Debug write logging exposes current and new mower PINs

[Bjorkan]

TL;DR

When debug logging is enabled, pyGrouw prints every outgoing BLE packet in full. A PIN-change packet contains both the current and new four-digit PIN, so shared Home Assistant logs can expose both codes even though incoming responses are redacted.

Problem

_write_with_log() logs payload.hex() for every successful GATT write without inspecting the command or redacting sensitive byte ranges.

Relevant code:

• All outgoing payloads are written verbatim to debug logs
• encode_daye_change_pin() places the old PIN in bytes 4–7 and the new PIN in bytes 8–11
• redact_daye_message() knows how to mask PIN fields, but it is only applied to parsed message dictionaries

The Home Assistant README explicitly recommends enabling pygrouw: debug during troubleshooting, making this an expected real-world logging path.

Why it happens

Incoming notifications are parsed and passed through redact_daye_message(). Outgoing payloads bypass that mechanism because they are logged as raw bytes before or after the GATT write.

For a PIN-change command, the log line contains enough information to reconstruct both PINs directly.

The raw debug service can also send arbitrary PIN-bearing payloads, so redaction cannot safely rely only on the high-level label.

Current behavior

A debug log can contain a line shaped like:

write change_pin ok payload=44594d06<old-pin-bytes><new-pin-bytes>...

Users are commonly asked to collect and share debug logs for BLE failures. The integration README warns users to redact PINs manually, but credentials should not enter logs in the first place.

Expected behavior

Sensitive bytes must be masked before any outgoing payload is logged.

At minimum:

• detect the DYM PIN-change command and mask bytes 4–11;
• mask known PIN-query/auth response fields consistently;
• provide a conservative redaction path for raw/debug payloads;
• never include self.pin, old PIN, or new PIN in exception messages;
• add tests that inspect log records, not only parsed-message dictionaries.

For unknown raw payloads, logging length, protocol, command byte, and a hash/correlation identifier is safer than logging the full packet by default.

Impact

Anyone with access to Home Assistant logs, diagnostics archives, issue attachments, or pasted support output may obtain the mower PIN. Both the old and replacement PIN can be exposed during a change, increasing the chance that one remains valid.

Suggested direction

Create a byte-oriented redaction helper used by _write_with_log() before converting to hexadecimal. Keep full raw logging behind an explicit unsafe developer-only opt-in, disabled by default.

Acceptance criteria

• PIN-change writes never expose bytes 4–11 in normal debug logs.
• Raw service payloads matching known sensitive commands are redacted.
• Tests assert that old and new test PINs do not appear anywhere in captured log output.
• Non-sensitive commands remain identifiable by command name and transaction ID.
• Documentation no longer relies on users manually finding every PIN occurrence.