exclude one-character secrets as well

Signed-off-by: Fredrik Adelöw <freben@gmail.com>

.changeset/spicy-rice-build.md

@@ -2,4 +2,4 @@
 '@backstage/backend-common': patch
 ---
 
-Do not redact the empty string, destroying all logs
+Do not redact empty or one-character strings. These imply that it's just a test or local dev, and unnecessarily ruin the log output.

packages/backend-common/src/logging/rootLogger.test.ts

@@ -48,15 +48,15 @@ describe('rootLogger', () => {
     );
   });
 
-  it('redacts but ignores empty secrets', () => {
+  it('redacts but ignores empty and one-character secrets', () => {
     const logger = createRootLogger();
     jest.spyOn(logger, 'write');
-    setRootLoggerRedactionList(['SECRET-1', 'SECRET_2', '']);
-    logger.info('Logging SECRET-1 and SECRET_2');
+    setRootLoggerRedactionList(['SECRET-1', 'SECRET_2', 'Q', '']);
+    logger.info('Logging SECRET-1 and SECRET_2 and Q');
 
     expect(logger.write).toHaveBeenCalledWith(
       expect.objectContaining({
-        message: 'Logging [REDACTED] and [REDACTED]',
+        message: 'Logging [REDACTED] and [REDACTED] and Q',
       }),
     );
   });

packages/backend-common/src/logging/rootLogger.ts

@@ -34,7 +34,11 @@ export function setRootLogger(newLogger: winston.Logger) {
 }
 
 export function setRootLoggerRedactionList(redactionList: string[]) {
-  const filtered = redactionList.filter(Boolean);
+  // Exclude secrets that are empty or just one character in length. These
+  // typically mean that you are running local dev or tests, or using the
+  // --lax flag which sets things to just 'x'. So exclude those.
+  const filtered = redactionList.filter(r => r.length > 1);
+
   if (filtered.length) {
     redactionRegExp = new RegExp(
       `(${filtered.map(escapeRegExp).join('|')})`,