Redact authentication material from application telemetry

[abhi1693]

What changes and why?

The production audit found 107 log records containing OAuth callback code parameters across the reader, administration UI, and authentication APIs over seven days. Request logging and browser diagnostics now replace authentication values with [REDACTED] while retaining concrete routes, ordinary query values, request IDs, trace IDs, and error context.

The policy covers Python text/JSON and stored job logs, Node request logs, Faro payloads before transport, and both telemetry receivers. It handles callback codes/state, credential fields, URL user information, Bearer/Basic authorization, encoded or repeated parameters, fragments, and nested callback URLs. Original requests and callback inputs are preserved.

Validation

• Shared Python/TypeScript fixtures cover redaction, preservation of ordinary query values, and idempotence.
• Regression tests exercise all three API services in both log formats, Node HTTP request logging, the real Faro SDK transport, and both telemetry receivers.
• Python lint, formatting, type checks, and version consistency pass.
• Focused Python regression tests: 142 passed; eight database integration cases excluded from this local run.
• Updated hosted backend suites: 2,617 unit tests and 1,102 integration tests passed, with no skips.
• Updated hosted reader/admin suites: 785 + 647 tests passed; frontend lint/types/builds, extension unit checks and both extension builds passed.
• npm run reader:test:parity passes for the production website build and built Chrome/Edge extensions, including sign-in, CSRF-protected actions, and sign-out across tabs.
• Shared fixtures live in packages/telemetry/fixtures, so frontend type checking can also load them inside the Docker build context. The AMD64 production web builder passes (docker build --target builder -f apps/web/Dockerfile .).
• This change has no visible UI changes.

Rollout notes

Restart or deploy the affected services to apply the policy to new records. Existing retained logs are unchanged. No authentication contract or database schema changes are required. OpenSSF workflow/badge work is in a separate PR.

Merge queue validation

Updated the branch against current master (409f4a52) with merge commit 0fd24e5c; no conflicts. Authentication-redaction regressions passed locally: 142 Python tests and 24 reader/telemetry tests. Full hosted CI, CI required, CodeQL and Sonar passed on this updated commit. Web/Chrome/Edge browser journeys and all ARM64 image build/scan/smoke checks passed. Sonar MCP confirms 95.1% new-code coverage, 0.0% new-code duplication, and zero new bugs, vulnerabilities or code smells. The separate GitHub-managed AI review remains quota-blocked; it is independent of these passing checks.

This PR is first in the non-draft queue. The documented dependency order remains #71 → #72 → #79: merge #71, retarget #72 to master and merge its worker-lock fix before updating #79. Draft #59 is excluded. Auto-merge is disabled.

Ready for review

• The description explains the change and the validation results, including any gaps.
• Relevant documentation and regression tests are updated.

[github-actions]

PR reader API performance

Result: INCONCLUSIVE

5 inconclusive · 3 within threshold. Zero request failures across all six runs.

Base 409f4a52d11a6b892be42b0327a9e8411864bd14 → PR 0fd24e5ccccf0b25283d2a7f2427bfbbaaca0707

Three independent runs per revision, each on a fresh GitHub-hosted ARM64 runner. 16 users, 60 seconds/run, 1,000 synthetic articles, cache off, five PgBouncer slots.

Latency comparison

All latency values are in milliseconds; lower is better. Values are medians of three runs.

Route	Base p95	PR p95	Change	Result
All requests	110	110	+0 (+0.0%)	Within threshold
Latest feed	140	130	-10 (-7.1%)	Within threshold
Feed pagination	100	92	-8 (-8.0%)	Within threshold
Article detail	91	72	-19 (-20.9%)	Inconclusive
Source feed	100	98	-2 (-2.0%)	Within threshold
Topic feed	100	80	-20 (-20.0%)	Inconclusive
Feed filters	100	80	-20 (-20.0%)	Inconclusive
Sources	61	33	-28 (-45.9%)	Inconclusive
Topics	55	45	-10 (-18.2%)	Inconclusive

Additional latency and throughput metrics

Each cell shows base → PR. Latencies are in milliseconds.

Endpoint	p50	p99	Requests/s
Aggregated	33 → 28	160 → 140	30.08 → 30.18
/v1/feed [latest]	49 → 44	190 → 200	8.71 → 8.78
/v1/feed [page]	31 → 26	130 → 130	3.73 → 3.96
/v1/articles/[id]	21 → 18	150 → 110	5.99 → 6.26
/v1/feed [source]	32 → 29	140 → 140	1.77 → 1.91
/v1/feed [topic]	31 → 26	160 → 120	1.81 → 1.62
/v1/feed/options	26 → 21	140 → 110	2.68 → 2.64
/v1/sources	13 → 11	100 → 54	2.68 → 2.64
/v1/topics	15 → 13	110 → 82	2.68 → 2.64

Individual runs

Run	Requests	Failures	Exit code
Base 1	1657	0	0
Base 2	1686	0	0
Base 3	1720	0	0
PR 1	1637	0	0
PR 2	1692	0	0
PR 3	1713	0	0

How to interpret this report

Regressed / Improved: a p95 regression needs >20% and >20 ms increase in the medians and at least two head samples versus the base median. Improvements use the inverse threshold. Within threshold means the change did not meet both thresholds.

Inconclusive: a within-revision p95 range >35% of its median and >20 ms is too noisy for a confident latency verdict.

Inconclusive latency comparisons are non-blocking: the check passes without claiming an improvement. Confirmed regressions and test/report errors fail the PR gate. Throughput is descriptive: paced users do not measure maximum capacity. This uncached public API test does not establish production health, browser performance or worker capacity. Separate runners can differ in hardware or host load; repetitions and noise checks reduce but cannot eliminate that uncertainty.

Full HTML/CSV reports and logs · attempt 1

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
95.1% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud