fix: wire log-redact dead code — add Pino redact + use safeFlowProjection (closes #69)#76
Open
LucasMaupin wants to merge 1 commit into
Open
fix: wire log-redact dead code — add Pino redact + use safeFlowProjection (closes #69)#76LucasMaupin wants to merge 1 commit into
LucasMaupin wants to merge 1 commit into
Conversation
…tion (closes #69) Add Pino's built-in `redact` option to the Fastify logger in server.ts so structured log fields matching the SENSITIVE_KEYS pattern (passphrase, srt_uri, streamid, authorization, token, pat, secret) are censored at the logger level as defence-in-depth. Import and call `safeFlowProjection` from log-redact.ts in flow-generator.ts, replacing the inline manual projection that duplicated the same logic. Add unit tests for both `redactSensitive` and `safeFlowProjection` covering key redaction, nested objects, arrays, and verifying no plaintext passphrase leaks in serialised output. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
redactoption to the Fastify logger insrc/server.ts, censoring structured log fields whose keys match theSENSITIVE_KEYSpattern (passphrase,srt_uri,streamid,authorization,token,pat,secret) with[REDACTED]at the logger level as a defence-in-depth measure.safeFlowProjectionfromsrc/lib/log-redact.tsinsrc/lib/flow-generator.ts, replacing the inline manual flow projection that duplicated the same logic.redactSensitiveandsafeFlowProjectioninsrc/__tests__/log-redact.test.ts, verifying key redaction, nested objects, arrays, and that no plaintext passphrase leaks in serialised output.Both
redactSensitiveandsafeFlowProjectionfromlog-redact.tsare now imported and called in production code paths, removing the dead code status identified in the issue.Closes #69