fix(log): redact single-use path tokens in the morgan access log

[PierreBrisorgueil]

Summary

• What changed: redactPathSecrets() now runs on both branches of redactUrl() (with and without a query string), so single-use tokens carried as PATH parameters — password-reset, email-verify and invitation links — are redacted before reaching the morgan access log.
• Why: redactUrl() only scrubbed the query string. A URL with no ? (e.g. GET /api/auth/reset/:token) was returned verbatim, so a legitimate click on a reset/verify-email/invitation link wrote the still-valid, replayable token straight into the server access log. fix(analytics): redact single-use path tokens before auto-capture (#3932) #3935 already redacted the analytics sink but missed this access-log path.
• Related issues: Closes 🔒 Redact single-use path tokens in the access log #3951

Scope

• Module(s) impacted: lib/helpers/redactUrl.js, lib/services/express.js (morgan :url token wiring, comment only)
• Cross-module impact: none
• Risk level: low

Validation

• npm run lint
• npm test
• Manual checks done (if applicable)

Guardrails check

• No secrets or credentials introduced (.env*, secrets/**, keys, tokens)
• No risky rename/move of core stack paths
• Changes remain merge-friendly for downstream projects
• Tests added or updated when behavior changed

Notes for reviewers

• Security considerations: 7 new unit tests added (red-green: each failed against the pre-fix redactUrl() before the fix, now pass) covering reset/verify-email/invitation path tokens, with and without a trailing query string, and a combined path+query redaction case.
• Mergeability considerations: none — additive, no downstream config surface changed.
• Follow-up tasks (optional): none.

https://claude.ai/code/session_01WfNC8bt1TgL4AsiYgCEGup

Summary by CodeRabbit

• Bug Fixes
  • Sensitive single-use tokens in URL paths are now redacted from logs.
  • Sensitive query parameters continue to be scrubbed, including when combined with secrets in the URL path.
  • Non-sensitive URLs and query parameters remain unchanged.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.70%. Comparing base (7c7c0bf) to head (5116dae).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #3955   +/-   ##
=======================================
  Coverage   92.70%   92.70%           
=======================================
  Files         169      169           
  Lines        5563     5563           
  Branches     1791     1790    -1     
=======================================
  Hits         5157     5157           
  Misses        326      326           
  Partials       80       80           

Flag	Coverage Δ
integration	61.04% <0.00%> (ø)
unit	74.40% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 7c7c0bf...5116dae. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 2acb3f6b-60fc-470f-a7b2-d02dd3a13af7

📥 Commits

Reviewing files that changed from the base of the PR and between 7c7c0bf and 5116dae.

📒 Files selected for processing (3)

• lib/helpers/redactUrl.js
• lib/helpers/tests/redactUrl.unit.tests.js
• lib/services/express.js

---

Walkthrough

redactUrl now redacts single-use secrets in URL paths alongside query parameters. Tests cover reset, email verification, and invitation tokens, while the Morgan token comment documents both redaction paths.

Changes

URL secret redaction

Layer / File(s)	Summary
Path and query redaction lib/helpers/redactUrl.js, lib/helpers/tests/redactUrl.unit.tests.js, lib/services/express.js	redactUrl sanitizes sensitive path segments with or without query strings; tests cover token routes and combined path/query redaction, and the Morgan comment reflects the updated behavior.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: redacting single-use path tokens from the morgan access log.
Description check	✅ Passed	The description follows the template well and includes summary, scope, validation, guardrails, and reviewer notes.
Linked Issues check	✅ Passed	The changes satisfy #3951 by redacting path tokens on both code paths and adding tests for the access-log behavior.
Out of Scope Changes check	✅ Passed	The diff stays within scope, limited to the helper fix, matching tests, and a non-functional comment update.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/3951-redact-path-tokens-in-access-log

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install timed out. The project may have too many dependencies for the sandbox.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}