log

func From ¶

func From(ctx context.Context) *zap.Logger

From returns the logger in ctx, or a no-op logger.

It never returns nil, so a caller that forgot to seed the context gets silence rather than a panic. Losing a log line is bad; taking down a request path because of one is worse.

func Into ¶

func Into(ctx context.Context, l *zap.Logger) context.Context

Into returns a context carrying l.

func New ¶

func New(level string, development bool) (*zap.Logger, error)

New builds the application logger. Production emits JSON; development emits human-readable console output.

func Untrusted ¶

func Untrusted(key, value string) zap.Field

Untrusted is zap.String for a value that came from a request.

A request path reaches a handler percent-decoded, so a caller can put a newline in one. A newline in a log line ends it, and what follows is a second line indistinguishable from one Pando wrote — the caller choosing what the record of its own request says.

Both of zap's encoders happen to prevent that today: the JSON encoder escapes control characters, and the console encoder writes the field block as JSON and escapes them too. That makes this belt and braces, and it is worth having because the property is currently owned by a dependency's choice of encoder rather than by any code here. Sanitizing at the call site means the guarantee survives a different encoder, a different logger, or a value that reaches an io.Writer some other way.

Newlines, carriage returns and tabs become spaces — the three control characters with an obvious readable substitute. Everything else unprintable becomes U+FFFD: an ANSI escape in a path is not a forged line, but it can repaint the terminal of whoever is reading the log, and nothing Pando logs has a use for one.

func With ¶

func With(ctx context.Context, fields ...zap.Field) context.Context

With returns a context whose logger carries the additional fields. This is how request_id, principal_id and app_id accumulate as a request descends through the layers that know them.