fix(cli): mask query tokens in uvicorn access log

tests/test_auth_query_token.py

@@ -1,5 +1,6 @@
 """``require_token`` accepts ``?token=`` only when no auth header is present."""
 
+import logging
 from types import SimpleNamespace
 
 import pytest
@@ -57,3 +58,20 @@ async def test_bootstrap_entry_can_carry_a_scope() -> None:
     assert admin is not None and admin.scope == "*"
     assert hook is not None and hook.scope == "api" and hook.name == "komodo"
     assert not hook.allows("admin") and hook.allows("api")
+
+
+def test_access_log_filter_masks_query_tokens() -> None:
+    from beaver_gateway.cli import ScrubQueryTokens
+
+    record = logging.LogRecord(
+        "uvicorn.access",
+        logging.INFO,
+        __file__,
+        1,
+        '%s - "%s %s HTTP/%s" %d',
+        ("1.2.3.4:1", "POST", "/hooks/komodo?token=s3cret&x=1", "1.1", 202),
+        None,
+    )
+    assert ScrubQueryTokens().filter(record)
+    assert "s3cret" not in record.getMessage()
+    assert "/hooks/komodo?token=<…>&x=1" in record.getMessage()