28660c8 refactor: Improve logging privacy and readability across API routes · pdraim

M src/routes/api/register/+server.ts +11 -10


@@ -9,7 +9,7 @@ const captchaAttempts = new Map<string, { count: number, lastAttempt: number }>(
9	9		const sleep = (ms: number) => new Promise(resolve => setTimeout(resolve, ms));
10	10
11	11		export const POST: RequestHandler = async ({ request }) => {
12		-	console.debug("POST /api/register called");
	12	+	console.log("[Register] New registration attempt received");
13	13
14	14		// Only allow POST
15	15		if (request.method !== 'POST') {

@@ -19,8 +19,8 @@ export const POST: RequestHandler = async ({ request }) => {
19	19		let body: unknown;
20	20		try {
21	21		body = await request.json();
22		-	} catch (err) {
23		-	console.debug("Invalid JSON", err);
	22	+	} catch {
	23	+	console.log("[Register] Invalid JSON payload received");
24	24		return new Response(JSON.stringify({ error: 'Invalid JSON' } as RegisterResponseError), { status: 400 });
25	25		}
26	26

@@ -29,7 +29,7 @@ export const POST: RequestHandler = async ({ request }) => {
29	29		// Destructure and validate required fields from the payload.
30	30		if (typeof suUsername !== 'string' \|\| typeof suPassword !== 'string' \|\|
31	31		typeof suConfirmPassword !== 'string' \|\| typeof captchaAnswer !== 'string') {
32		-	console.debug("Missing or invalid input fields", { suUsername, suPassword, suConfirmPassword, captchaAnswer });
	32	+	console.log("[Register] Missing or invalid input fields");
33	33		return new Response(JSON.stringify({ error: 'Missing or invalid input fields' } as RegisterResponseError), { status: 400 });
34	34		}
35	35

@@ -66,19 +66,20 @@ export const POST: RequestHandler = async ({ request }) => {
66	66		const expectedCaptcha = "point de rencontre";
67	67		// Get the IP address for rate limiting. In production, a more reliable method should be used.
68	68		const ip = request.headers.get('x-forwarded-for') \|\| 'unknown';
	69	+	const maskedIp = ip.split('.').map((octet, idx) => idx < 3 ? 'xxx' : octet).join('.');
69	70		const now = Date.now();
70	71		const attemptData = captchaAttempts.get(ip) \|\| { count: 0, lastAttempt: 0 };
71	72		// If the user has failed three or more times, apply aggressive exponential backoff.
72	73		if (attemptData.count >= 3) {
73	74		const delay = Math.pow(2, attemptData.count - 3 + 1) * 1000; // delay in milliseconds
74		-	console.debug(`Applying exponential backoff delay of ${delay}ms for IP ${ip}`);
	75	+	console.log(`[Register] Rate limit exceeded for IP ${maskedIp} - applying ${delay}ms delay`);
75	76		await sleep(delay);
76	77		}
77	78		if (captcha !== expectedCaptcha) {
78	79		attemptData.count++;
79	80		attemptData.lastAttempt = now;
80	81		captchaAttempts.set(ip, attemptData);
81		-	console.debug(`Captcha failed for IP ${ip}. Attempt count: ${attemptData.count}`);
	82	+	console.log(`[Register] Captcha failed for IP ${maskedIp}. Attempt count: ${attemptData.count}`);
82	83		const remaining = Math.max(0, 3 - attemptData.count);
83	84		return new Response(JSON.stringify({ error: `Incorrect captcha answer. ${remaining > 0 ? remaining + " attempt(s) remaining." : "Please wait before trying again."}` } as RegisterResponseError), { status: 400 });
84	85		}

@@ -91,8 +92,8 @@ export const POST: RequestHandler = async ({ request }) => {
91	92		let hashedPassword: string;
92	93		try {
93	94		hashedPassword = await hashPassword(password);
94		-	} catch (err) {
95		-	console.debug("Error hashing password", err);
	95	+	} catch {
	96	+	console.log("[Register] Error hashing password");
96	97		return new Response(JSON.stringify({ error: 'Internal Server Error' } as RegisterResponseError), { status: 500 });
97	98		}
98	99		// Insert the new user into the database.

