Redact IPTV credentials from logs and debug output

[dwizzle204]

Summary

The app should redact IPTV credentials before writing URLs, API requests, playback URLs, or raw provider responses to logs/debug output.

Xtream-style APIs commonly include credentials in query parameters or path segments, for example:

player_api.php?username=<user>&password=<pass>

/live/<user>/<pass>/<stream_id>.ts
/movie/<user>/<pass>/<stream_id>.mp4
/series/<user>/<pass>/<stream_id>.mkv

If these values are logged, credentials can be exposed through local device logs, screenshots, crash reports, support bundles, CI logs, or developer console output.

Proposed behavior

• Do not log full provider URLs containing credentials.
• Redact username and password query parameters before logging.
• Redact Xtream path credentials before logging playback URLs.
• Avoid logging raw provider response bodies unless explicitly needed for debugging and safely redacted.
• Ensure release builds do not emit credential-bearing debug output.

Suggested redaction examples

player_api.php?username=<redacted>&password=<redacted>

/live/<user>/<pass>/123.ts
/movie/<user>/<pass>/456.mp4
/series/<user>/<pass>/789.mkv

Suggested implementation direction

Add a small shared helper per client/platform:

redactCredentials(input: String) -> String

It should handle at least:

• username=<value>
• password=<value>
• /live/{username}/{password}/{stream}
• /movie/{username}/{password}/{stream}
• /series/{username}/{password}/{stream}

Then require all logging/debug output that may include provider URLs or API responses to pass through the redaction helper first.

Acceptance criteria

• No log/debug statement prints raw IPTV username/password values.
• API URLs are redacted before logging.
• Playback URLs are redacted before logging.
• Raw JSON/body logging is removed, gated, or redacted.
• A basic unit test validates that sample Xtream URLs are redacted correctly.

[bsogulcan]

Hi @dwizzle204, thanks — confirmed.

Current state:

• The video player and download manager log full playback/download URLs to the unified system log with privacy: .public. For Xtream streams these URLs embed credentials in the path
  (/live///.ts), so they end up in Console output and sysdiagnose bundles. This is the worst offender.
• The Xtream API client has debug print statements that dump the full player_api.php URL (including username/password query parameters) and raw JSON response bodies, without even a #if
  DEBUG guard.
• One thing worth adding to your list: the Xtream auth response itself (user_info) contains the username and password in the JSON body, so raw response logging leaks credentials even
  after URL redaction. Raw body dumps will be removed rather than redacted.

Planned fix:

1. A redactCredentials(_:) helper covering username=/password= query parameters and the /live|movie|series/// path pattern, plus removal of the playlist's known credential
   values as a catch-all.
2. All URL-bearing log statements routed through it; the .public os_log calls are the priority.
3. Raw request/response body dumps removed.
4. Unit tests with sample Xtream URLs.
5. Applied across iOS, tvOS, and macOS (the codebases are isolated per platform).

This will land ahead of #100 since it's a smaller change with a more direct exposure path.