dohertj2/scadaproj
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(telemetry): redact after ConfigureLogger enrichers, keep colliding dictionary keys, require http(s) OTLP endpoint and validate the options overload; bump 0.2.1 (scadaproj#48)

Browse Source 
Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV
This commit is contained in:
Joseph Doherty
2026-11-09 14:57:48 -05:00
parent 5bf2f2caf1
commit 1786bab0a0
12 changed files with 182 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code-reviews/Telemetry/findings.md
+7 -7
View File
@@ -10,7 +10,7 @@
| Last reviewed | 2026-11-09 (re-review; baseline 2026-06-01 at `5f75cd4`) |
| Reviewer | Claude (2026-11-09 re-review, scadaproj#15; baseline: Claude automated) |
| Commit reviewed | `91fb2b4` |
| Open findings | 3 |
| Open findings | 0 |
## Summary
@@ -397,7 +397,7 @@ shared-contract summary.
| Severity | Low |
| Priority | P3 |
| Category | Security & secret handling |
| Status | Open |
| Status | Resolved |
| Location | `ZB.MOM.WW.Telemetry/src/ZB.MOM.WW.Telemetry.Serilog/ZbSerilogExtensions.cs:118-120`, `ZB.MOM.WW.Telemetry/src/ZB.MOM.WW.Telemetry.Serilog/ZbSerilogOptions.cs:41-46` |
**Description**
@@ -431,7 +431,7 @@ asserts it is redacted.
**Resolution**
_Unresolved._
Resolved 2026-11-09 in the commit tagged `(scadaproj#48)` (Telemetry `0.2.1`, unpublished) — `AddZbSerilogCore` now applies the shared enrichers with no provider, invokes `ConfigureLogger`, then registers `RedactionEnricher` last (new internal `ZbSerilogConfig.ApplyRedaction`; `Apply(…, sp)` still includes redaction for direct callers). Option doc updated. Test `Properties_stamped_by_ConfigureLogger_enrichers_are_redacted` (failed without the fix: `apiKey` reached the sink raw).
### Telemetry-010 — Redaction projection keys logged dictionaries by `ToString()`, silently dropping entries whose keys stringify identically
@@ -440,7 +440,7 @@ _Unresolved._
| Severity | Low |
| Priority | P3 |
| Category | Correctness & logic bugs |
| Status | Open |
| Status | Resolved |
| Location | `ZB.MOM.WW.Telemetry/src/ZB.MOM.WW.Telemetry.Serilog/RedactionEnricher.cs:134-143` (projection), `:163-173` (rebuild) |
**Description**
@@ -470,7 +470,7 @@ colliding keys.
**Resolution**
_Unresolved._
Resolved 2026-11-09 in the commit tagged `(scadaproj#48)` (Telemetry `0.2.1`, unpublished) — `RedactionEnricher.Project` keeps every dictionary entry: a key whose string form collides gets a `#n` suffix in the redactor's view and `OriginalKeys` restores the real key on rebuild. Test `Dictionary_keys_that_print_identically_are_all_kept` (two `DateTime` keys differing by milliseconds, no-op redactor; failed without the fix: one entry survived).
### Telemetry-011 — OTLP fail-fast validation accepts scheme-less `host:port` and is skipped by the pre-built-options `AddZbTelemetry` overload
@@ -479,7 +479,7 @@ _Unresolved._
| Severity | Low |
| Priority | P3 |
| Category | Error handling & resilience |
| Status | Open |
| Status | Resolved |
| Location | `ZB.MOM.WW.Telemetry/src/ZB.MOM.WW.Telemetry/ZbTelemetryOptionsValidator.cs:36`, `ZB.MOM.WW.Telemetry/src/ZB.MOM.WW.Telemetry/ZbTelemetryExtensions.cs:40-46` |
**Description**
@@ -514,4 +514,4 @@ Require `uri.Scheme` to be `http` or `https` (the OTLP gRPC/HTTP schemes) and a
**Resolution**
_Unresolved._
Resolved 2026-11-09 in the commit tagged `(scadaproj#48)` (Telemetry `0.2.1`, unpublished) — `ZbTelemetryOptionsValidator` now requires an absolute `http`/`https` URI with a host (`localhost:4317`, `otel-collector:4317`, `ftp://…` rejected); `AddZbTelemetry(IServiceCollection, ZbTelemetryOptions)` now runs the same ServiceName + OTLP validation as the lambda overloads (param name `options`). Tests `AddZbTelemetry_Throws_WhenOtlpEndpointIsSchemeLessOrNotHttp` and `AddZbTelemetry_PrebuiltOptionsOverload_ValidatesServiceNameAndOtlpEndpoint` (failed without the fix). Behaviour change: configs with a scheme-less endpoint now fail at startup, as Telemetry-006 intended.