fix(webapp,clickhouse): keep sensitive data out of server logs

Mono-RevId: ea91673acce3eb6a757274025b59b3f1f39e19ef

Author: carderne

apps/webapp/app/models/user.server.ts

@@ -243,15 +243,10 @@ async function findOrCreateGoogleUser({
     // Check if email user and auth user are the same
     if (existingEmailUser.id !== existingUser.id) {
       // Different users: email is taken by one user, Google auth belongs to another
-      logger.warn(
-        `Google auth conflict: Google ID ${authenticationProfile.id} belongs to user ${existingUser.id} but email ${email} is taken by user ${existingEmailUser.id}`,
-        {
-          email,
-          existingEmailUserId: existingEmailUser.id,
-          existingAuthUserId: existingUser.id,
-          authIdentifier,
-        }
-      );
+      logger.warn("Google auth conflict between existing users", {
+        existingEmailUserId: existingEmailUser.id,
+        existingAuthUserId: existingUser.id,
+      });
 
       return {
         user: existingUser,

apps/webapp/app/routes/api.v1.query.ts

@@ -94,14 +94,12 @@ const { action, loader } = createActionApiRoute(
       if (queryResult.error instanceof QueryError) {
         logger.warn("Query API error", {
           error: queryResult.error.message,
-          query,
         });
         return json({ error: queryResult.error.message }, { status: 400 });
       }
 
       logger.error("Query API error", {
         error: queryResult.error,
-        query,
       });
 
       return json(

apps/webapp/app/routes/auth.sso.ts

@@ -55,9 +55,9 @@ export async function action({ request }: ActionFunctionArgs) {
     );
     if (rateError) {
       if (rateError instanceof SsoRateLimitError) {
-        logger.warn("SSO login rate limit exceeded", { clientIp, email });
+        logger.warn("SSO login rate limit exceeded", { clientIp });
       } else {
-        logger.error("SSO login rate limiter failed", { clientIp, email, error: rateError });
+        logger.error("SSO login rate limiter failed", { clientIp, error: rateError });
       }
       return redirect(`/login/sso?email=${encodeURIComponent(email)}&error=rate_limited`);
     }
@@ -78,7 +78,7 @@ export async function action({ request }: ActionFunctionArgs) {
 
   const begun = await ssoController.beginAuthorization({ email, redirectTo, flow });
   if (begun.isErr()) {
-    logger.warn("SSO beginAuthorization failed", { reason: begun.error, email, flow });
+    logger.warn("SSO beginAuthorization failed", { reason: begun.error, flow });
     return redirect(`/login/sso?email=${encodeURIComponent(email)}&error=${begun.error}`);
   }
 

apps/webapp/app/routes/login.magic/route.tsx

@@ -185,13 +185,11 @@ export async function action({ request }: ActionFunctionArgs) {
           if (error instanceof MagicLinkRateLimitError) {
             logger.warn("Login magic link rate limit exceeded", {
               clientIp,
-              email,
               error,
             });
           } else {
             logger.error("Failed sending login magic link", {
               clientIp,
-              email,
               error,
             });
           }

apps/webapp/app/services/emailAuth.server.tsx

@@ -28,7 +28,7 @@ const emailStrategy = new EmailLinkStrategy(
     form: FormData;
     magicLinkVerify: boolean;
   }) => {
-    logger.info("Magic link user authenticated", { email, magicLinkVerify });
+    logger.info("Magic link user authenticated", { magicLinkVerify });
 
     // Gate the link CLICK, not just the send: a magic link issued before
     // SSO enforcement flipped on (or replayed within its validity

apps/webapp/app/services/gitHubAuth.server.ts

@@ -36,12 +36,6 @@ export function addGitHubStrategy(
       }
 
       try {
-        logger.debug("GitHub login", {
-          emails,
-          profile,
-          extraParams,
-        });
-
         const { user, isNewUser } = await findOrCreateUser({
           email,
           authenticationMethod: "GITHUB",

apps/webapp/app/services/googleAuth.server.ts

@@ -45,12 +45,6 @@ export function addGoogleStrategy(
       }
 
       try {
-        logger.debug("Google login", {
-          emails,
-          profile,
-          extraParams,
-        });
-
         const { user, isNewUser } = await findOrCreateUser({
           email,
           authenticationMethod: "GOOGLE",

apps/webapp/app/services/loops.server.ts

@@ -13,7 +13,7 @@ class LoopsClient {
     email: string;
     name: string | null;
   }) {
-    logger.info(`Loops send "sign-up" event`, { userId, email, name });
+    logger.info(`Loops send "sign-up" event`, { userId });
     return this.#sendEvent({
       email,
       userId,
@@ -53,10 +53,7 @@ class LoopsClient {
       if (!response.ok) {
         logger.error(`Loops sendEvent ${eventName} bad status`, {
           status: response.status,
-          email,
           userId,
-          firstName,
-          eventProperties,
           eventName,
         });
         return false;

