security: redact Xiaomi auth logs

mi-fitness-python/src/mi_fitness/auth/_helpers.py

@@ -116,11 +116,7 @@ async def extract_credentials(
         service_token = await extract_service_token(http, location)
         token.service_token = service_token
 
-    logger.debug(
-        "凭证提取完成, ssecurity={}, user_id={}",
-        token.ssecurity[:8] + "...",
-        token.user_id,
-    )
+    logger.debug("凭证提取完成, user_id={}", token.user_id)
 
 
 async def async_sleep(seconds: float) -> None:

mi-fitness-python/src/mi_fitness/auth/qr.py

@@ -67,9 +67,9 @@ async def login_qr(
         await qr_callback(qr_image_url, login_url)
     else:
         logger.info("请使用小米账号 APP 扫描二维码登录")
-        logger.info("二维码图片: {}", qr_image_url)
+        logger.info("二维码图片已获取")
         if login_url:
-            logger.info("或在浏览器打开: {}", login_url)
+            logger.info("浏览器登录链接已获取")
 
     # Step 2: 长轮询等待扫码
     effective_timeout = min(float(qr_timeout), max_wait)

mi-fitness-python/src/mi_fitness/auth/sts.py

@@ -2,8 +2,8 @@
 
 from __future__ import annotations
 
-import time
 import os
+import time
 
 from loguru import logger
 
@@ -46,10 +46,6 @@ async def sts_exchange(http: RetryAsyncClient, token: AuthToken) -> None:
         resp = await http.get(STS_HEALTH_URL, params=params, cookies=cookies)
         if resp.text.strip() == "ok":
             logger.debug("STS 交换成功")
-            # Extract STS serviceToken from cookies and save it to AuthToken
-            logger.debug("Куки в клиенте во время STS:")
-            for cookie in http.cookies.jar:
-                logger.debug(f"  Cookie: {cookie.name}, Domain: {cookie.domain}, Value: {cookie.value[:15]}...")
             sts_token = None
             for cookie in http.cookies.jar:
                 if cookie.name == "serviceToken" and "hlth.io.mi.com" in (cookie.domain or ""):
@@ -57,10 +53,10 @@ async def sts_exchange(http: RetryAsyncClient, token: AuthToken) -> None:
                     break
             if not sts_token:
                 sts_token = http.cookies.get("serviceToken")
-            
+
             if sts_token:
                 token.service_token = sts_token
-                logger.debug("STS serviceToken успешно сохранен в AuthToken: {}", sts_token[:15] + "...")
+                logger.debug("STS serviceToken успешно сохранен в AuthToken")
         else:
             logger.warning("STS 交换响应: {}", resp.text[:100])
     except Exception as e:

mi-fitness-python/src/mi_fitness/cli.py

@@ -48,9 +48,9 @@ async def _qr_login() -> None:
         print("\n📱 请用小米账号 APP 扫描二维码登录\n")
         if login_url:
             _print_qr_to_terminal(login_url)
-        print(f"\n   二维码图片: {qr_image_url}")
-        if login_url:
-            print(f"   浏览器打开: {login_url}")
+        elif qr_image_url:
+            _print_qr_to_terminal(qr_image_url)
+        print("\n   登录二维码已显示在终端；URL 不会打印。")
         print("\n⏳ 等待扫码...\n")
 
     async with XiaomiAuth() as auth: