fix(log): silence httpx and urllib3 request logs

logging_initialize sets the stdlib loggers httpx, httpx2 and urllib3 to
WARNING. httpx logs each request URL at INFO, including the query string
of signed URLs. The root logger is at level 0, so these lines got to all
loguru sinks and to Sentry breadcrumbs.

Tests restore the stdlib logger levels, the root level and the
InterceptHandler after each logging_initialize call.

BREAKING CHANGE: logging_initialize sets the httpx, httpx2 and urllib3 loggers
to WARNING. INFO request lines no longer get to the log sinks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: olivermeyer

README.md

@@ -144,6 +144,11 @@ Settings class: `LogSettings`
 | `{PREFIX}LOG_FILE_NAME` | platform log dir | Path to the log file (validated on startup when `FILE_ENABLED` is true). |
 | `{PREFIX}LOG_REDIRECT_LOGGING` | `true` | Redirect stdlib `logging` to loguru via `InterceptHandler`. |
 
+`logging_initialize()` sets the stdlib loggers `httpx`, `httpx2` and `urllib3` to `WARNING`. These
+HTTP clients log each request URL at `INFO`, and the URL can contain credentials in its query string
+(for example, the signature of a signed URL). At `WARNING`, these request lines do not get to the log
+sinks or to Sentry. The `psycopg` and `psycopg.pool` loggers are also at `WARNING`.
+
 #### Sentry (`{PREFIX}SENTRY_`)
 
 Settings class: `SentrySettings`. Sentry is only initialised when `ENABLED=true` **and** `DSN` is

src/aignostics_foundry_core/AGENTS.md

@@ -171,7 +171,7 @@ This file provides an overview of all modules in `aignostics_foundry_core`, thei
 - **Key Features**:
   - `InterceptHandler(logging.Handler)` — redirects stdlib log records to loguru, preserving original module/function/line metadata
   - `LogSettings(BaseSettings)` — uses the active FoundryContext.env_prefix to derive the env prefix (`{ctx.env_prefix}LOG_`). Fields: `level`, `stderr_enabled`, `file_enabled`, `file_name`, `redirect_logging`
-  - `logging_initialize(filter_func, *, context)` — removes all existing loguru handlers, then adds stderr/file handlers per settings; reads project name, version, and env file list from `context` (falls back to process-level context); embeds `project_name` and `version` in loguru `extra`; installs `InterceptHandler` for stdlib redirect; suppresses psycopg pool noise
+  - `logging_initialize(filter_func, *, context)` — removes all existing loguru handlers, then adds stderr/file handlers per settings; reads project name, version, and env file list from `context` (falls back to process-level context); embeds `project_name` and `version` in loguru `extra`; installs `InterceptHandler` for stdlib redirect; sets the stdlib loggers `psycopg`, `psycopg.pool`, `httpx`, `httpx2` and `urllib3` to WARNING (process-wide), so the INFO request lines of the HTTP clients, which contain the request URL and its query string, do not get to the sinks
 - **Location**: `aignostics_foundry_core/log.py`
 - **Dependencies**: `loguru>=0.7,<1`, `platformdirs>=4,<5` (mandatory)
 - **Import**: `from aignostics_foundry_core.log import logging_initialize, LogSettings, InterceptHandler`

src/aignostics_foundry_core/log.py

@@ -7,6 +7,9 @@
 - psycopg.pool: Set to WARNING level to suppress verbose INFO logs from
   connection pool operations (getconn/putconn). Only non-nominal pool
   messages (warnings and errors) are logged.
+- httpx, httpx2 and urllib3: Set to WARNING level. These HTTP clients log each
+  request URL at INFO, and the URL can include the query string of a signed URL.
+  At WARNING, these request lines do not get to the log sinks or to Sentry.
 """
 
 import contextlib
@@ -31,6 +34,7 @@
     from aignostics_foundry_core.foundry import FoundryContext
 
 _DEFAULT_PROJECT = "foundry"
+_HTTP_CLIENT_LOGGERS = ("httpx", "httpx2", "urllib3")
 
 
 def _validate_file_name(file_name: str | None) -> str | None:
@@ -186,6 +190,9 @@ def logging_initialize(
     handlers based on settings read from environment variables with the
     ``{ctx.env_prefix}LOG_`` prefix (derived from the context).
 
