Bug: log caught errors instead of silently returning sanitized responses #212

New issue

Closed

opened 2026-06-27 11:11:30 -05:00 by erik · 2 comments

erik commented

2026-06-27 11:11:30 -05:00

Owner

Problem

Caught server-side errors can be converted into user-facing responses without being logged, making production failures hard to diagnose.

Observed while debugging passkey registration on slugkit.com: /settings/passkeys/register returned Could not verify passkey registration, but pod logs did not include the underlying verification error or stack trace.

Expected

Any caught exception should be logged server-side before returning a sanitized response.

Scope

Audit route/API catch blocks for swallowed errors.
Add structured error logging with safe context.
Do not log secrets, tokens, full credential payloads, API keys, or session cookies.
Include enough context to debug: route/action, status category, user/email when safe, challenge/request IDs when safe, and stack traces for exceptions.

Acceptance criteria

Passkey registration failures emit useful server logs.
Other caught route/API errors are logged consistently.
Tests or documented verification cover at least one caught-error path.

## Problem Caught server-side errors can be converted into user-facing responses without being logged, making production failures hard to diagnose. Observed while debugging passkey registration on slugkit.com: `/settings/passkeys/register` returned `Could not verify passkey registration`, but pod logs did not include the underlying verification error or stack trace. ## Expected Any caught exception should be logged server-side before returning a sanitized response. ## Scope - Audit route/API catch blocks for swallowed errors. - Add structured error logging with safe context. - Do not log secrets, tokens, full credential payloads, API keys, or session cookies. - Include enough context to debug: route/action, status category, user/email when safe, challenge/request IDs when safe, and stack traces for exceptions. ## Acceptance criteria - Passkey registration failures emit useful server logs. - Other caught route/API errors are logged consistently. - Tests or documented verification cover at least one caught-error path.

erik added the

labels

2026-06-27 11:11:30 -05:00

erik commented

2026-06-27 19:01:44 -05:00

Author

Owner

Synced from todu comment by @todu on 2026-06-27T23:58:12.343Z

Review update

PR: #218 is open with Forgejo CI passing.
Result: approved.
Follow-up: waiting for explicit human merge approval.

Acceptance criteria: 3/3 met. Blocking issues: 0. Warnings: 0.

_Synced from todu comment by @todu on 2026-06-27T23:58:12.343Z_ ### Review update - PR: https://forge.caradoc.com/erik/slugkit/pulls/218 is open with Forgejo CI passing. - Result: approved. - Follow-up: waiting for explicit human merge approval. Acceptance criteria: 3/3 met. Blocking issues: 0. Warnings: 0.

erik

2026-06-27 23:02:45 -05:00

closed this issue
added
status:done
and removed
status:inprogress
labels

erik commented

2026-06-27 23:02:46 -05:00

Author

Owner

Synced from todu comment by @todu on 2026-06-28T04:00:23.390Z

Close gate

Readiness: READY

Evidence:

PR #218 (fix: log sanitized caught errors) was reviewed/approved with Forgejo CI passing and acceptance criteria reported 3/3 met.
Local main is fast-forwarded to origin/main at 859ed3c, merge commit for PR #218.

Acceptance criteria:

Passkey registration failures emit useful server logs — met via merged PR #218 and review evidence.
Other caught route/API errors are logged consistently — met via merged PR #218 and review evidence.
Tests or documented verification cover at least one caught-error path — met via review evidence reporting 3/3 acceptance criteria met.

Next action: close task.

_Synced from todu comment by @todu on 2026-06-28T04:00:23.390Z_ ### Close gate Readiness: READY Evidence: - PR #218 (`fix: log sanitized caught errors`) was reviewed/approved with Forgejo CI passing and acceptance criteria reported 3/3 met. - Local `main` is fast-forwarded to `origin/main` at `859ed3c`, merge commit for PR #218. Acceptance criteria: - Passkey registration failures emit useful server logs — met via merged PR #218 and review evidence. - Other caught route/API errors are logged consistently — met via merged PR #218 and review evidence. - Tests or documented verification cover at least one caught-error path — met via review evidence reporting 3/3 acceptance criteria met. Next action: close task.