DM-44606: Change passwords to SecretStr

requirements/main.in

@@ -22,10 +22,10 @@ jinja2
 psycopg2
 pydantic
 pydantic-settings
-safir[db,gcs]>=5.2.1
+#safir[db,gcs]>=5.2.1
 sqlalchemy[asyncio]
 structlog
 
 # Uncomment this, change the branch, comment out safir above, and run make
 # update-deps-no-hashes to test against an unreleased version of Safir.
-# safir[db,gcs] @ git+https://github.com/lsst-sqre/safir@main
+safir[db,gcs] @ git+https://github.com/lsst-sqre/safir@main

requirements/tox.txt

@@ -1,235 +1,92 @@
 # This file was autogenerated by uv via the following command:
-#    uv pip compile --generate-hashes --output-file requirements/tox.txt requirements/tox.in
-cachetools==5.3.3 \
-    --hash=sha256:0abad1021d3f8325b2fc1d2e9c8b9c9d57b04c3932657a72465447332c24d945 \
-    --hash=sha256:ba29e2dfa0b8b556606f097407ed1aa62080ee108ab0dc5ec9d6a723a007d105
+#    uv pip compile --output-file requirements/tox.txt requirements/tox.in
+cachetools==5.3.3
     # via
     #   -c requirements/dev.txt
     #   -c requirements/main.txt
     #   tox
-certifi==2024.2.2 \
-    --hash=sha256:0569859f95fc761b18b45ef421b1290a0f65f147e92a1e5eb3e635f9a5e4e66f \
-    --hash=sha256:dc383c07b76109f368f6106eee2b593b04a011ea4d55f652c6ca24a754d1cdd1
+certifi==2024.2.2
     # via
     #   -c requirements/dev.txt
     #   -c requirements/main.txt
     #   requests
-chardet==5.2.0 \
-    --hash=sha256:1b3b6ff479a8c414bc3fa2c0852995695c4a026dcd6d0633b2dd092ca39c1cf7 \
-    --hash=sha256:e1cf59446890a00105fe7b7912492ea04b6e6f06d4b742b2c788469e34c82970
+chardet==5.2.0
     # via
     #   -c requirements/dev.txt
     #   tox
-charset-normalizer==3.3.2 \
-    --hash=sha256:06435b539f889b1f6f4ac1758871aae42dc3a8c0e24ac9e60c2384973ad73027 \
-    --hash=sha256:06a81e93cd441c56a9b65d8e1d043daeb97a3d0856d177d5c90ba85acb3db087 \
-    --hash=sha256:0a55554a2fa0d408816b3b5cedf0045f4b8e1a6065aec45849de2d6f3f8e9786 \
-    --hash=sha256:0b2b64d2bb6d3fb9112bafa732def486049e63de9618b5843bcdd081d8144cd8 \
-    --hash=sha256:10955842570876604d404661fbccbc9c7e684caf432c09c715ec38fbae45ae09 \
-    --hash=sha256:122c7fa62b130ed55f8f285bfd56d5f4b4a5b503609d181f9ad85e55c89f4185 \
-    --hash=sha256:1ceae2f17a9c33cb48e3263960dc5fc8005351ee19db217e9b1bb15d28c02574 \
-    --hash=sha256:1d3193f4a680c64b4b6a9115943538edb896edc190f0b222e73761716519268e \
-    --hash=sha256:1f79682fbe303db92bc2b1136016a38a42e835d932bab5b3b1bfcfbf0640e519 \
-    --hash=sha256:2127566c664442652f024c837091890cb1942c30937add288223dc895793f898 \
