From 0fab38d5547d9d69d47726de7618faaa2d4c0425 Mon Sep 17 00:00:00 2001 From: Lars Francke Date: Thu, 19 Feb 2026 08:26:59 +0100 Subject: [PATCH 1/7] WIP logging --- .claude/skills/code-reviewer/SKILL.md | 24 ++- .env.example | 5 + AGENTS.md | 34 ++++ package.json | 20 +- src/app.d.ts | 9 +- src/hooks.server.ts | 18 +- .../logging/__mocks__/app-environment.ts | 2 + .../logging/__mocks__/env-dynamic-private.ts | 1 + src/lib/server/logging/index.ts | 24 +++ src/lib/server/logging/logger.ts | 52 +++++ src/lib/server/logging/redaction.test.ts | 96 ++++++++++ src/lib/server/logging/redaction.ts | 42 +++++ src/lib/server/logging/request-logger.test.ts | 178 ++++++++++++++++++ src/lib/server/logging/request-logger.ts | 42 +++++ src/lib/server/logging/types.ts | 13 ++ src/routes/(app)/+page.server.ts | 15 ++ src/routes/(app)/page.svelte.spec.ts | 39 ++++ vite.config.ts | 33 +++- 18 files changed, 633 insertions(+), 14 deletions(-) create mode 100644 src/lib/server/logging/__mocks__/app-environment.ts create mode 100644 src/lib/server/logging/__mocks__/env-dynamic-private.ts create mode 100644 src/lib/server/logging/index.ts create mode 100644 src/lib/server/logging/logger.ts create mode 100644 src/lib/server/logging/redaction.test.ts create mode 100644 src/lib/server/logging/redaction.ts create mode 100644 src/lib/server/logging/request-logger.test.ts create mode 100644 src/lib/server/logging/request-logger.ts create mode 100644 src/lib/server/logging/types.ts create mode 100644 src/routes/(app)/page.svelte.spec.ts diff --git a/.claude/skills/code-reviewer/SKILL.md b/.claude/skills/code-reviewer/SKILL.md index dcd41242..3a442372 100644 --- a/.claude/skills/code-reviewer/SKILL.md +++ b/.claude/skills/code-reviewer/SKILL.md @@ -84,6 +84,17 @@ Common duplication areas: - Superforms used correctly with Zod schemas? - Zod schemas defined once, not duplicated? +**Logging (server-side code only):** + +- Server-side load functions, API endpoints, and hooks should include logging at appropriate levels +- Uses `event.locals.logger` (request-scoped) in request handlers, not the root `logger` import +- Module-level singletons/services use `logger.child({ module: '...' })`, not bare `console.log` +- Context object first, message string second: `log.info({ user_id }, 'User logged in')` +- Field names use snake_case consistently (`request_id`, `user_id`, `duration_ms`, `status_code`) — not camelCase variants +- Tokens, credentials, passwords, or full request/session objects are never logged directly +- If new sensitive fields are logged, redaction paths should be added to `src/lib/server/logging/redaction.ts` +- No leftover `console.log`/`console.error` in server code (use pino logger instead) + **Accessibility (BITV 2.0 / WCAG 2.1 AA):** - Semantic HTML elements used (`