backend: add some todos for redacting secrets from logs

Co-authored-by: Harry Hogg <harry@hogg.io>
Signed-off-by: Himanshu Mishra <himanshu@orkohunter.net>

packages/backend-common/src/config.ts

@@ -21,6 +21,7 @@ import { findPaths } from '@backstage/cli-common';
 import { Config, ConfigReader } from '@backstage/config';
 import { JsonValue } from '@backstage/types';
 import { loadConfig } from '@backstage/config-loader';
+import { setRootLoggerFilteredKeys } from './logging';
 
 export class ObservableConfigProxy implements Config {
   private config: Config = new ConfigReader({});
@@ -186,6 +187,6 @@ export async function loadBackendConfig(options: {
   );
 
   config.setConfig(ConfigReader.fromConfigs(configs));
-
+  setRootLoggerFilteredKeys({ 'secret-1': 'GOATS', 'secret-2': 'SHARKS' });
   return config;
 }

packages/backend-common/src/logging/rootLogger.ts

@@ -15,11 +15,22 @@
  */
 
 import { merge } from 'lodash';
+import { Config } from '@backstage/config';
 import * as winston from 'winston';
 import { LoggerOptions } from 'winston';
 import { coloredFormat } from './formats';
 
+type FilteredKeys = Record<string, string>;
+
 let rootLogger: winston.Logger;
+let filteredKeys: FilteredKeys;
+
+/**
+ {
+    secret-1: 'integrations.github[0].token',
+    secrets-2: 'something'
+ }
+ */
 
 /** @public */
 export function getRootLogger(): winston.Logger {
@@ -31,16 +42,31 @@ export function setRootLogger(newLogger: winston.Logger) {
   rootLogger = newLogger;
 }
 
+export function setRootLoggerFilteredKeys(_filteredKeys: FilteredKeys) {
+  filteredKeys = _filteredKeys;
+}
+
 /** @public */
 export function createRootLogger(
   options: winston.LoggerOptions = {},
   env = process.env,
 ): winston.Logger {
+  // TODO(Harry/Himanshu): Get the config schema, filter all the configs with @visibility secret, and pass that to winston so that it can mask it in the logs. https://github.com/winstonjs/winston/issues/1079#issuecomment-382861053
+
   const logger = winston.createLogger(
     merge<LoggerOptions, LoggerOptions>(
       {
         level: env.LOG_LEVEL || 'info',
         format: winston.format.combine(
+          winston.format(info => {
+            // TODO(Harry/Himanshu): Iterate over all secrets, and substitute info.message string. Or dynamically create regex from all the secrets and do a one time substitution.
+            // example: info.message = info.message.replace(new RegExp('abc123', 'g'), "**[Redacted: Config integration.github.token]**");
+            // Make sure do it in a case-insensitive way
+            Object.entries(filteredKeys || {}).forEach(([key, value]) => {
+              info.message = info.message.replace(new RegExp(key, 'g'), value);
+            });
+            return info;
+          })(),
           env.NODE_ENV === 'production' ? winston.format.json() : coloredFormat,
         ),
         defaultMeta: {

packages/backend/src/index.ts

@@ -88,6 +88,8 @@ async function main() {
   });
   const createEnv = makeCreateEnv(config);
 
+  logger.info('hiiiii secret-1');
+
   const healthcheckEnv = useHotMemoize(module, () => createEnv('healthcheck'));
   const catalogEnv = useHotMemoize(module, () => createEnv('catalog'));
   const codeCoverageEnv = useHotMemoize(module, () =>