+    Sets the stdlib loggers ``psycopg``, ``psycopg.pool``, ``httpx``, ``httpx2``
+    and ``urllib3`` to WARNING. These levels are process-wide.
+
     Args:
         filter_func: Optional loguru filter callable; receives a ``Record``
             and returns ``True`` to keep the message, ``False`` to drop it.
@@ -234,4 +241,10 @@ def logging_initialize(
     logging.getLogger("psycopg.pool").setLevel(logging.WARNING)
     logger.trace("psycopg and psycopg.pool loggers set to WARNING to prevent deadlock and reduce noise")
 
+    # Suppress the INFO request lines of the HTTP clients. Each line contains the full request URL,
+    # which can include credentials in the query string (for example, the signature of a signed URL).
+    for http_client_logger in _HTTP_CLIENT_LOGGERS:
+        logging.getLogger(http_client_logger).setLevel(logging.WARNING)
+    logger.trace("{} loggers set to WARNING to keep request URLs out of the logs", ", ".join(_HTTP_CLIENT_LOGGERS))
+
     logger.trace("Logging initialized with level: {}", settings.level)

tests/aignostics_foundry_core/conftest.py

@@ -4,6 +4,7 @@
 
 import logging
 import os
+from contextlib import contextmanager
 from typing import TYPE_CHECKING
 from unittest.mock import MagicMock, patch
 
@@ -15,7 +16,7 @@
 from tests.conftest import TEST_PROJECT_PREFIX
 
 if TYPE_CHECKING:
-    from collections.abc import Generator
+    from collections.abc import Generator, Iterator
 
     from opentelemetry.sdk._logs import LoggerProvider  # pyright: ignore[reportPrivateImportUsage]
 
@@ -25,6 +26,45 @@
 # otel_initialize() writes these with os.environ.setdefault(), so monkeypatch cannot undo them.
 _OTEL_SDK_ENV_DEFAULTS = ("OTEL_SERVICE_NAME", "OTEL_SEMCONV_STABILITY_OPT_IN", "OTEL_EXPORTER_OTLP_CERTIFICATE")
 
+# logging_initialize() sets the level of these stdlib loggers for the whole process.
+_LOGGERS_SET_BY_LOGGING_INITIALIZE = ("psycopg", "psycopg.pool", "httpx", "httpx2", "urllib3")
+
+
+@contextmanager
+def stdlib_logging_restored() -> Iterator[None]:
+    """Undo the process-wide logging changes of ``logging_initialize`` on exit.
+
+    On exit, removes all loguru sinks and the ``InterceptHandler`` on the stdlib
+    root logger. Restores the level of the root logger and of the loggers that
+    ``logging_initialize`` sets to WARNING.
+
+    Yields:
+        None
+    """
+    root_logger = logging.getLogger()
+    saved_root_level = root_logger.level
+    saved_levels = {name: logging.getLogger(name).level for name in _LOGGERS_SET_BY_LOGGING_INITIALIZE}
+    try:
+        yield
+    finally:
+        logger.remove()
+        for handler in [h for h in root_logger.handlers if isinstance(h, InterceptHandler)]:
+            root_logger.removeHandler(handler)
+        root_logger.setLevel(saved_root_level)
+        for name, level in saved_levels.items():
+            logging.getLogger(name).setLevel(level)
+
+
+@pytest.fixture
+def stdlib_logging_reset() -> Generator[None, None, None]:
+    """Undo the process-wide logging changes of ``logging_initialize`` after the test.
+
+    Yields:
+        None
+    """
+    with stdlib_logging_restored():
+        yield
+
 
 class OtlpLogCapture:
     """Access to the log records that the OTLP log sink exports."""
@@ -63,9 +103,9 @@ def otlp_log_exporter(monkeypatch: pytest.MonkeyPatch) -> Generator[OtlpLogCaptu
     patches only OpenTelemetry symbols, so the global ``LoggerProvider`` stays
     unset.
 
-    Teardown shuts the ``LoggerProvider`` down, removes all loguru sinks, removes
-    the ``InterceptHandler`` that ``logging_initialize`` puts on the stdlib root
-    logger, and restores the root logger level and the ``OTEL_*`` defaults.
+    Teardown shuts the ``LoggerProvider`` down, undoes the process-wide logging
+    changes of ``logging_initialize`` (see :func:`stdlib_logging_restored`), and
+    restores the ``OTEL_*`` defaults.
 
     Yields:
         OtlpLogCapture: Access to the exported log records.
@@ -76,11 +116,10 @@ def otlp_log_exporter(monkeypatch: pytest.MonkeyPatch) -> Generator[OtlpLogCaptu
     monkeypatch.setenv(f"{_OTEL_PREFIX}METRICS_ENABLED", "false")
     monkeypatch.setenv("OTEL_EXPORTER_OTLP_ENDPOINT", _OTLP_ENDPOINT)
     saved_env = {name: os.environ.get(name) for name in _OTEL_SDK_ENV_DEFAULTS}
-    root_logger = logging.getLogger()
-    saved_root_level = root_logger.level
 