-    --hash=sha256:22afcb9f253dac0696b5a4be4a1c0f8762f8239e21b99680099abd9b2b1b2269 \
-    --hash=sha256:25baf083bf6f6b341f4121c2f3c548875ee6f5339300e08be3f2b2ba1721cdd3 \
-    --hash=sha256:2e81c7b9c8979ce92ed306c249d46894776a909505d8f5a4ba55b14206e3222f \
-    --hash=sha256:3287761bc4ee9e33561a7e058c72ac0938c4f57fe49a09eae428fd88aafe7bb6 \
-    --hash=sha256:34d1c8da1e78d2e001f363791c98a272bb734000fcef47a491c1e3b0505657a8 \
-    --hash=sha256:37e55c8e51c236f95b033f6fb391d7d7970ba5fe7ff453dad675e88cf303377a \
-    --hash=sha256:3d47fa203a7bd9c5b6cee4736ee84ca03b8ef23193c0d1ca99b5089f72645c73 \
-    --hash=sha256:3e4d1f6587322d2788836a99c69062fbb091331ec940e02d12d179c1d53e25fc \
-    --hash=sha256:42cb296636fcc8b0644486d15c12376cb9fa75443e00fb25de0b8602e64c1714 \
-    --hash=sha256:45485e01ff4d3630ec0d9617310448a8702f70e9c01906b0d0118bdf9d124cf2 \
-    --hash=sha256:4a78b2b446bd7c934f5dcedc588903fb2f5eec172f3d29e52a9096a43722adfc \
-    --hash=sha256:4ab2fe47fae9e0f9dee8c04187ce5d09f48eabe611be8259444906793ab7cbce \
-    --hash=sha256:4d0d1650369165a14e14e1e47b372cfcb31d6ab44e6e33cb2d4e57265290044d \
-    --hash=sha256:549a3a73da901d5bc3ce8d24e0600d1fa85524c10287f6004fbab87672bf3e1e \
-    --hash=sha256:55086ee1064215781fff39a1af09518bc9255b50d6333f2e4c74ca09fac6a8f6 \
-    --hash=sha256:572c3763a264ba47b3cf708a44ce965d98555f618ca42c926a9c1616d8f34269 \
-    --hash=sha256:573f6eac48f4769d667c4442081b1794f52919e7edada77495aaed9236d13a96 \
-    --hash=sha256:5b4c145409bef602a690e7cfad0a15a55c13320ff7a3ad7ca59c13bb8ba4d45d \
-    --hash=sha256:6463effa3186ea09411d50efc7d85360b38d5f09b870c48e4600f63af490e56a \
-    --hash=sha256:65f6f63034100ead094b8744b3b97965785388f308a64cf8d7c34f2f2e5be0c4 \
-    --hash=sha256:663946639d296df6a2bb2aa51b60a2454ca1cb29835324c640dafb5ff2131a77 \
-    --hash=sha256:6897af51655e3691ff853668779c7bad41579facacf5fd7253b0133308cf000d \
-    --hash=sha256:68d1f8a9e9e37c1223b656399be5d6b448dea850bed7d0f87a8311f1ff3dabb0 \
-    --hash=sha256:6ac7ffc7ad6d040517be39eb591cac5ff87416c2537df6ba3cba3bae290c0fed \
-    --hash=sha256:6b3251890fff30ee142c44144871185dbe13b11bab478a88887a639655be1068 \
-    --hash=sha256:6c4caeef8fa63d06bd437cd4bdcf3ffefe6738fb1b25951440d80dc7df8c03ac \
-    --hash=sha256:6ef1d82a3af9d3eecdba2321dc1b3c238245d890843e040e41e470ffa64c3e25 \
-    --hash=sha256:753f10e867343b4511128c6ed8c82f7bec3bd026875576dfd88483c5c73b2fd8 \
-    --hash=sha256:7cd13a2e3ddeed6913a65e66e94b51d80a041145a026c27e6bb76c31a853c6ab \
-    --hash=sha256:7ed9e526742851e8d5cc9e6cf41427dfc6068d4f5a3bb03659444b4cabf6bc26 \
