mirror of
https://github.com/jcreek/CosmicClash.git
synced 2026-09-10 16:04:04 +00:00
Josh Creek
3817df2a12
server/observability existed fully unit-tested but was imported by nothing outside its own package -- no HTTP handler ever called it, so its credential redaction protected zero real log output. Wire it into Service via an optional Log field (nil-safe, so every existing Service literal keeps compiling unchanged) and call it from the two workload-authenticated server routes -- register and result -- at every outcome: unauthorized, rejected, conflict and success. Wire cmd/control-plane to actually emit those events as JSON lines on stderr. Add a secret canary test that drives both routes end to end with realistic bearer-token and result-nonce values and asserts neither literal secret appears anywhere in what Service.Log actually received -- a stronger claim than the existing observability unit test, which only proves redact() strips a synthetic value under a denylisted key name. redact() is still key-name-based, not content-based: a future call site that logs a secret under an unlisted key name would not be caught by this test or by redact() itself, only by the same discipline applied here of never putting raw request/token bytes into Fields. Queue, proposal and assignment mutation routes are not wired yet.