feat: emit structured log events and redact secrets from debug logs - #128
Merged
Conversation
logRequestFailed logged err.Error() verbatim into error.message. Real *http.Client transport failures wrap the cause in *url.Error, whose Error() embeds the full request URL including api_key/api_secret/token query values, leaking secrets on every real transport failure. Classification still runs on the original err; only the logged message unwraps *url.Error to its underlying cause. Also fix http.request.sent logging the caller's params instead of the built request's actual query, which meant url.query was empty (or never redacted) for the ~246 of 316 call sites passing nil params. logRequestSent now takes r.URL.Query() so the mandated redacted api_key field actually appears in production logs. Replace the hand-rolled toLowerASCII with strings.ToLower.
mogita
temporarily deployed
to
feeds-enabled-shard
July 22, 2026 15:40 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
mogita
temporarily deployed
to
feeds-enabled-shard
July 22, 2026 15:40 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
mogita
temporarily deployed
to
feeds-enabled-shard
July 22, 2026 15:40 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
mogita
temporarily deployed
to
feeds-enabled-shard
July 22, 2026 15:40 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
mogita
temporarily deployed
to
feeds-enabled-shard
July 22, 2026 15:40 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
mogita
temporarily deployed
to
feeds-enabled-shard
July 22, 2026 15:40 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ticket
https://linear.app/stream/issue/CHA-2957/logging
Summary
Adds structured logging via the existing
Loggerinterface: emitsclient.initialized,http.request.sent,http.response.received, andhttp.request.failedevents with the standard field schema. Mandatory redaction ofapi_key/api_secret/tokenquery values andapi_secret/token/passwordbody keys. Opt-inWithLogBodiesadds (still-redacted) bodies with a one-shot WARN. No-logger behavior unchanged.Security
Authorizationheaders and secret query values are no longer logged (they were previously dumped verbatim at DEBUG). Thehttp.request.failedmessage is scrubbed of any URL-embedded secret.Tests
Full
-shortunit suite green; newlogging_test.gocovers events, redaction, the no-header guarantee, and the transport-error message scrub.