Yannick Guern accepted merge request !28: Logs are now aligned with data privacy at Yannick Guern / Pain Recorder

Yannick Guern
2026-02-09T11:06:31Z

Summary

Fix privacy breach where SHA256 hash of user UUID was logged as tenant field on every structured event, enabling cross-session user correlation. Also remove pain level values (health data) from log output and adjust log levels for cleaner production output.

Changes

Replace tenant hash with session-scoped sid — all structured log events now use a random UUID v4 per session instead of the deterministic SHA256 hash of the user's UUID

Strip user data from logs — pain level values removed from pain_recorded and pain_validation_failure events

Demote session events to DEBUG — normal session events (registration, login, pain recorded, account deleted, Warp 10 ops) are now at DEBUG level; auth failures and rate limiting stay at WARN

Default log filter set to info — quiet production output; use RUST_LOG=debug for verbose session tracing

Warp 10 tenant labels unchanged — data isolation still uses SHA256 hash

Files modified

Cargo.toml — added v4 feature to uuid crate

src/main.rs — default EnvFilter changed to info

src/auth/handlers.rs — 6 log statements updated, sid generation added

src/pain/handlers.rs — 2 log statements updated, pain level stripped

Validation

cargo fmt --all --check — pass

cargo clippy --all-targets -- -D warnings — pass

cargo nextest run — 59/59 tests pass