@@ -102,9 +103,9 @@ export const POST: RequestHandler = async ({ request }) => {
102	103		nickname: username,
103	104		createdAt: Date.now()
104	105		});
105		-	console.debug(`User ${username} registered successfully`);
	106	+	console.log(`[Register] User ${username} registered successfully`);
106	107		} catch (err) {
107		-	console.debug("Database insertion error", err);
	108	+	console.log("Database insertion error", err);
108	109		// Assume a duplicate user error if the email (or derived unique field) already exists.
109	110		return new Response(JSON.stringify({ error: 'User registration failed. Possibly user already exists.' } as RegisterResponseError), { status: 409 });
110	111		}

 const sleep = (ms: number) => new Promise(resolve => setTimeout(resolve, ms));
 export const POST: RequestHandler = async ({ request }) => {
-	console.debug("POST /api/register called");
+	console.log("[Register] New registration attempt received");
 	// Only allow POST
 	if (request.method !== 'POST') {
 	let body: unknown;
 	try {
 		body = await request.json();
-	} catch (err) {
+	} catch {
-		console.debug("Invalid JSON", err);
+		console.log("[Register] Invalid JSON payload received");
 		return new Response(JSON.stringify({ error: 'Invalid JSON' } as RegisterResponseError), { status: 400 });
 	}
 	// Destructure and validate required fields from the payload.
 	if (typeof suUsername !== 'string' || typeof suPassword !== 'string' ||
 	    typeof suConfirmPassword !== 'string' || typeof captchaAnswer !== 'string') {
-		console.debug("Missing or invalid input fields", { suUsername, suPassword, suConfirmPassword, captchaAnswer });
+		console.log("[Register] Missing or invalid input fields");
 		return new Response(JSON.stringify({ error: 'Missing or invalid input fields' } as RegisterResponseError), { status: 400 });
 	}
 	const expectedCaptcha = "point de rencontre";
 	// Get the IP address for rate limiting. In production, a more reliable method should be used.
 	const ip = request.headers.get('x-forwarded-for') || 'unknown';
+	const maskedIp = ip.split('.').map((octet, idx) => idx < 3 ? 'xxx' : octet).join('.');
 	const now = Date.now();
 	const attemptData = captchaAttempts.get(ip) || { count: 0, lastAttempt: 0 };
 	// If the user has failed three or more times, apply aggressive exponential backoff.
 	if (attemptData.count >= 3) {
 		const delay = Math.pow(2, attemptData.count - 3 + 1) * 1000; // delay in milliseconds
-		console.debug(`Applying exponential backoff delay of ${delay}ms for IP ${ip}`);
+		console.log(`[Register] Rate limit exceeded for IP ${maskedIp} - applying ${delay}ms delay`);
 		await sleep(delay);
 	}
 	if (captcha !== expectedCaptcha) {
 		attemptData.count++;
 		attemptData.lastAttempt = now;
 		captchaAttempts.set(ip, attemptData);
-		console.debug(`Captcha failed for IP ${ip}. Attempt count: ${attemptData.count}`);
+		console.log(`[Register] Captcha failed for IP ${maskedIp}. Attempt count: ${attemptData.count}`);
 		const remaining = Math.max(0, 3 - attemptData.count);
 		return new Response(JSON.stringify({ error: `Incorrect captcha answer. ${remaining > 0 ? remaining + " attempt(s) remaining." : "Please wait before trying again."}` } as RegisterResponseError), { status: 400 });
 	}
 	let hashedPassword: string;
 	try {
 		hashedPassword = await hashPassword(password);
-	} catch (err) {
+	} catch {
-		console.debug("Error hashing password", err);
+		console.log("[Register] Error hashing password");
 		return new Response(JSON.stringify({ error: 'Internal Server Error' } as RegisterResponseError), { status: 500 });
 	}
 	// Insert the new user into the database.
 			nickname: username,
 			createdAt: Date.now()
 		});
-		console.debug(`User ${username} registered successfully`);
+		console.log(`[Register] User ${username} registered successfully`);
 	} catch (err) {
-		console.debug("Database insertion error", err);
+		console.log("Database insertion error", err);
 		// Assume a duplicate user error if the email (or derived unique field) already exists.
 		return new Response(JSON.stringify({ error: 'User registration failed. Possibly user already exists.' } as RegisterResponseError), { status: 409 });
 	}

