@oneuptime/common 12.0.12 → 12.0.13

package/Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel.ts

@@ -58,6 +58,32 @@ export type DbTypes =
   | JSONArray
   | Buffer;
 
+/*
+ * Metadata-only vanilla instances used by toJSONObject to read table-column
+ * metadata. Frozen and never exported, so they can never be mutated or escape
+ * this file. _fromJSON must never use this cache — it mutates and returns the
+ * instance it constructs.
+ */
+const vanillaModelCache: WeakMap<
+  { new (): DatabaseBaseModel },
+  DatabaseBaseModel
+> = new WeakMap();
+
+function getVanillaModel(modelType: {
+  new (): DatabaseBaseModel;
+}): DatabaseBaseModel {
+  let vanillaModel: DatabaseBaseModel | undefined =
+    vanillaModelCache.get(modelType);
+
+  if (!vanillaModel) {
+    vanillaModel = new modelType();
+    Object.freeze(vanillaModel);
+    vanillaModelCache.set(modelType, vanillaModel);
+  }
+
+  return vanillaModel;
+}
+
 export default class DatabaseBaseModel extends BaseEntity {
   @TableColumn({
     title: "ID",
@@ -252,8 +278,7 @@ export default class DatabaseBaseModel extends BaseEntity {
   }
 
   public getTableColumnMetadata(columnName: string): TableColumnMetadata {
-    const dictionary: Dictionary<TableColumnMetadata> = getTableColumns(this);
-    return dictionary[columnName] as TableColumnMetadata;
+    return getTableColumn(this, columnName);
   }
 
   public hasColumn(columnName: string): boolean {
@@ -275,8 +300,10 @@ export default class DatabaseBaseModel extends BaseEntity {
   }
 
   public getColumnAccessControlForAllColumns(): Dictionary<ColumnAccessControl> {
-    const dictionary: Dictionary<ColumnAccessControl> =
-      getColumnAccessControlForAllColumns(this);
+    // Copy: the helper's dictionary is cached per class and must stay pristine.
+    const dictionary: Dictionary<ColumnAccessControl> = {
+      ...getColumnAccessControlForAllColumns(this),
+    };
 
     const defaultColumns: Array<string> = [
       "_id",
@@ -613,7 +640,7 @@ export default class DatabaseBaseModel extends BaseEntity {
   ): JSONObject {
     const json: JSONObject = {};
 
-    const vanillaModel: DatabaseBaseModel = new modelType();
+    const vanillaModel: DatabaseBaseModel = getVanillaModel(modelType);
 
     for (const key of vanillaModel.getTableColumns().columns) {
       if ((model as any)[key] === undefined) {

package/Models/DatabaseModels/NetworkDevice.ts

@@ -1942,6 +1942,70 @@ export default class NetworkDevice extends BaseModel {
   })
   public lastSeenAt?: Date = undefined;
 
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDevice,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditNetworkDevice,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.Date,
+    canReadOnRelationQuery: true,
+    title: "Last Polled At",
+    description:
+      'When the assigned probe last ATTEMPTED an SNMP walk of this device, whether or not the device answered. Paired with lastSeenAt (which only moves on a successful walk) this is what separates "the device did not answer" from "we have not asked recently". Managed by the probe.',
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.Date,
+  })
+  public lastPolledAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDevice,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditNetworkDevice,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.Boolean,
+    canReadOnRelationQuery: true,
+    title: "Is Reachable",
+    description:
+      "Whether the most recent SNMP walk reached this device. NULL means it has never been polled. This — not the age of lastSeenAt — is what the device list, the topology graph and the site rollup read, so a device whose last poll succeeded is never shown as down just because the probe is behind schedule. Managed by the probe.",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.Boolean,
+  })
+  public isReachable?: boolean = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [

package/Models/DatabaseModels/StatusPage.ts

@@ -317,6 +317,65 @@ export default class StatusPage extends BaseModel {
   })
   public pageDescription?: string = undefined;
 
