mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 04:50:59 +00:00
Marc-André BombeckandClaude Opus 4.7
fb12f098e6
`redactEventForEgress()` only redacted `error.message`, `error.stack`, `warnings`, `http.user_agent` and `external_calls[*].error`. The free-shape `meta` field and `action.details` blob carry annotated key=value pairs from `annotate()` calls — including the provider-runner's `ai_chain_hop_<n>_reason` which captures the upstream error body capped at 240 chars. If an upstream provider ever echoes a Bearer token in its error body, the raw token would land in `meta` without any scrub. Added a recursive `redactDeep()` walker that runs `redactSecrets()` over every string-shaped value inside both blobs. Same gap on `/api/admin/audit-log`: the `details` JSON column was returned verbatim. A user-supplied identifier in a failed-login row (e.g. a typo'd "Bearer hlk_..." in a username field) flowed through the deepened B4 admin viewer + CSV export. Run `redactSecrets()` over each row's `details` at egress so already-persisted rows are scrubbed on read without a backfill migration. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>