fix: redact sensitive auth and bridge logs

[adm01-debug]

Resumo

• Remove e-mail/user id de logs do fluxo de login.
• Reduz logs das bridges para metadados operacionais sem payloads, filtros, IDs ou previews de dados.
• Remove prefixo/sufixo/tamanho de credenciais dos logs de resolução do CRM.

Validacao

• npx.cmd eslint src/pages/auth/Auth.tsx
• git diff --check
• npm.cmd run build com VITE_SUPABASE_URL e VITE_SUPABASE_PUBLISHABLE_KEY explicitas

Observacao

• node scripts/typecheck-edge-functions.mjs nao rodou localmente porque deno nao esta no PATH.
• O pre-push local falhou em lint:baseline com status null no Windows; o push foi feito com HUSKY=0 apos as validacoes acima, deixando a validacao principal para o CI.

---

Summary by cubic

Redacted sensitive data from auth and bridge logs. Replaced payloads, identifiers, and credential details with metadata-only logging to reduce PII exposure.

• Bug Fixes
  • Auth flow: removed email/user ID from log messages; sanitized errors and credential-store logs; kept fail-open redirect with neutral warnings.
  • supabase CRM bridge: replaced user-id logging with role-only; standardized insert/update/delete errors to code/message; SELECT logs now report counts and error presence; removed credential prefixes/length/last4 from startup logs.
  • supabase external DB bridge: summarized invalid filter logs to field/reason/type; SELECT/RPC logs show key counts, not values; insert/update/delete/upsert logs report field counts and omit IDs/payloads; reduced orderBy fallback context to field and filter key counts.

^{Written for commit 6cad72c. Summary will update on new commits. Review in cubic}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
we-dream-big	Ready	Preview, Comment	May 23, 2026 12:45pm

[coderabbitai]

Warning

Review limit reached

@adm01-debug, we couldn't start this review because you've used your available PR reviews for now.

Your plan currently allows 2 reviews/hour. Refill in 15 minutes and 15 seconds.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more review capacity refills, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 74c86985-ce38-441c-901c-383d0d8c18ea

📥 Commits

Reviewing files that changed from the base of the PR and between a9a667f and 6cad72c.

📒 Files selected for processing (3)

• src/pages/auth/Auth.tsx
• supabase/functions/crm-db-bridge/index.ts
• supabase/functions/external-db-bridge/index.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/redact-sensitive-logs-2026-05-23

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[supabase]

This pull request has been ignored for the connected project doufsxqlfjyuvxuezpln due to reaching the limit of concurrent preview branches.
Go to Project Integrations Settings ↗︎ if you wish to update this limit.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[cubic-dev-ai]

No issues found across 3 files

_{Re-trigger cubic}

[Copilot]

Pull request overview

This PR reduces exposure of sensitive data (PII/credentials/payload contents) by redacting and summarizing logs across the login flow and Supabase edge-function “bridge” functions.

Changes:

• Auth UI: removes email/user-id from login logging and avoids dumping caught errors to console.
• External DB bridge: logs filter-validation failures and RPC/CRUD operations using metadata-only summaries (counts/keys), omitting payloads/IDs.
• CRM DB bridge: removes credential/payload previews from logs and standardizes error logs to minimal { code, message }.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
supabase/functions/external-db-bridge/index.ts	Replaces payload/ID-heavy logs with summarized metadata; adds invalid-filter summarization and reduces RPC/CRUD log verbosity.
supabase/functions/crm-db-bridge/index.ts	Redacts user-id/credential info from logs; standardizes write/select error logging; removes payload preview logging.
src/pages/auth/Auth.tsx	Removes PII from auth logs and avoids logging raw caught errors while preserving existing control flow (including fail-open redirect).

Comments suppressed due to low confidence (2)

supabase/functions/external-db-bridge/index.ts:1365

• The insert error log still prints insertError.details and insertError.hint. PostgREST error details commonly embeds the offending values (e.g., unique constraint violations include the key/value), which can reintroduce sensitive data into logs even after the payload redaction. Consider logging only a minimal { code, message } (and optionally a request-id) and avoid emitting details/hint to server logs.

  console.log(`Inserting into ${table}: field_count=${Object.keys(insertData).length}`);
  const { data: insertResult, error: insertError } = await externalSupabase.from(table).insert(insertData).select().single();

  if (insertError) {
    console.error('Insert error:', insertError.message, insertError.details, insertError.hint);

supabase/functions/external-db-bridge/index.ts:1396

• The update error log still prints updateError.details and updateError.hint, which can include raw field values (e.g., constraint errors). Since this PR is tightening log redaction, consider emitting only { code, message } (or a sanitized subset) in logs to avoid leaking data via details/hint.

  console.log(`Updating ${table}: field_count=${Object.keys(updateData).length}`);
  const { data: updateResult, error: updateError } = await externalSupabase.from(table).update(updateData).eq('id', id).select().maybeSingle();

  if (updateError) {
    console.error('Update error:', updateError.message, updateError.details, updateError.hint);

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.