chore(@console|@profile): remove database credentials from logs

libs/juava/src/security.ts

@@ -76,3 +76,13 @@ export function decrypt(secret: string, iv: string, value: string): string {
   const decrypted = Buffer.concat([decipher.update(Buffer.from(value, "hex")), decipher.final()]);
   return decrypted.toString();
 }
+
+export function hideSensitiveInfo(url: string) {
+  try {
+    const parsedUrl = new URL(url);
+    parsedUrl.password = "****";
+    return parsedUrl.toString();
+  } catch (e) {
+    return "***";
+  }
+}

services/profiles/src/lib/db.ts

@@ -1,6 +1,6 @@
 import { Pool, PoolClient } from "pg";
 import Cursor from "pg-cursor";
-import { getSingleton, namedParameters, newError, requireDefined, stopwatch, getLog } from "juava";
+import { getSingleton, namedParameters, newError, requireDefined, stopwatch, getLog, hideSensitiveInfo } from "juava";
 
 export type Handler = (row: Record<string, any>) => Promise<void> | void;
 
@@ -197,8 +197,9 @@ export function createPg(): Pool {
     log
       .atInfo()
       .log(
-        `Connecting new client ${connectionUrl}. Pool stat: idle=${pool.idleCount}, waiting=${pool.waitingCount}, total=${pool.totalCount}` +
-          (schema ? `. Default schema: ${schema}` : "")
+        `Connecting new client ${hideSensitiveInfo(connectionUrl)}. Pool stat: idle=${pool.idleCount}, waiting=${
+          pool.waitingCount
+        }, total=${pool.totalCount}` + (schema ? `. Default schema: ${schema}` : "")
       );
     //this is commented on purpose, it won't work for pgbouncer in transaction mode https://www.pgbouncer.org/features.html
     //let's leave it commented for information purposes

webapps/console/lib/server/db.ts

@@ -1,7 +1,7 @@
 import { PrismaClient } from "@prisma/client";
 import { Pool, PoolClient } from "pg";
 import Cursor from "pg-cursor";
-import { getSingleton, namedParameters, newError, requireDefined, stopwatch } from "juava";
+import { getSingleton, namedParameters, newError, requireDefined, stopwatch, hideSensitiveInfo } from "juava";
 import { getServerLog } from "./log";
 import { isReadOnly } from "./read-only-mode";
 import { isTruish } from "../shared/chores";
@@ -116,8 +116,9 @@ export function createPg(): Pool {
     log
       .atInfo()
       .log(
-        `Connecting new client ${connectionUrl}. Pool stat: idle=${pool.idleCount}, waiting=${pool.waitingCount}, total=${pool.totalCount}` +
-          (schema ? `. Default schema: ${schema}` : "")
+        `Connecting new client ${hideSensitiveInfo(connectionUrl)}. Pool stat: idle=${pool.idleCount}, waiting=${
+          pool.waitingCount
+        }, total=${pool.totalCount}` + (schema ? `. Default schema: ${schema}` : "")
       );
     //this is commented on purpose, it won't work for pgbouncer in transaction mode https://www.pgbouncer.org/features.html
     //let's leave it commented for information purposes

webapps/ee-api/lib/store.ts

@@ -1,4 +1,4 @@
-import { assertDefined, getErrorMessage } from "juava";
+import { assertDefined, getErrorMessage, hideSensitiveInfo } from "juava";
 import * as PG from "pg";
 import { getServerLog } from "./log";
 
@@ -82,16 +82,6 @@ function maybeDeleteExpiredObjects(pgPool, table) {
   }
 }
 
-function hideSensitiveInfo(url: string) {
-  try {
-    const parsedUrl = new URL(url);
-    parsedUrl.password = "****";
-    return parsedUrl.toString();
-  } catch (e) {
-    return "***";
-  }
-}
-
 export function createPg(url: string, opts: { defaultSchema?: string; connectionName?: string } = {}): PG.Pool {
   const parsedUrl = new URL(url);
   const schema = opts.defaultSchema || parsedUrl.searchParams.get("schema") || "public";