-    --hash=sha256:7f04c839ed0b6b98b1a7501a002144b76c18fb1c1850c8b98d458ac269e26ed2 \
-    --hash=sha256:802fe99cca7457642125a8a88a084cef28ff0cf9407060f7b93dca5aa25480db \
-    --hash=sha256:80402cd6ee291dcb72644d6eac93785fe2c8b9cb30893c1af5b8fdd753b9d40f \
-    --hash=sha256:8465322196c8b4d7ab6d1e049e4c5cb460d0394da4a27d23cc242fbf0034b6b5 \
-    --hash=sha256:86216b5cee4b06df986d214f664305142d9c76df9b6512be2738aa72a2048f99 \
-    --hash=sha256:87d1351268731db79e0f8e745d92493ee2841c974128ef629dc518b937d9194c \
-    --hash=sha256:8bdb58ff7ba23002a4c5808d608e4e6c687175724f54a5dade5fa8c67b604e4d \
-    --hash=sha256:8c622a5fe39a48f78944a87d4fb8a53ee07344641b0562c540d840748571b811 \
-    --hash=sha256:8d756e44e94489e49571086ef83b2bb8ce311e730092d2c34ca8f7d925cb20aa \
-    --hash=sha256:8f4a014bc36d3c57402e2977dada34f9c12300af536839dc38c0beab8878f38a \
-    --hash=sha256:9063e24fdb1e498ab71cb7419e24622516c4a04476b17a2dab57e8baa30d6e03 \
-    --hash=sha256:90d558489962fd4918143277a773316e56c72da56ec7aa3dc3dbbe20fdfed15b \
-    --hash=sha256:923c0c831b7cfcb071580d3f46c4baf50f174be571576556269530f4bbd79d04 \
-    --hash=sha256:95f2a5796329323b8f0512e09dbb7a1860c46a39da62ecb2324f116fa8fdc85c \
-    --hash=sha256:96b02a3dc4381e5494fad39be677abcb5e6634bf7b4fa83a6dd3112607547001 \
-    --hash=sha256:9f96df6923e21816da7e0ad3fd47dd8f94b2a5ce594e00677c0013018b813458 \
-    --hash=sha256:a10af20b82360ab00827f916a6058451b723b4e65030c5a18577c8b2de5b3389 \
-    --hash=sha256:a50aebfa173e157099939b17f18600f72f84eed3049e743b68ad15bd69b6bf99 \
-    --hash=sha256:a981a536974bbc7a512cf44ed14938cf01030a99e9b3a06dd59578882f06f985 \
-    --hash=sha256:a9a8e9031d613fd2009c182b69c7b2c1ef8239a0efb1df3f7c8da66d5dd3d537 \
-    --hash=sha256:ae5f4161f18c61806f411a13b0310bea87f987c7d2ecdbdaad0e94eb2e404238 \
-    --hash=sha256:aed38f6e4fb3f5d6bf81bfa990a07806be9d83cf7bacef998ab1a9bd660a581f \
-    --hash=sha256:b01b88d45a6fcb69667cd6d2f7a9aeb4bf53760d7fc536bf679ec94fe9f3ff3d \
-    --hash=sha256:b261ccdec7821281dade748d088bb6e9b69e6d15b30652b74cbbac25e280b796 \
-    --hash=sha256:b2b0a0c0517616b6869869f8c581d4eb2dd83a4d79e0ebcb7d373ef9956aeb0a \
-    --hash=sha256:b4a23f61ce87adf89be746c8a8974fe1c823c891d8f86eb218bb957c924bb143 \
-    --hash=sha256:bd8f7df7d12c2db9fab40bdd87a7c09b1530128315d047a086fa3ae3435cb3a8 \
-    --hash=sha256:beb58fe5cdb101e3a055192ac291b7a21e3b7ef4f67fa1d74e331a7f2124341c \
-    --hash=sha256:c002b4ffc0be611f0d9da932eb0f704fe2602a9a949d1f738e4c34c75b0863d5 \