M src/routes/api/rooms/[roomId]/+server.ts +13 -3


@@ -14,7 +14,11 @@ export async function GET({ params, url, locals }): Promise<Response> {
14	14		}
15	15
16	16		try {
17		-	console.debug(`Fetching ${isPublic ? 'public' : 'private'} room data for room: ${roomId}`);
	17	+	console.log('[Rooms] Fetching room data:', {
	18	+	roomId,
	19	+	isPublic,
	20	+	requestedBy: locals.user ? `${locals.user.id.slice(0, 4)}...${locals.user.id.slice(-4)}` : 'public'
	21	+	});
18	22
19	23		// Fetch messages for the room (most recent then reversed for chronological order)
20	24		const messageQuery = db.select()

@@ -42,12 +46,18 @@ export async function GET({ params, url, locals }): Promise<Response> {
42	46		buddyList: sanitizedUsers
43	47		};
44	48
	49	+	console.log('[Rooms] Successfully fetched room data:', {
	50	+	roomId,
	51	+	userCount: sanitizedUsers.length,
	52	+	isPublic
	53	+	});
	54	+
45	55		return new Response(JSON.stringify(responseData), {
46	56		status: 200,
47	57		headers: { 'Content-Type': 'application/json' }
48	58		});
49		-	} catch (err) {
50		-	console.debug('Error fetching room data:', err);
	59	+	} catch {
	60	+	console.log('[Rooms] Error fetching room data:', { roomId });
51	61		const errorResponse: PublicRoomResponse = {
52	62		success: false,
53	63		error: 'Failed to fetch room data'

   }
   try {
-    console.debug(`Fetching ${isPublic ? 'public' : 'private'} room data for room: ${roomId}`);
+    console.log('[Rooms] Fetching room data:', {
+      roomId,
+      isPublic,
+      requestedBy: locals.user ? `${locals.user.id.slice(0, 4)}...${locals.user.id.slice(-4)}` : 'public'
+    });
     // Fetch messages for the room (most recent then reversed for chronological order)
     const messageQuery = db.select()
       buddyList: sanitizedUsers
     };
+    console.log('[Rooms] Successfully fetched room data:', {
+      roomId,
+      userCount: sanitizedUsers.length,
+      isPublic
+    });
     return new Response(JSON.stringify(responseData), {
       status: 200,
       headers: { 'Content-Type': 'application/json' }
     });
-  } catch (err) {
+  } catch {
-    console.debug('Error fetching room data:', err);
+    console.log('[Rooms] Error fetching room data:', { roomId });
     const errorResponse: PublicRoomResponse = {
       success: false,
       error: 'Failed to fetch room data'

M src/routes/api/status/+server.ts +4 -3


@@ -18,13 +18,14 @@ export async function POST({ request, cookies, locals }) {
18	18		}
19	19
20	20		const userId = locals.user.id;
21		-	console.debug('Updating status for user', userId, 'to', status);
	21	+	const maskedUserId = `${userId.slice(0, 4)}...${userId.slice(-4)}`;
	22	+	console.log('[Status] Updating user status:', { userId: maskedUserId, status });
22	23
23	24		// Update the user status in the database
24	25		await db.update(users)
25	26		.set({ status, lastSeen: status === 'offline' ? Date.now() : null })
26	27		.where(eq(users.id, userId));
27		-	console.debug('Status updated in database');
	28	+	console.log('[Status] Database updated successfully');
28	29
29	30		// Renew session if status is online and session is near expiry
30	31		if (status === 'online') {

