Documentation
¶
Overview ¶
Package logging builds the server's one logger: slog, JSON, to stdout, with a redaction layer wrapped around it.
The redaction layer is the point of the package. A secret reaches a log line by accident, never on purpose — a connection string inside a pgx error, an Authorization header swept up by a request dump, an API key logged while someone was debugging at two in the morning. So the handler treats redaction as its job rather than the caller's: it rewrites attribute values whose key names a secret, and it scrubs message and string values for the shapes a secret has. A caller cannot opt out, and forgetting to think about it is the safe default.
What it cannot do is read minds. A password logged under the key "detail" with no recognisable shape goes through. The rule for callers stays: log the name of a thing, not the thing.
Index ¶
Constants ¶
const Redacted = "[redacted]"
Redacted replaces every value this package removes. It is a fixed string, so a log search for it finds every place a secret was on its way out.
Variables ¶
This section is empty.
Functions ¶
func Discard ¶
Discard is a logger that writes nothing. Tests that do not assert on log output use it so a test run stays readable.
func New ¶
New builds the server's logger. Every line is JSON on one line, which is what a log shipper wants and what `jq` reads, and every line has passed through the redactor.
Types ¶
type Options ¶
type Options struct {
// Level is the minimum level that reaches the output. The zero value is
// [slog.LevelInfo].
Level slog.Level
// Output is where lines are written. nil means os.Stdout.
Output io.Writer
// AddSource attaches the file and line of the call site. Off by default:
// it costs a stack walk per line.
AddSource bool
}
Options configures New. The zero value is valid: info level to stdout.
Source Files