+  /*
+   * Search engine indexing opt-out. Indexing stays on unless the owner turns
+   * it off, so this defaults to true and every pre-existing status page keeps
+   * being indexed exactly as it is today.
+   *
+   * Turning it off is served two ways, both of which a crawler honours before
+   * it decides to index: a <meta name="robots" content="noindex, nofollow">
+   * in the server-rendered index.ejs (so it is there before the JS bundle
+   * loads) and an X-Robots-Tag response header (so it also covers the RSS
+   * feed and llms.txt, which are not HTML).
+   *
+   * Deliberately NOT wired into robots.txt: Disallow blocks the crawl, and a
+   * crawler that never fetches the page never sees the noindex, so the URL can
+   * still surface in results. Letting crawlers in and telling them not to
+   * index is what actually removes the page.
+   */
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.StatusPageAdmin,
+      Permission.StatusPageMember,
+      Permission.CreateProjectStatusPage,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.StatusPageAdmin,
+      Permission.StatusPageMember,
+      Permission.StatusPageViewer,
+      Permission.ReadProjectStatusPage,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.StatusPageAdmin,
+      Permission.StatusPageMember,
+      Permission.EditProjectStatusPage,
+    ],
+  })
+  @TableColumn({
+    isDefaultValueColumn: true,
+    type: TableColumnType.Boolean,
+    title: "Enable Search Engine Indexing",
+    description:
+      "Should search engines like Google and Bing be allowed to index this status page? Turn this off to keep the page reachable by link but out of search results.",
+    defaultValue: true,
+  })
+  @Column({
+    type: ColumnType.Boolean,
+    default: true,
+    nullable: false,
+  })
+  public enableSearchEngineIndexing?: boolean = undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Models/DatabaseModels/StatusPageOidc.ts

@@ -14,6 +14,7 @@ import CanAccessIfCanReadOn from "../../Types/Database/CanAccessIfCanReadOn";
 import ColumnLength from "../../Types/Database/ColumnLength";
 import ColumnType from "../../Types/Database/ColumnType";
 import CrudApiEndpoint from "../../Types/Database/CrudApiEndpoint";
+import EnableDocumentation from "../../Types/Database/EnableDocumentation";
 import TableColumn from "../../Types/Database/TableColumn";
 import TableColumnType from "../../Types/Database/TableColumnType";
 import TableMetadata from "../../Types/Database/TableMetadata";
@@ -24,6 +25,7 @@ import ObjectID from "../../Types/ObjectID";
 import Permission from "../../Types/Permission";
 import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
 
+@EnableDocumentation()
 @CanAccessIfCanReadOn("statusPage")
 @TableEditionAccessControl({
   requiresEnterprise: true,

package/Models/DatabaseModels/WorkspaceProjectAuthToken.ts

@@ -45,9 +45,26 @@ export interface MicrosoftTeamsChat {
  * roster member of. Listing a team is therefore NOT evidence that we can post
  * to it — this record is, which is why channel sends check it before calling
  * the Bot Framework.
+ *
+ * A Teams team has TWO ids and they are not interchangeable. Bot activities
+ * carry the thread id (channelData.team.id, "19:...@thread.tacv2"); Graph — and
+ * therefore every team picker, notification rule and channel URL in OneUptime —
+ * uses the AAD group id (a GUID, channelData.team.aadGroupId). Records used to
+ * be keyed by the thread id and looked up by the group id, so the lookup could
+ * never hit. Both are stored explicitly now so neither side has to guess which
+ * one it holds.
  */
 export interface MicrosoftTeamsInstalledTeam {
-  id: string; // Teams team (group) id.
+  /*
+   * Map key. The Graph team id when we could resolve it, otherwise the Teams
+   * thread id — a record written before this shipped, or one whose group id
+   * could not be resolved, keeps the thread id here so uninstall still matches.
+   * Read it through MicrosoftTeamsUtil.indexInstalledTeamsByGraphTeamId rather
+   * than assuming which id space it is in.
+   */
+  id: string;
+  graphTeamId?: string | undefined; // AAD group id — what Graph and notification rules use. Absent on unresolved records.
+  teamsThreadId?: string | undefined; // channelData.team.id ("19:...@thread.tacv2") — what bot activities carry.
   name?: string | undefined;
   serviceUrl?: string | undefined; // Bot Framework service URL captured on install. Required for GCC/DoD.
   addedAt?: string | undefined;
@@ -79,7 +96,7 @@ export interface MicrosoftTeamsMiscData extends MiscData {
   availableTeams?: Record<string, MicrosoftTeamsTeam>; // keyed by team id. Every team Graph can see in the tenant.
   appAccessTokenExpiresAt?: string;
   availableChats?: Record<string, MicrosoftTeamsChat>; // keyed by chat id. Chats the OneUptime app has been added to.
-  installedTeams?: Record<string, MicrosoftTeamsInstalledTeam>; // keyed by team id. Teams the OneUptime app has been added to.
+  installedTeams?: Record<string, MicrosoftTeamsInstalledTeam>; // keyed by MicrosoftTeamsInstalledTeam.id — see that type, the key is not always a Graph team id.
 }
 
