set(), "must reach actual local transport refusal"
+        finally:
+            await broker.close()
+            listener.close()
+            await listener.wait_closed()
+
+    asyncio.run(refused_connection())
+    assert "private-sentinel" not in caplog.text
+    assert "amqp://" not in caplog.text