fix(dune-client): redact sensitive request payloads and API responses from debug logs

[magqqgq]

Description

This PR addresses a medium-severity observability and data exposure vulnerability (CWE-532) within the dune-client Python SDK. It prevents sensitive caller data—such as raw SQL queries, upload data, query parameters, and decoded API error content—from being inadvertently written to debug logs.

Key Changes

• Synchronous Client Logging (dune_client/api/base.py):
  • Removed the logging of full parameter dictionaries from _post and _patch request initiations[cite: 54].
  • Updated _handle_response to log only the HTTP status_code instead of dumping the fully decoded response.json() into the debug stream[cite: 54].
• Asynchronous Client Logging (dune_client/client_async.py):
  • Refactored the _request and _handle_response methods to ensure json_body parameters and asynchronous decoded response bodies are entirely excluded from debug logs[cite: 55].
• Diagnostic Preservation:
  • Standardized all routing logs (_get, _post, _patch, _delete) to emit strictly safe metadata, such as the HTTP method and the targeted route/URL, preserving observability without risking data privacy[cite: 54, 55].

Validation & Testing

• Syntax Validation: Python syntax compilation (python -m compileall -q) passed successfully for the modified client code.
• Reviewer Action Required: The broader Python regression suite (pytest tests/unit) was blocked during this audit by environment limitations (the local system used Python 3.10, whereas datetime.UTC requires Python 3.11+, and mypy was missing from the offline cache). A maintainer must run uv run python -m pytest tests/unit using Python 3.11 or newer before approving the release.

[cursor]

PR Summary

Low Risk
Observability-only changes to debug log lines; no API or error-handling logic changes, though operators lose full response bodies in debug output.

Overview
Tightens debug logging in the sync and async Dune HTTP layers so query payloads and API bodies are not written to logs when debug logging is enabled.

In dune_client/api/base.py, _handle_response now logs only the HTTP status instead of the full decoded JSON. _post and _patch log the route only, not params (which can carry SQL, filters, and other caller data).

In dune_client/client_async.py, _handle_response is updated the same way so async JSON responses are not dumped at debug level. Request/response behavior is unchanged; only what appears in logs is reduced.

^{Reviewed by Cursor Bugbot for commit 0b88f08. Configure here.}