[doublebyte1]

remove_url_auth removed the literal "{username}:{password}@" string, so a URL with only a username (e.g. "mqtt://TOKEN@broker:1883", a common way to pass a token) became "TOKEN:None@" and nothing was removed. The broker URL is published in the AsyncAPI document and in broker_safe_url, so the token was exposed. Rebuild the netloc without the userinfo instead of doing a string replace.

Overview

Related Issue / discussion

Additional information

Dependency policy (RFC2)

• I have ensured that this PR meets RFC2 requirements

Updates to public demo

• I have ensured that breaking changes to the pygeoapi master demo server have been addressed
  • https://github.com/geopython/demo.pygeoapi.io/blob/master/services/pygeoapi_master/local.config.yml

Contributions and licensing

(as per https://github.com/geopython/pygeoapi/blob/master/CONTRIBUTING.md#contributions-and-licensing)

• I'd like to contribute [feature X|bugfix Y|docs|something else] to pygeoapi. I confirm that my contributions to pygeoapi will be compatible with the pygeoapi license guidelines at the time of contribution

• I have already previously agreed to the pygeoapi Contributions and Licensing Guidelines

• Original PR: Fix remove_url_auth leaving username-only credentials in URLs geopython/pygeoapi#2417

• Reproduced automatically by test_create_pr.py to exercise the Detect AI workflow.