Redact auth token secrets from debug logs

models/signin.test.ts

@@ -1,3 +1,4 @@
+import { configure, type LogRecord, reset } from "@logtape/logtape";
 import { assert } from "@std/assert/assert";
 import { assertEquals } from "@std/assert/equals";
 import {
@@ -31,3 +32,45 @@ Deno.test({
     assertEquals(deleted, undefined);
   },
 });
+
+Deno.test({
+  name: "signin token debug log omits replay secrets",
+  sanitizeOps: false,
+  sanitizeResources: false,
+  async fn() {
+    const { kv } = createTestKv();
+    const records: LogRecord[] = [];
+    const accountId = "019d9162-ffff-7fff-8fff-ffffffffffff";
+
+    await configure({
+      reset: true,
+      sinks: { capture: (record) => records.push(record) },
+      loggers: [
+        {
+          category: ["hackerspub", "models", "signin"],
+          lowestLevel: "debug",
+          sinks: ["capture"],
+        },
+      ],
+    });
+
+    try {
+      const token = await createSigninToken(kv, accountId);
+      const record = records.find((record) =>
+        record.rawMessage ===
+          "Created sign-in token for {accountId} (expires in {expires})"
+      );
+
+      assert(record != null);
+      assertEquals(record.properties.accountId, accountId);
+      assertEquals(record.properties.token, undefined);
+      assertEquals(record.properties.code, undefined);
+
+      const serializedProperties = JSON.stringify(record.properties);
+      assertEquals(serializedProperties.includes(token.token), false);
+      assertEquals(serializedProperties.includes(token.code), false);
+    } finally {
+      await reset();
+    }
+  },
+});

models/signin.ts

@@ -36,9 +36,9 @@ export async function createSigninToken(
     tokenData,
     EXPIRATION.total("millisecond"),
   );
-  logger.debug("Created sign-in token (expires in {expires}): {token}", {
+  logger.debug("Created sign-in token for {accountId} (expires in {expires})", {
     expires: EXPIRATION,
-    token: tokenData,
+    accountId: tokenData.accountId,
   });
   return tokenData;
 }

models/signup.test.ts

@@ -1,3 +1,4 @@
+import { configure, type LogRecord, reset } from "@logtape/logtape";
 import { assert } from "@std/assert/assert";
 import { assertEquals } from "@std/assert/equals";
 import {
@@ -38,6 +39,53 @@ Deno.test({
   },
 });
 
+Deno.test({
+  name: "signup token debug log omits replay secrets",
+  sanitizeOps: false,
+  sanitizeResources: false,
+  async fn() {
+    const { kv } = createTestKv();
+    const records: LogRecord[] = [];
+    const email = "candidate@example.com";
+    const inviterId = "019d9162-ffff-7fff-8fff-ffffffffffff";
+
+    await configure({
+      reset: true,
+      sinks: { capture: (record) => records.push(record) },
+      loggers: [
+        {
+          category: ["hackerspub", "models", "signup"],
+          lowestLevel: "debug",
+          sinks: ["capture"],
+        },
+      ],
+    });
+
+    try {
+      const token = await createSignupToken(kv, email, { inviterId });
+      const record = records.find((record) =>
+        record.rawMessage ===
+          "Created sign-up token (expires in {expires}, invited: {invited})"
+      );
+
+      assert(record != null);
+      assertEquals(record.properties.invited, true);
+      assertEquals(record.properties.email, undefined);
+      assertEquals(record.properties.inviterId, undefined);
+      assertEquals(record.properties.token, undefined);
+      assertEquals(record.properties.code, undefined);
+
+      const serializedProperties = JSON.stringify(record.properties);
+      assertEquals(serializedProperties.includes(email), false);
+      assertEquals(serializedProperties.includes(inviterId), false);
+      assertEquals(serializedProperties.includes(token.token), false);
+      assertEquals(serializedProperties.includes(token.code), false);
+    } finally {
+      await reset();
+    }
+  },
+});
+
 Deno.test({
   name: "createAccount() stores inviter and verified email",
   sanitizeOps: false,

models/signup.ts

@@ -56,10 +56,13 @@ export async function createSignupToken(
     tokenData,
     expiration.total("millisecond"),
   );
-  logger.debug("Created sign-up token (expires in {expires}): {token}", {
-    expires: EXPIRATION,
-    token: tokenData,
-  });
+  logger.debug(
+    "Created sign-up token (expires in {expires}, invited: {invited})",
+    {
+      expires: expiration,
+      invited: tokenData.inviterId != null,
+    },
+  );
   return tokenData;
 }