v8.5.52 — the Logger stays universal and keeps its redaction

The Logger stays universal and keeps its redaction

v8.5.51 took the codesafe-specific parts out of Ovos\Service\Logger, and with them went redaction that every application wants. This release puts that redaction back, still without a codesafe name in the Logger: secrets always go, identities follow a policy. Every method v8.5.51 removed from the Logger and the Sender that callers still use is back, so the upgrade from v8.5.50 or v8.5.51 needs no code change for logging.

Secrets

• Query-only names (Logger::$queryNames: key, auth, code, sig, signature, otp, pin, hash; extend with addQueryNames()) are redacted in URL query strings again: a WordPress reset key (?key=), a Google API key, an Azure SAS sig, an OAuth code. They are judged in URLs only, so a key field in a request array is still a cache key.
• Token-shaped path segments are redacted again: looksSecret() catches a JWT, a uuid, a long hex run, or a long mixed-case run with digits (/invite/<token>, /login/magic/<jwt>). Slugs and content-hashed assets (app.<hash>.js) stay readable.
• The /token/<value> rule from v8.5.51 stays, and now leaves an empty next segment alone (/settings/token/).
• Since v8.5.51 the log file runs the request URI, the CLI arguments and the whole entry through these rules, so a local log line now loses ?key= and token paths too. Up to v8.5.50 the URI and argv were written as they came.

Identities: a policy

E-mail addresses (by value, domain kept: j***.***@example.com) and username fields (user, username, login, …, extend with addUsernames(); masked as m***i*) are masked when the policy says so.

logger:
    identities: keep   # the default; `mask` masks identities in the log file

• maskingIdentities() and keepingIdentities() return copies with the policy set in code.
• keepingIdentities(?array $usernames) is for a destination that masks and stores identities itself. Secrets are dropped as always, and e-mail addresses stay raw. The username fields matching $usernames stay raw too (every one when null), and any other username field stays masked.
• Logger::maskEmails() and Logger::maskName() (now public static) give the masks directly.

The codesafe Sender

• Sender::USERNAMES holds the username fields codesafe masks and keeps encrypted when they arrive; it moved here from Logger::CODESAFE_USERNAMES. Every report goes through keepingIdentities(Sender::USERNAMES). E-mail addresses and those fields travel raw for codesafe to vault, while a username field the application added to the Logger is masked, since codesafe would store it in clear.
• Sender::maskName() is back, for a username in a reportRefusal() message. It delegates to Logger::maskName().

Upgrading

• From v8.5.50: the logging API is the same. Read v8.5.51's notes for everything else it changed (forms, action arguments, services, query Fragment, Redis stores, Stream\Request).
• From v8.5.51: nothing to change. A local log file keeps identities raw unless you set logger.identities: mask.
• The Logger and the codesafe Sender must be listed in system.services.http and .cli. They register as event writers when they boot (since v8.5.51).

Full changelog: v8.5.51...v8.5.52