-    --hash=sha256:c083af607d2515612056a31f0a8d9e0fcb5876b7bfc0abad3ecd275bc4ebc2d5 \
-    --hash=sha256:c180f51afb394e165eafe4ac2936a14bee3eb10debc9d9e4db8958fe36afe711 \
-    --hash=sha256:c235ebd9baae02f1b77bcea61bce332cb4331dc3617d254df3323aa01ab47bd4 \
-    --hash=sha256:cd70574b12bb8a4d2aaa0094515df2463cb429d8536cfb6c7ce983246983e5a6 \
-    --hash=sha256:d0eccceffcb53201b5bfebb52600a5fb483a20b61da9dbc885f8b103cbe7598c \
-    --hash=sha256:d965bba47ddeec8cd560687584e88cf699fd28f192ceb452d1d7ee807c5597b7 \
-    --hash=sha256:db364eca23f876da6f9e16c9da0df51aa4f104a972735574842618b8c6d999d4 \
-    --hash=sha256:ddbb2551d7e0102e7252db79ba445cdab71b26640817ab1e3e3648dad515003b \
-    --hash=sha256:deb6be0ac38ece9ba87dea880e438f25ca3eddfac8b002a2ec3d9183a454e8ae \
-    --hash=sha256:e06ed3eb3218bc64786f7db41917d4e686cc4856944f53d5bdf83a6884432e12 \
-    --hash=sha256:e27ad930a842b4c5eb8ac0016b0a54f5aebbe679340c26101df33424142c143c \
-    --hash=sha256:e537484df0d8f426ce2afb2d0f8e1c3d0b114b83f8850e5f2fbea0e797bd82ae \
-    --hash=sha256:eb00ed941194665c332bf8e078baf037d6c35d7c4f3102ea2d4f16ca94a26dc8 \
-    --hash=sha256:eb6904c354526e758fda7167b33005998fb68c46fbc10e013ca97f21ca5c8887 \
-    --hash=sha256:eb8821e09e916165e160797a6c17edda0679379a4be5c716c260e836e122f54b \
-    --hash=sha256:efcb3f6676480691518c177e3b465bcddf57cea040302f9f4e6e191af91174d4 \
-    --hash=sha256:f27273b60488abe721a075bcca6d7f3964f9f6f067c8c4c605743023d7d3944f \
-    --hash=sha256:f30c3cb33b24454a82faecaf01b19c18562b1e89558fb6c56de4d9118a032fd5 \
-    --hash=sha256:fb69256e180cb6c8a894fee62b3afebae785babc1ee98b81cdf68bbca1987f33 \
-    --hash=sha256:fd1abc0d89e30cc4e02e4064dc67fcc51bd941eb395c502aac3ec19fab46b519 \
-    --hash=sha256:ff8fa367d09b717b2a17a052544193ad76cd49979c805768879cb63d9ca50561
+charset-normalizer==3.3.2
     # via
     #   -c requirements/dev.txt
     #   -c requirements/main.txt
     #   requests
-colorama==0.4.6 \
-    --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \
-    --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6
+colorama==0.4.6
     # via
     #   -c requirements/dev.txt
     #   tox
-distlib==0.3.8 \
-    --hash=sha256:034db59a0b96f8ca18035f36290806a9a6e6bd9d1ff91e45a7f172eb17e51784 \
-    --hash=sha256:1530ea13e350031b6312d8580ddb6b27a104275a31106523b8f123787f494f64
+distlib==0.3.8
     # via
     #   -c requirements/dev.txt
     #   virtualenv
-docker==7.1.0 \
-    --hash=sha256:ad8c70e6e3f8926cb8a92619b832b4ea5299e2831c14284663184e200546fa6c \
-    --hash=sha256:c96b93b7f0a746f9e77d325bcfb87422a3d8bd4f03136ae8a85b37f1898d5fc0