 export type WorkspaceMiscData = SlackMiscData | MicrosoftTeamsMiscData;

package/Server/API/AIChatAPI.ts

@@ -9,7 +9,6 @@ import Express, {
 import Response from "../Utils/Response";
 import BadDataException from "../../Types/Exception/BadDataException";
 import PaymentRequiredException from "../../Types/Exception/PaymentRequiredException";
-import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import ObjectID from "../../Types/ObjectID";
 import OneUptimeDate from "../../Types/Date";
@@ -89,18 +88,16 @@ router.post(
       const props: DatabaseCommonInteractionProps =
         await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-      if (!props.userId) {
-        throw new NotAuthorizedException(
-          "AI chat requires a logged-in user session.",
-        );
-      }
-
-      if (!props.tenantId) {
-        throw new BadDataException("Project ID is required (tenantid header).");
-      }
-
-      const projectId: ObjectID = props.tenantId;
-      const userId: ObjectID = props.userId;
+      /*
+       * Membership, not just a session. getUserMiddleware admits an
+       * unauthenticated request as "public" and reads the tenant id straight
+       * out of the caller-supplied `tenantid` header, so the pair of checks
+       * this replaces proved only that SOMEBODY was logged in and had named
+       * SOME project - never that they belonged to the project they named.
+       */
+      const projectId: ObjectID =
+        CommonAPI.assertAuthenticatedProjectMember(props);
+      const userId: ObjectID = props.userId!;
 
       const content: string = (req.body["content"] as string) || "";
 
@@ -502,17 +499,30 @@ router.post(
       const props: DatabaseCommonInteractionProps =
         await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-      if (!props.userId) {
-        throw new NotAuthorizedException(
-          "AI chat requires a logged-in user session.",
-        );
-      }
-
-      if (!props.tenantId) {
-        throw new BadDataException("Project ID is required (tenantid header).");
-      }
+      /*
+       * Membership, not just a session - see the note on send-message. This
+       * route is where that distinction was load-bearing: it took the project
+       * id straight from the header and handed it to root-privileged reads,
+       * so any logged-in user could name ANY project's UUID and be told which
+       * LLM providers that project has - their names, descriptions, types and
+       * models (GHSA-hm7m-9qjj-xj5x).
+       */
+      const projectId: ObjectID =
+        CommonAPI.assertAuthenticatedProjectMember(props);
 
-      const projectId: ObjectID = props.tenantId;
+      /*
+       * Membership is still not read authorisation. The very same rows served
+       * by a plain GET /llm-provider are gated there by LlmProvider's own read
+       * list, and a member whose teams grant none of those permissions has no
+       * business reading them through the chat picker instead. Asking the
+       * model for that list keeps the two paths from drifting apart.
+       */
+      CommonAPI.assertPermittedInProject({
+        databaseProps: props,
+        allowedPermissions: new LlmProvider().getReadPermissions(),
+        errorMessage:
+          "You do not have permission to read this project's AI providers.",
+      });
 
       const [providers, defaultProvider]: [
         Array<LlmProvider>,
@@ -561,18 +571,16 @@ router.post(
       const props: DatabaseCommonInteractionProps =
         await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-      if (!props.userId) {
-        throw new NotAuthorizedException(
-          "AI chat requires a logged-in user session.",
-        );
-      }
-
-      if (!props.tenantId) {
-        throw new BadDataException("Project ID is required (tenantid header).");
-      }
-
-      const projectId: ObjectID = props.tenantId;
-      const userId: ObjectID = props.userId;
+      /*
+       * Membership, not just a session. getUserMiddleware admits an
+       * unauthenticated request as "public" and reads the tenant id straight
+       * out of the caller-supplied `tenantid` header, so the pair of checks
+       * this replaces proved only that SOMEBODY was logged in and had named
+       * SOME project - never that they belonged to the project they named.
+       */
+      const projectId: ObjectID =
+        CommonAPI.assertAuthenticatedProjectMember(props);
+      const userId: ObjectID = props.userId!;
 
