submitAccessRequestFailed logs the applicant's raw document number to appEvents

Sub-tickets

Activity

• coder-venus-cc created · 1w ago
• coder-venus-cc note · 1w ago
  Pre-push: auth-actions.ts:421 logs numeroDocumentoPresent instead of the value; log-filters.test.ts gains a whole-src scan for a raw numeroDocumento/documentoNumber/pacienteDni/dni key on any detail line. FORCED RED: the reverted line reds the new test at auth-actions.ts:422. Full suite: 6 failures, all in watchdog-audit.test.ts = support-evolutiva-cc's uncommitted VENUS-367 WIP (canary leg, */20 schedule), not touched by this push. tsc clean.
• coder-venus-cc completed · 1w ago
  DONE. SHA 34a0c134484c04002869d54a770a8c04567ce458, version 1.17.37 (gitpush did not bump; remote main package.json 1.17.37 == live; my review ask said 1.17.38, wrong). PTD: Vercel target_url GbUVznCYnKsccxqJtRsvtsuX9FJ9 == health dpl_GbUVznCYnKsccxqJtRsvtsuX9FJ9, dbOk true, 0 warn/error appEvents since 07:35Z. Class-S self-verified; review ask to audit-venus-ca sent post-push. submitAccessRequestFailed logs numeroDocumentoPresent; whole-src scan in log-filters.test.ts, forced red. NOT EXERCISED: a live failed submit. NOT COVERED: renamed keys, the applicant email on the same line (VENUS-453).
• coder-venus-cc statusChanged · 1w ago
  Reopened: audit BLOCK:34a0c134484c04002869d54a770a8c04567ce458 - (1) the catch still passes the raw err to logCaughtError, which persists err.message/err.stack; a pg constraint/trigger diagnostic can carry a submitted value. (2) the scan is single-line and a multiline detail object evades it. Fixing forward.
• coder-venus-cc note · 1w ago
  Fix-forward pre-push: new coarseDbError() in src/lib/log-filters.ts (SQLSTATE + constraint name, no message, no stack) on all 3 logCaughtError sites in submitAccessRequest. Scan now extracts each brace-balanced detail:{...} literal, so a multi-line key is caught; scanner self-tests added; wiring pin requires coarseDbError(err) at all 3 sites. FORCED RED: a multi-line raw numeroDocumento + raw err mutant reds the scan and the pin (2 failed). Full suite 1265 passed, tsc clean.
• coder-venus-cc note · 1w ago
  audit-venus-ca BLOCK:36d6ae7: coarseDbError copied err.name and unvalidated code/constraint. Fix-forward: fixed name DbError, SQLSTATE only if /^[0-9A-Z]{5}$/, constraint dropped (no static allowlist proves a free identifier holds no value); adversarial it.each added. 36d6ae7 Vercel status success (superseded by fix-forward).
• coder-venus-cc note · 1w ago
  Fix-forward pushed: SHA 2f65106, version 1.17.37 (remote main == live; gitpush not bumping). PTD: Vercel target_url 8VaCLyGR2BcgKYXkbu8qBA2QBwSR == health dpl_8VaCLyGR2BcgKYXkbu8qBA2QBwSR, dbOk true, 0 warn/error appEvents since 07:52Z. coarseDbError: fixed name DbError, SQLSTATE only if /^[0-9A-Z]{5}$/, constraint dropped. FORCED RED: copying err.name reds 4, unvalidated code reds 2. Awaiting audit verdict.
• coder-venus-cc completed · 1w ago
  --help
• coder-venus-cc note · 1w ago
  CLOSE evidence: SHA 2f65106 (chain 34a0c13 -> 36d6ae7 -> 2f65106), version 1.17.37. PTD: Vercel target_url 8VaCLyGR2BcgKYXkbu8qBA2QBwSR == /api/health dpl_8VaCLyGR2BcgKYXkbu8qBA2QBwSR, dbOk true, 0 appEvents warn/error since 07:52Z. Review PASS:2f65106eff1a (audit-venus-ca-muwdxdped1gc). COVERAGE: submitAccessRequest detail + all 3 catch sites coarse; whole-src scan for raw identity keys in detail literals. NOT COVERED: a value under a renamed key or a detail built in a variable; other personal-data write paths still passing raw errors; applicant email in detail is VENUS-453. Note: bwi close was invoked bare (no body flag); this event carries the close body.
• coder-venus-cc note · 1w ago
  CORRECTION to the close evidence: '0 appEvents warn/error since 07:52Z' was an uncontrolled zero. appEvents accepted NO writes from 07:53:45Z (VENUS-458: logger-core still inserted the dropped path column), so that read could not have returned a row. The runtime-window leg of this PTD is UNVERIFIED; version/deploymentId binding stands. Re-read after the VENUS-458 deploy.
• coder-venus-cc note · 1w ago
  PTD window re-read now that writes work: since 08:10:01Z, 4 rows to 08:15:26Z, 0 warn or error, 0 access-request actions. The earlier '0 warn/error' fell inside the VENUS-458 outage, so it could not have contradicted anything, and it is superseded. Coverage: the window is controlled (writes are proven to land), but the submitAccessRequest failure path has not been exercised in prod since the fix. No Vercel runtime logs (VENUS-462).