Avoid leaking Immich API key in error logs (#173541)

homeassistant/components/immich/coordinator.py

@@ -119,7 +119,7 @@ class ImmichDataUpdateCoordinator(DataUpdateCoordinator[ImmichData]):
             raise UpdateFailed(
                 translation_domain=DOMAIN,
                 translation_key="update_error",
-                translation_placeholders={"error": repr(err)},
+                translation_placeholders={"error": str(err)},
             ) from err
 
         return ImmichData(

tests/components/immich/test_sensor.py

@@ -2,8 +2,11 @@
 
 from unittest.mock import Mock, patch
 
+from aiohttp import ContentTypeError, RequestInfo
+from multidict import CIMultiDict, CIMultiDictProxy
 import pytest
 from syrupy.assertion import SnapshotAssertion
+from yarl import URL
 
 from homeassistant.const import Platform
 from homeassistant.core import HomeAssistant
@@ -43,3 +46,32 @@ async def test_admin_sensors(
     assert hass.states.get("sensor.mock_title_videos_count") is None
     assert hass.states.get("sensor.mock_title_disk_used_by_photos") is None
     assert hass.states.get("sensor.mock_title_disk_used_by_videos") is None
+
+
+async def test_update_error_does_not_leak_api_key(
+    hass: HomeAssistant,
+    mock_immich: Mock,
+    mock_config_entry: MockConfigEntry,
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    """Test that API key is not leaked in error logs on connection failure."""
+    await setup_integration(hass, mock_config_entry)
+
+    api_key = "SECRET_API_KEY_12345"
+    headers = CIMultiDictProxy(
+        CIMultiDict({"x-api-key": api_key, "Host": "example.com"})
+    )
+    request_info = RequestInfo(
+        url=URL("https://example.com/api/server/about"),
+        method="GET",
+        headers=headers,
+        real_url=URL("https://example.com/api/server/about"),
+    )
+    mock_immich.server.async_get_about_info.side_effect = ContentTypeError(
+        request_info, (), status=503, message="Service Unavailable"
+    )
+
+    await hass.config_entries.async_reload(mock_config_entry.entry_id)
+    await hass.async_block_till_done()
+
+    assert api_key not in caplog.text