+docker==7.1.0
     # via tox-docker
-filelock==3.14.0 \
-    --hash=sha256:43339835842f110ca7ae60f1e1c160714c5a6afd15a2873419ab185334975c0f \
-    --hash=sha256:6ea72da3be9b8c82afd3edcf99f2fffbb5076335a5ae4d03248bb5b6c3eae78a
+filelock==3.14.0
     # via
     #   -c requirements/dev.txt
     #   tox
     #   virtualenv
-idna==3.7 \
-    --hash=sha256:028ff3aadf0609c1fd278d8ea3089299412a7a8b9bd005dd08b9f8285bcb5cfc \
-    --hash=sha256:82fee1fc78add43492d3a1898bfa6d8a904cc97d8427f683ed8e798d07761aa0
+idna==3.7
     # via
     #   -c requirements/dev.txt
     #   -c requirements/main.txt
     #   requests
-packaging==24.0 \
-    --hash=sha256:2ddfb553fdf02fb784c234c7ba6ccc288296ceabec964ad2eae3777778130bc5 \
-    --hash=sha256:eb82c5e3e56209074766e6885bb04b8c38a0c015d0a30036ebe7ece34c9989e9
+packaging==24.0
     # via
     #   -c requirements/dev.txt
     #   -c requirements/main.txt
     #   pyproject-api
     #   tox
     #   tox-uv
-platformdirs==4.2.2 \
-    --hash=sha256:2d7a1657e36a80ea911db832a8a6ece5ee53d8de21edd5cc5879af6530b1bfee \
-    --hash=sha256:38b7b51f512eed9e84a22788b4bce1de17c0adb134d6becb09836e37d8654cd3
+platformdirs==4.2.2
     # via
     #   -c requirements/dev.txt
     #   tox
     #   virtualenv
-pluggy==1.5.0 \
-    --hash=sha256:2cffa88e94fdc978c4c574f15f9e59b7f4201d439195c3715ca9e2486f1d0cf1 \
-    --hash=sha256:44e1ad92c8ca002de6377e165f3e0f1be63266ab4d554740532335b9d75ea669
+pluggy==1.5.0
     # via
     #   -c requirements/dev.txt
     #   tox
-pyproject-api==1.6.1 \
-    --hash=sha256:1817dc018adc0d1ff9ca1ed8c60e1623d5aaca40814b953af14a9cf9a5cae538 \
-    --hash=sha256:4c0116d60476b0786c88692cf4e325a9814965e2469c5998b830bba16b183675
+pyproject-api==1.6.1
     # via
     #   -c requirements/dev.txt
     #   tox
-requests==2.32.3 \
-    --hash=sha256:55365417734eb18255590a9ff9eb97e9e1da868d4ccd6402399eaf68af20a760 \
-    --hash=sha256:70761cfe03c773ceb22aa2f671b4757976145175cdfca038c02654d061d6dcc6
+requests==2.32.3
     # via
     #   -c requirements/dev.txt
     #   -c requirements/main.txt
     #   docker
-tox==4.15.0 \
-    --hash=sha256:300055f335d855b2ab1b12c5802de7f62a36d4fd53f30bd2835f6a201dda46ea \
-    --hash=sha256:7a0beeef166fbe566f54f795b4906c31b428eddafc0102ac00d20998dd1933f6
+tox==4.15.0
     # via
     #   -c requirements/dev.txt
     #   -r requirements/tox.in
     #   tox-docker
     #   tox-uv
-tox-docker==5.0.0 \
-    --hash=sha256:3cbfe70713910b9dbb9f74e20a5c42f19da42d375bac7d6a3ccc11aed0738d7a \
