Ben Schumacher 307da95d9d [MM-69457] Stop logging PII in exportable app logs (#9884) ... * MM-69457: Stop logging PII in exportable app logs App logs are written to rolling files users can export via "Report a Problem" and the same args are forwarded as Sentry breadcrumbs. Several call sites logged PII into both destinations. Fix the known high-risk sites and prevent regressions: - push token, incoming-call payload (callerName), channel display names, and raw websocket url/event are no longer logged - wrap stray raw error/event logging with getFullErrorMessage() - add a no-restricted-syntax ESLint rule flagging PII (names/emails/ usernames) and credentials (tokens/passwords/secrets) in log* calls - document Logging & PII guidance in CLAUDE.md Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LAfpPfhVfZSv3veGDQfPYQ * Update websocket error test for PII-safe logging The error handler no longer logs the raw url/event; assert it logs code/reason instead and verify the url is not logged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LAfpPfhVfZSv3veGDQfPYQ * fix: address PR review feedback on PII-safe logging - Add server URL to websocket error log for multi-server debuggability - Redact device token to first 4 chars instead of omitting entirely - Update websocket error test to match new log signature Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: address PR review feedback on PII-safe logging - files.ts: add hasRejectionReason boolean to initial event log - websocket/index.ts: replace this.url (full WS URL with connection_id) with this.serverUrl in all log calls; update tests to match - calls_native.ts: split combined serverId/channelId guard into two separate if blocks for clearer per-field log messages - push_notifications.ts: expand redacted token prefix from 4 to 16 chars Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: revert websocket lifecycle logs back to full URL The full WebSocket URL (with path and connection_id) provides more diagnostic value than just the server base URL for lifecycle events (connect, reconnect, close, missed events). Only the onError handler keeps this.serverUrl, which was the original targeted fix. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * cleanup --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>		2026-07-02 12:19:04 +02:00
..
index.test.ts	[MM-69457] Stop logging PII in exportable app logs (#9884)	2026-07-02 12:19:04 +02:00
index.ts	[MM-69457] Stop logging PII in exportable app logs (#9884)	2026-07-02 12:19:04 +02:00