@@ -39,7 +40,7 @@ export async function POST({ request, cookies, locals }) {
39	40		const newToken = generateSessionToken();
40	41		const newSession = await createSession(newToken, userId);
41	42		setSessionTokenCookie({ cookies }, newToken, newSession.expiresAt);
42		-	console.debug('Session renewed for user', userId);
	43	+	console.log('[Status] Session renewed:', { userId: maskedUserId, expiresAt: new Date(newSession.expiresAt).toISOString() });
43	44		}
44	45		}
45	46		}

     }
     const userId = locals.user.id;
-    console.debug('Updating status for user', userId, 'to', status);
+    const maskedUserId = `${userId.slice(0, 4)}...${userId.slice(-4)}`;
+    console.log('[Status] Updating user status:', { userId: maskedUserId, status });
     // Update the user status in the database
     await db.update(users)
         .set({ status, lastSeen: status === 'offline' ? Date.now() : null })
         .where(eq(users.id, userId));
-    console.debug('Status updated in database');
+    console.log('[Status] Database updated successfully');
     // Renew session if status is online and session is near expiry
     if (status === 'online') {
                     const newToken = generateSessionToken();
                     const newSession = await createSession(newToken, userId);
                     setSessionTokenCookie({ cookies }, newToken, newSession.expiresAt);
-                    console.debug('Session renewed for user', userId);
+                    console.log('[Status] Session renewed:', { userId: maskedUserId, expiresAt: new Date(newSession.expiresAt).toISOString() });
                 }
             }
         }

M src/routes/api/users/[userId]/+server.ts +10 -5


@@ -5,7 +5,8 @@ import { eq } from 'drizzle-orm';
5	5		import type { RequestHandler } from './$types';
6	6
7	7		export const GET: RequestHandler = async ({ params }) => {
8		-	console.debug('GET /api/users/[userId] called with params:', params);
	8	+	const maskedUserId = `${params.userId.slice(0, 4)}...${params.userId.slice(-4)}`;
	9	+	console.log('[Users] Fetching user data:', { userId: maskedUserId });
9	10
10	11		try {
11	12		const user = await db.select({

@@ -20,17 +21,21 @@ export const GET: RequestHandler = async ({ params }) => {
20	21		.get();
21	22
22	23		if (!user) {
23		-	console.debug('User not found:', params.userId);
	24	+	console.log('[Users] User not found:', { userId: maskedUserId });
24	25		throw error(404, 'User not found');
25	26		}
26	27
27		-	console.debug('User found:', user);
	28	+	console.log('[Users] User data retrieved:', {
	29	+	userId: maskedUserId,
	30	+	status: user.status,
	31	+	lastSeen: user.lastSeen ? new Date(user.lastSeen).toISOString() : null
	32	+	});
28	33		return json({
29	34		success: true,
30	35		user
31	36		});
32		-	} catch (err) {
33		-	console.debug('Error fetching user:', err);
	37	+	} catch {
	38	+	console.log('[Users] Error fetching user data:', { userId: maskedUserId });
34	39		throw error(500, 'Failed to fetch user information');
35	40		}
36	41		};⏎̸

 import type { RequestHandler } from './$types';
 export const GET: RequestHandler = async ({ params }) => {
-    console.debug('GET /api/users/[userId] called with params:', params);
+    const maskedUserId = `${params.userId.slice(0, 4)}...${params.userId.slice(-4)}`;
+    console.log('[Users] Fetching user data:', { userId: maskedUserId });
     try {
         const user = await db.select({
         .get();
         if (!user) {
-            console.debug('User not found:', params.userId);
+            console.log('[Users] User not found:', { userId: maskedUserId });
             throw error(404, 'User not found');
         }
-        console.debug('User found:', user);
+        console.log('[Users] User data retrieved:', {
+            userId: maskedUserId,
+            status: user.status,
+            lastSeen: user.lastSeen ? new Date(user.lastSeen).toISOString() : null
+        });
         return json({
             success: true,
             user
         });
-    } catch (err) {
+    } catch {
-        console.debug('Error fetching user:', err);
+        console.log('[Users] Error fetching user data:', { userId: maskedUserId });
         throw error(500, 'Failed to fetch user information');
     }
 };⏎̸