-    --hash=sha256:7dd7293ea286dff422eab6c23a70652147b275eb436c02e97a90ac59ba41f8a8
+tox-docker==5.0.0
     # via -r requirements/tox.in
-tox-uv==1.9.0 \
-    --hash=sha256:1a2e49ea5aac1c4e83513b863169fa47ce1479fdb0aaac2ab09d35e9a9635f84 \
-    --hash=sha256:ff2300be19acc14b15580a3a06806ef36cbb952e124c8a478c6f3d59f768b122
+tox-uv==1.9.0
     # via
     #   -c requirements/dev.txt
     #   -r requirements/tox.in
-urllib3==2.2.1 \
-    --hash=sha256:450b20ec296a467077128bff42b73080516e71b56ff59a60a02bef2232c4fa9d \
-    --hash=sha256:d0570876c61ab9e520d776c38acbbb5b05a776d3f9ff98a5c8fd5162a444cf19
+urllib3==2.2.1
     # via
     #   -c requirements/dev.txt
     #   -c requirements/main.txt
     #   docker
     #   requests
-uv==0.2.5 \
-    --hash=sha256:041b1ee240fc36606dcea2a68369c7db29eb0ea75dc15d33f74ed6485a7d3aa2 \
-    --hash=sha256:14f5ca36f8873d272a715250b3d602815924742a5f184e1400826fb967fd371e \
-    --hash=sha256:1e0b790a2367c8ebdd1a3eb2aca87ae393c5536021fbc37f97c36e5454cb2875 \
-    --hash=sha256:1ec01d0505e2d56cebad02b7565db5b1e61ad97c4eeca751c4816bfe8261ea28 \
-    --hash=sha256:541c8ee1369232c7be8bde2165175b08ddfa1cae6d0d31ffca9993fa83b64634 \
-    --hash=sha256:5b2f56c0219c9ee37da702d824ae3bffd7d023184824e6fdaacac8b435624784 \
-    --hash=sha256:5ffb593256d69623071c248348e6fe101aae806944da68e3b597c377444e022f \
-    --hash=sha256:650f81439c4f65e86fdba84f2cbb6700a074b95d70c5cc3d38e8ce2b87e43a45 \
-    --hash=sha256:6b977b3d83b7bb48ccc0ef568f1be73f45ff0bc53ff9ba1e33b4c883027feec9 \
-    --hash=sha256:6cedb8bfabd59ab56e781297dc6c66a298cfa912da16a4da9439274681c39622 \
-    --hash=sha256:7a4e793419993967183633afb2cfd9c4a7c4c5134f01af8c8aa25bf9520ff1db \
-    --hash=sha256:7fb8c35694de30186140adddc8498222c8728b00edde25ddc7c93c3dee69644c \
-    --hash=sha256:a55c5b1bf948d439a40f4d959be853f7441923c6b324e4d423116fda2cb277da \
-    --hash=sha256:b64372e90c6e921efbcca82113bc6a8f86a5a6ba8695f8c1d2dd215b7989b2a3 \
-    --hash=sha256:d7f24e33253e0b60faf4dd76849f0e0e710f30229f205eaaa94660b8626d6636 \
-    --hash=sha256:d879d0c436ad9289ff1ad39112a0b53bf5b99ec69d3d300e55d18864b4ed3291 \
-    --hash=sha256:ff1c8fe7d54dd3051bab529f715e562994d19e038822ce99acd903cbbf8d0cd0
+uv==0.2.5
     # via
     #   -c requirements/dev.txt
     #   tox-uv
-virtualenv==20.26.2 \
-    --hash=sha256:82bf0f4eebbb78d36ddaee0283d43fe5736b53880b8a8cdcd37390a07ac3741c \
-    --hash=sha256:a624db5e94f01ad993d476b9ee5346fdf7b9de43ccaee0e0197012dc838a0e9b
+virtualenv==20.26.2
     # via
     #   -c requirements/dev.txt
     #   tox

