From 96672a459db425be92c1cdbf59a8932037207432 Mon Sep 17 00:00:00 2001
From: Afonso Jorge Ramos <afonsojorgeramos@gmail.com>
Date: Sun, 12 Jul 2026 23:32:24 +0200
Subject: [PATCH] fix(log): stop logging Last.fm auth token prefixes

Request-token material must never appear in support log bundles.
---
 crates/qbz-integrations/src/lastfm/client.rs | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/crates/qbz-integrations/src/lastfm/client.rs b/crates/qbz-integrations/src/lastfm/client.rs
index 57695099e..717095231 100644
--- a/crates/qbz-integrations/src/lastfm/client.rs
+++ b/crates/qbz-integrations/src/lastfm/client.rs
@@ -100,10 +100,9 @@ impl LastFmClient {
     ///
     /// Call this after the user has visited the auth_url from `get_token`.
     pub async fn get_session(&mut self, token: &str) -> IntegrationResult<LastFmSession> {
-        log::info!(
-            "Getting Last.fm session with token: {}...",
-            &token[..token.len().min(8)]
-        );
+        // Never log request-token material (even a prefix) — support log
+        // bundles must not carry auth substrings.
+        log::info!("Requesting Last.fm session");
 
         let url = format!("{}/auth.getSession", LASTFM_PROXY_URL);