apps/webapp/app/services/routeBuilders/apiBuilder.server.ts

@@ -18,6 +18,7 @@ import {
 } from "../personalAccessToken.server";
 import { assertTokenOrganizationClaim, assertUserActorScope } from "../userActorEnvironment.server";
 import { safeJsonParse } from "~/utils/json";
+import { sanitizeHttpUrl } from "~/utils/sanitizeHttpUrl";
 import type { AuthenticatedWorkerInstance } from "~/v3/services/worker/workerGroupTokenService.server";
 import { WorkerGroupTokenService } from "~/v3/services/worker/workerGroupTokenService.server";
 import type { API_VERSIONS } from "~/api/versions";
@@ -31,24 +32,70 @@ import { tenantContext, tenantContextFromAuthEnvironment } from "~/services/tena
 // Client aborts and service-level validation errors aren't bugs — they're
 // expected at API boundaries. Log them at `warn` so they stay in stdout
 // without flowing to Sentry via Logger.onError.
+type DrizzleQueryError = Error & {
+  query: string;
+  params: unknown[];
+  cause?: unknown;
+};
+
+function isDrizzleQueryError(error: unknown): error is DrizzleQueryError {
+  if (!(error instanceof Error)) return false;
+
+  try {
+    return (
+      error.message.startsWith("Failed query:") &&
+      typeof (error as Partial<DrizzleQueryError>).query === "string" &&
+      Array.isArray((error as Partial<DrizzleQueryError>).params)
+    );
+  } catch {
+    return false;
+  }
+}
+
+function safeErrorCode(error: unknown): string | number | boolean | undefined {
+  if ((typeof error !== "object" && typeof error !== "function") || error === null) return;
+
+  try {
+    const code = (error as { code?: unknown }).code;
+    return typeof code === "string" || typeof code === "number" || typeof code === "boolean"
+      ? code
+      : undefined;
+  } catch {
+    return;
+  }
+}
+
+export function boundaryErrorLogValue(error: unknown) {
+  if (isDrizzleQueryError(error)) {
+    const code = safeErrorCode(error.cause);
+    return {
+      name: "DrizzleQueryError",
+      message: "Database query failed",
+      ...(code === undefined ? {} : { causeCode: code }),
+    };
+  }
+
+  return error instanceof Error
+    ? { name: error.name, message: error.message, stack: error.stack }
+    : String(error);
+}
+
 function logBoundaryError(
   message: "Error in loader" | "Error in action" | "Unroutable id",
   error: unknown,
   url: string
 ) {
-  const formatted =
-    error instanceof Error
-      ? { name: error.name, message: error.message, stack: error.stack }
-      : String(error);
+  const formatted = boundaryErrorLogValue(error);
+  const sanitizedUrl = sanitizeHttpUrl(url);
   const isExpected =
     error instanceof Error &&
     (error.name === "AbortError" ||
       error instanceof ServiceValidationError ||
       error instanceof EngineServiceValidationError);
   if (isExpected) {
-    logger.warn(message, { error: formatted, url });
+    logger.warn(message, { error: formatted, url: sanitizedUrl });
   } else {
-    logger.error(message, { error: formatted, url });
+    logger.error(message, { error: formatted, url: sanitizedUrl });
   }
 }
 
@@ -466,7 +513,10 @@ export function createLoaderApiRoute<
           corsStrategy !== "none"
         );
       } catch (innerError) {
-        logger.error("[apiBuilder] Failed to handle error", { error, innerError });
+        logger.error("[apiBuilder] Failed to handle error", {
+          error: boundaryErrorLogValue(error),
+          innerError: boundaryErrorLogValue(innerError),
+        });
 
         return json({ error: "Internal Server Error" }, { status: 500 });
       }
@@ -769,7 +819,10 @@ export function createLoaderPATApiRoute<
           corsStrategy !== "none"
         );
       } catch (innerError) {
-        logger.error("[apiBuilder] Failed to handle error", { error, innerError });
+        logger.error("[apiBuilder] Failed to handle error", {
+          error: boundaryErrorLogValue(error),
+          innerError: boundaryErrorLogValue(innerError),
+        });
 
         return json({ error: "Internal Server Error" }, { status: 500 });
       }
@@ -1061,7 +1114,10 @@ export function createActionPATApiRoute<
           corsStrategy !== "none"
         );
       } catch (innerError) {
-        logger.error("[apiBuilder] Failed to handle error", { error, innerError });
+        logger.error("[apiBuilder] Failed to handle error", {
+          error: boundaryErrorLogValue(error),
+          innerError: boundaryErrorLogValue(innerError),
+        });
 
         return json({ error: "Internal Server Error" }, { status: 500 });
       }
@@ -1407,7 +1463,10 @@ export function createActionApiRoute<
           corsStrategy !== "none"
         );
       } catch (innerError) {
-        logger.error("[apiBuilder] Failed to handle error", { error, innerError });
+        logger.error("[apiBuilder] Failed to handle error", {
+          error: boundaryErrorLogValue(error),
+          innerError: boundaryErrorLogValue(innerError),
+        });
 
         return json({ error: "Internal Server Error" }, { status: 500 });
       }
@@ -1679,7 +1738,10 @@ export function createMultiMethodApiRoute<
           corsStrategy !== "none"
         );
       } catch (innerError) {
-        logger.error("[apiBuilder] Failed to handle error", { error, innerError });
+        logger.error("[apiBuilder] Failed to handle error", {
+          error: boundaryErrorLogValue(error),
+          innerError: boundaryErrorLogValue(innerError),
+        });
         return json({ error: "Internal Server Error" }, { status: 500 });
       }
     }

apps/webapp/app/services/ssoAutoDiscovery.server.ts

@@ -45,11 +45,11 @@ export async function ssoRedirectForEmail(
     Promise.resolve(ssoController.decideRouteForEmail(normalised))
   );
   if (error) {
-    logger.warn("SSO auto-discovery fail-open (threw)", { error, email: normalised });
+    logger.warn("SSO auto-discovery fail-open (threw)", { error });
     return null;
   }
   if (decision.isErr()) {
-    logger.warn("SSO auto-discovery fail-open", { reason: decision.error, email: normalised });
+    logger.warn("SSO auto-discovery fail-open", { reason: decision.error });
     return null;
   }
   if (decision.value.kind !== "sso_required") return null;