     exporter = InMemoryLogRecordExporter()
     with (
+        stdlib_logging_restored(),
         patch("opentelemetry.exporter.otlp.proto.grpc._log_exporter.OTLPLogExporter", return_value=exporter),
         patch("opentelemetry._logs.set_logger_provider") as set_logger_provider,
     ):
@@ -90,10 +129,6 @@ def otlp_log_exporter(monkeypatch: pytest.MonkeyPatch) -> Generator[OtlpLogCaptu
         finally:
             if capture.provider is not None:
                 capture.provider.shutdown()
-            logger.remove()
-            for handler in [h for h in root_logger.handlers if isinstance(h, InterceptHandler)]:
-                root_logger.removeHandler(handler)
-            root_logger.setLevel(saved_root_level)
             for name, value in saved_env.items():
                 if value is None:
                     os.environ.pop(name, None)

tests/aignostics_foundry_core/log_test.py

@@ -2,17 +2,22 @@
 
 import logging as stdlib_logging
 import sys
+from contextlib import contextmanager
 from pathlib import Path
 from typing import TYPE_CHECKING, Any
 
+import httpx
 import pytest
+from loguru import logger
 from pydantic import ValidationError
 
 from aignostics_foundry_core.log import InterceptHandler, LogSettings, logging_initialize
 from tests.conftest import TEST_PROJECT_PREFIX
 
 if TYPE_CHECKING:
-    from loguru import Message
+    from collections.abc import Iterator
+
+    from loguru import Message, Record
 
 _MARKER_MESSAGE = "log_test_unique_marker_4f2a"
 _STDLIB_MESSAGE = "stdlib_redirect_unique_marker_9b3c"
@@ -24,10 +29,34 @@
 _CONTEXTUALIZE_MARKER = "contextualize_intercept_marker_6d2e"
 _PARITY_NATIVE_MARKER = "parity_native_loguru_4b7a"
 _PARITY_STDLIB_MARKER = "parity_stdlib_intercept_9c1f"
+_HTTP_CLIENT_INFO_MARKER = "http_client_info_marker_5a8d"
+_HTTP_CLIENT_WARNING_MARKER = "http_client_warning_marker_2c6b"
+_SIGNED_URL = "https://example.com/blob?sig=secret"
+_SIGNED_URL_QUERY = "sig=secret"
+
+
+@contextmanager
+def _captured_records() -> "Iterator[list[Record]]":
+    """Collect every loguru record at TRACE and above while the block runs.
+
+    Yields:
+        list[Record]: The records that loguru emitted inside the block.
+    """
+    records: list[Record] = []
+
+    def capture(message: "Message") -> None:
+        records.append(message.record)
+
+    sink_id = logger.add(capture, level="TRACE")
+    try:
+        yield records
+    finally:
+        logger.remove(sink_id)
 
 
 @pytest.mark.sequential
 @pytest.mark.unit
+@pytest.mark.usefixtures("stdlib_logging_reset")
 class TestLoggingInitialize:
     """Behavioural tests for logging_initialize()."""
 
@@ -103,6 +132,31 @@ def test_logging_initialize_suppresses_psycopg_loggers(self) -> None:
         assert stdlib_logging.getLogger("psycopg").level == stdlib_logging.WARNING
         assert stdlib_logging.getLogger("psycopg.pool").level == stdlib_logging.WARNING
 
+    @pytest.mark.parametrize("logger_name", ["httpx", "httpx2", "urllib3"])
+    def test_logging_initialize_sets_http_client_loggers_to_warning(self, logger_name: str) -> None:
+        """After logging_initialize(), the HTTP client loggers pass WARNING records but drop INFO records."""
+        logging_initialize()
+
+        with _captured_records() as records:
+            stdlib_logging.getLogger(logger_name).info(_HTTP_CLIENT_INFO_MARKER)
+            stdlib_logging.getLogger(logger_name).warning(_HTTP_CLIENT_WARNING_MARKER)
+
+        assert [(r["level"].name, r["message"]) for r in records if r["name"] == logger_name] == [
+            ("WARNING", _HTTP_CLIENT_WARNING_MARKER)
+        ]
+
+    def test_logging_initialize_drops_httpx_request_line(self) -> None:
+        """An httpx request writes no record, so the query string of a signed URL gets to no sink."""
+        logging_initialize()
+        transport = httpx.MockTransport(lambda _request: httpx.Response(200))
+
+        with _captured_records() as records, httpx.Client(transport=transport) as client:
+            response = client.get(_SIGNED_URL)
+
+        assert response.status_code == 200
+        assert [r["name"] for r in records if (r["name"] or "").startswith("httpx")] == []
+        assert all(_SIGNED_URL_QUERY not in r["message"] for r in records)
+
     def test_logging_initialize_uses_context_project_name(
         self, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
     ) -> None: