fix: safe DATABASE_URL parsing and redact exception from client response

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/main.py

@@ -4,12 +4,11 @@ from contextlib import asynccontextmanager
 from datetime import datetime
 from typing import AsyncGenerator
 
-import yaml
 from fastapi import FastAPI, Depends, HTTPException
 from fastapi.responses import Response
 from fastapi.templating import Jinja2Templates
 from sqlalchemy.ext.asyncio import AsyncSession
-from sqlalchemy import select
+from sqlalchemy import select, make_url
 
 from models import Base, Config, Subscription, ExportLog, make_engine, make_session_factory
 from mihomo import MihomoClient
@@ -57,8 +56,9 @@ async def write_and_reload_mihomo(db: AsyncSession) -> None:
 @asynccontextmanager
 async def lifespan(app: FastAPI):  # type: ignore[type-arg]
     os.makedirs(MIHOMO_CONFIG_DIR, exist_ok=True)
-    db_path = DATABASE_URL.split("///")[-1]
-    if db_path:
+    db_url = make_url(DATABASE_URL)
+    db_path = db_url.database
+    if db_path and db_path != ":memory:":
         os.makedirs(os.path.dirname(db_path), exist_ok=True)
 
     async with engine.begin() as conn:
@@ -105,7 +105,7 @@ async def get_config(
     try:
         expanded = expand_config(config.base_yaml, provider_proxies)
     except Exception as exc:
-        logger.error("Config expansion failed for token %s: %s", token, exc)
+        logger.error("Config expansion failed for token (redacted): %s", exc, exc_info=True)
         db.add(
             ExportLog(
                 config_id=config.id,
@@ -115,7 +115,7 @@ async def get_config(
             )
         )
         await db.commit()
-        raise HTTPException(status_code=500, detail=f"Config expansion failed: {exc}")
+        raise HTTPException(status_code=500, detail="Config expansion failed")
 
     node_count = sum(len(p) for p in provider_proxies.values())
     error_msg = "; ".join(errors) if errors else None