appEvents detail still logs alumno/admin email under key 'email'

Sub-tickets

Activity

• coder-venus-cc created · 1w ago
• coder-venus-cc note · 1w ago
  SITE FOUND outside the previously recorded list, during the VENUS-460 appEvents writer census: scripts/repair-access-grant.ts:149-156 writes an appEvents row whose detail carries { email: canonicalEmail } - the access requester's address, i.e. a student address, under the key 'email'. Same defect family and same key as the admin-actions/alumnos-actions sites already on this row. It is a CLI script rather than a route, so it is not reachable by a user, but appEvents is appEvents: the row is append-only (trg_appevents_immutable) and is read by rails and digests that leave the DB, so the write is exactly as unretractable. Fold it into the VENUS-456 batch.
• coder-venus-cc statusChanged · 1w ago
  Scope widened by scanner: extended log-filters RECIPIENT_KEY with email/newEmail (force-red) -> 38 sites in 4 files (admin-actions 14, alumnos-actions 6, alumnos-import 3, auth-actions 15 - last not in filed list). db-venus-cc: 0 readers of detail.email, 0 rows 30d. Remedy: drop where a synthetic id is present, else emailPresent boolean. No row purge.
• coder-venus-cc note · 1w ago
  Pushing: RECIPIENT_KEY += email/newEmail (force-red 38 sites), producers drop email where requestId/authUserId/titularUserId/rowIndex present else emailPresent:Boolean. No purge of existing rows. Also carries db handoff a3bd9dc (VENUS-473/469/86).
• audit-venus-ca audited · 1w ago
  audit fail: Source review of commit 7536dae6fedb4b1eab2930d2dade13461ec35213, email/newEmail appEvents redaction; excludes co-pushed DB handoff a3bd9dc
  payload

  {"scope":"Source review of commit 7536dae6fedb4b1eab2930d2dade13461ec35213, email/newEmail appEvents redaction; excludes co-pushed DB handoff a3bd9dc","outcome":"fail","evidence":"BLOCK: literal email/newEmail detail keys removed, but alumnos-actions.ts createAlumnoJwtMirrorFailed and alumnos-import-actions.ts alumnosImportJwtMirrorFailed still copy raw exception message into appEvents.detail.error. An address-bearing upstream error therefore reaches detail; RECIPIENT_KEY scans keys only. Require coarse metadata/omission plus adversarial address-bearing test. Raw logCaughtError errorMessage/errorStack also remain outside key-scanner coverage; whole-row PII removal not established. Static-only; no live error/prod row exercised. Verdict sent coder-venus-cc on thread coder-venus-cc-muzrn0t84hba.","reportRef":null}

• coder-venus-cc note · 1w ago
  Fixup 5027781 (1.17.44): coarseAuthError at both JWT-mirror detail.error sites + value test + source arm (forced red on the prior form). errorMessage/errorStack raw-message gap split to new row (above). Scope of 456 = detail keys only; NOT a whole-row PII removal claim.
• audit-venus-ca audited · 1w ago
  audit pass: Source re-review of 5027781418ee0c1b1278ac4f43b8b83875f6843f plus original 7536dae email/newEmail detail-key removals; excludes co-pushed DB handoff
  payload

  {"scope":"Source re-review of 5027781418ee0c1b1278ac4f43b8b83875f6843f plus original 7536dae email/newEmail detail-key removals; excludes co-pushed DB handoff","outcome":"pass","evidence":"PASS scoped to appEvents.detail literal email-address removal: applicant JWT-mirror detail.error at both sites now uses coarseAuthError, which retains bounded numeric status and syntax-gated snake_case code, not message; address-bearing tests and per-site source pins added. NOT COVERED: logCaughtError errorMessage/errorStack, tracked as VENUS-483. Source review only; no live auth failure, appEvents row, or independent PTD read exercised. Verdict sent coder-venus-cc on thread coder-venus-cc-muzrrsi1ph2w.","reportRef":null}

• coder-venus-cc completed · 1w ago
  Done. SHAs 7536dae (1.17.43) + fixup 5027781 (1.17.44). PTD: live dpl_9ws9ogaPsXKhdSQxTM1vPnQanAX4 == Vercel status id for 5027781; remote package.json 1.17.44. audit-venus-ca BLOCK:7536dae -> PASS:5027781. Scope: email/newEmail detail keys + applicant JWT-mirror detail.error only; source-only verdict, no live auth failure exercised. errorMessage/errorStack raw-message gap = VENUS-483. Existing rows not purged (no proactive DB edits).