src/vocutouts/broker.py

@@ -49,7 +49,7 @@ def before_worker_boot(self, broker: Broker, worker: Worker) -> None:
         if worker_session is None:
             logger = structlog.get_logger("vocutouts")
             worker_session = create_sync_session(
-                str(config.database_url),
+                config.database_url,
                 config.database_password,
                 logger,
                 isolation_level="REPEATABLE READ",

src/vocutouts/cli.py

@@ -47,8 +47,7 @@ async def init(*, reset: bool) -> None:
     """Initialize the database storage."""
     logger = structlog.get_logger("vocutouts")
     engine = create_database_engine(
-        str(config.database_url),
-        config.database_password,
+        config.database_url, config.database_password
     )
     await initialize_database(
         engine, logger, schema=Base.metadata, reset=reset

src/vocutouts/config.py

@@ -8,7 +8,14 @@
 from typing import Annotated, TypeAlias
 from urllib.parse import urlparse, urlunparse
 
-from pydantic import Field, PostgresDsn, RedisDsn, TypeAdapter, field_validator
+from pydantic import (
+    Field,
+    PostgresDsn,
+    RedisDsn,
+    SecretStr,
+    TypeAdapter,
+    field_validator,
+)
 from pydantic_settings import BaseSettings, SettingsConfigDict
 from safir.logging import LogLevel, Profile
 
@@ -44,7 +51,7 @@ class Config(BaseSettings):
         description="DSN of PostgreSQL database for UWS job tracking",
     )
 
-    database_password: str | None = Field(
+    database_password: SecretStr | None = Field(
         None, title="Password for UWS job database"
     )
 
@@ -61,7 +68,7 @@ class Config(BaseSettings):
         ),
     )
 
-    redis_password: str | None = Field(
+    redis_password: SecretStr | None = Field(
         None,
         title="Password for Redis server",
         description=(
@@ -173,7 +180,7 @@ def uws_config(self) -> UWSConfig:
         return UWSConfig(
             execution_duration=self.timeout,
             lifetime=self.lifetime,
-            database_url=str(self.database_url),
+            database_url=self.database_url,
             database_password=self.database_password,
             redis_url=self.redis_url,
             redis_password=self.redis_password,

src/vocutouts/uws/config.py

@@ -5,6 +5,8 @@
 from dataclasses import dataclass
 from datetime import timedelta
 
+from pydantic import SecretStr
+
 __all__ = ["UWSConfig"]
 
 
@@ -49,10 +51,10 @@ class encapsulates the configuration of the UWS component that may vary by
     with this email.
     """
 
-    database_password: str | None = None
+    database_password: SecretStr | None = None
     """Password for the database."""
 
-    redis_password: str | None = None
+    redis_password: SecretStr | None = None
     """Password for the Redis server used by Dramatiq."""
 
     url_lifetime: timedelta = timedelta(minutes=15)

tests/conftest.py

@@ -62,7 +62,7 @@ async def app() -> AsyncIterator[FastAPI]:
     broker.flush_all()
     broker.emit_after("process_boot")
     engine = create_database_engine(
-        str(config.database_url), config.database_password
+        config.database_url, config.database_password
     )
     await initialize_database(engine, logger, schema=Base.metadata, reset=True)
     await engine.dispose()

tests/handlers/error_test.py

@@ -23,7 +23,7 @@ async def test_uncaught_error(client: AsyncClient) -> None:
     # no meaningful information and no exception traceback due a bug in
     # swallowing errors in subapps.
     engine = create_database_engine(
-        str(config.database_url), config.database_password
+        config.database_url, config.database_password
     )
     async with engine.begin() as conn:
         await conn.run_sync(Base.metadata.drop_all)

tests/support/uws.py

@@ -14,6 +14,7 @@
 from dramatiq.middleware import CurrentMessage, Middleware
 from dramatiq.results import Results
 from dramatiq.results.backends import StubBackend
+from pydantic import SecretStr
 from safir.database import create_sync_session
 from safir.datetime import current_datetime, isodatetime, parse_isodatetime
 from sqlalchemy.future import select
@@ -155,7 +156,7 @@ def build_uws_config() -> UWSConfig:
         execution_duration=timedelta(minutes=10),
         lifetime=timedelta(days=1),
         database_url=database_url,
-        database_password=os.getenv("CUTOUT_DATABASE_PASSWORD"),
+        database_password=SecretStr(os.environ["CUTOUT_DATABASE_PASSWORD"]),
         redis_url=redis_url,
         redis_password=None,
         signing_service_account="",