feat: add credential-safe multiplayer observability

server/observability/log.go

@@ -0,0 +1,63 @@
+// Package observability provides credential-safe structured event encoding.
+package observability
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+	"time"
+)
+
+type Event struct {
+	Event      string
+	QueueID    string
+	ProposalID string
+	MatchID    string
+	ServerID   string
+	Stage      string
+	OccurredAt time.Time
+	Fields     map[string]any
+}
+
+func Encode(event Event) ([]byte, error) {
+	if event.Event == "" {
+		return nil, fmt.Errorf("event name is required")
+	}
+	fields := map[string]any{
+		"event": event.Event, "occurred_at": event.OccurredAt.UTC().Format(time.RFC3339Nano),
+	}
+	for key, value := range map[string]string{"queue_id": event.QueueID, "proposal_id": event.ProposalID, "match_id": event.MatchID, "server_id": event.ServerID, "stage": event.Stage} {
+		if value != "" {
+			fields[key] = value
+		}
+	}
+	for key, value := range event.Fields {
+		fields[key] = redact(key, value)
+	}
+	return json.Marshal(fields)
+}
+
+func redact(key string, value any) any {
+	lowered := strings.ToLower(key)
+	for _, secret := range []string{"token", "secret", "credential", "authorization", "private_key", "auth_ticket", "relay_ticket"} {
+		if strings.Contains(lowered, secret) {
+			return "[REDACTED]"
+		}
+	}
+	switch typed := value.(type) {
+	case map[string]any:
+		copy := make(map[string]any, len(typed))
+		for key, value := range typed {
+			copy[key] = redact(key, value)
+		}
+		return copy
+	case []any:
+		copy := make([]any, len(typed))
+		for i, value := range typed {
+			copy[i] = redact("item", value)
+		}
+		return copy
+	default:
+		return value
+	}
+}