       const conversationIdString: string = req.body["conversationId"] as string;
       const assistantMessageIdString: string = req.body[
@@ -743,18 +751,16 @@ router.post(
       const props: DatabaseCommonInteractionProps =
         await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-      if (!props.userId) {
-        throw new NotAuthorizedException(
-          "AI chat requires a logged-in user session.",
-        );
-      }
-
-      if (!props.tenantId) {
-        throw new BadDataException("Project ID is required (tenantid header).");
-      }
-
-      const projectId: ObjectID = props.tenantId;
-      const userId: ObjectID = props.userId;
+      /*
+       * Membership, not just a session. getUserMiddleware admits an
+       * unauthenticated request as "public" and reads the tenant id straight
+       * out of the caller-supplied `tenantid` header, so the pair of checks
+       * this replaces proved only that SOMEBODY was logged in and had named
+       * SOME project - never that they belonged to the project they named.
+       */
+      const projectId: ObjectID =
+        CommonAPI.assertAuthenticatedProjectMember(props);
+      const userId: ObjectID = props.userId!;
 
       const conversationIdString: string = req.body["conversationId"] as string;
 
@@ -913,15 +919,8 @@ router.post(
       const props: DatabaseCommonInteractionProps =
         await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-      if (!props.userId) {
-        throw new NotAuthorizedException(
-          "AI chat requires a logged-in user session.",
-        );
-      }
-
-      if (!props.tenantId) {
-        throw new BadDataException("Project ID is required (tenantid header).");
-      }
+      // Membership, not just a session - see the note on send-message.
+      CommonAPI.assertAuthenticatedProjectMember(props);
 
       const messageIdString: string = req.body["messageId"] as string;
 

package/Server/API/CommonAPI.ts

@@ -9,6 +9,14 @@ import SpanUtil from "../Utils/Telemetry/SpanUtil";
 import ObjectID from "../../Types/ObjectID";
 import BadDataException from "../../Types/Exception/BadDataException";
 import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
+import Permission, {
+  PermissionHelper,
+  PermissionProps,
+  UserPermission,
+} from "../../Types/Permission";
+import DatabaseCommonInteractionPropsUtil, {
+  PermissionType,
+} from "../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
 
 export default class CommonAPI {
   /*
@@ -132,6 +140,87 @@ export default class CommonAPI {
     }
   }
 
+  /*
+   * Membership is not read authorisation.
+   *
+   * assertAuthenticatedProjectMember proves the caller belongs to the project
+   * they named in the `tenantid` header; it says nothing about WHICH of that
+   * project's data they may see. A custom route that then reads with
+   * `isRoot: true` has skipped the permission check the equivalent CRUD read
+   * would have run, so the route has to make that check itself - otherwise a
+   * member whose teams grant nothing but, say, ReadProjectIncident still reads
+   * everything else the route happens to touch.
+   *
+   * The permissions consulted are the caller's grants in props.tenantId, so
+   * this must be called after assertAuthenticatedProjectMember has confirmed
+   * that tenant is one the caller actually belongs to.
+   *
+   * `allowedPermissions` is normally the model's own declared list, e.g.
+   * `new LlmProvider().getReadPermissions()`, so the custom route stays in
+   * step with the CRUD endpoint for the same data instead of inventing a
+   * second, quietly diverging rule.
+   *
+   * Permissions that are never assigned INSIDE a project are stripped from
+   * that list first. This matters: getUserPermissions merges the caller's
+   * global permissions in, and every caller - including an anonymous one -
+   * carries Permission.Public, which a model's read list very often contains
+   * (LlmProvider has it so the shared global providers stay readable). Left
+   * in, it would make this guard pass for anyone. What remains is the
+   * tenant-assignable subset, which is exactly what a team can grant.
+   *
+   * Stripping can empty the list, and an empty list denies everyone rather
+   * than admitting them - a model whose read access is purely public has no
+   * business behind this guard, and failing closed is the safe direction.
+   *
+   * Master admins bypass, matching every other permission gate in the API.
+   */
+  public static assertPermittedInProject(data: {
+    databaseProps: DatabaseCommonInteractionProps;
+    allowedPermissions: Array<Permission>;
+    errorMessage?: string | undefined;
+  }): void {
+    if (data.databaseProps.isMasterAdmin) {
+      return;
+    }
+
+    const tenantAssignablePermissions: Array<Permission> =
+      PermissionHelper.getTenantPermissionProps().map(
+        (permissionProps: PermissionProps) => {
+          return permissionProps.permission;
+        },
+      );
+
+    const requiredPermissions: Array<Permission> =
+      data.allowedPermissions.filter((permission: Permission) => {
+        return tenantAssignablePermissions.includes(permission);
+      });
+
+    /*
+     * Allow-only: getUserPermissions discriminates grants from denials by
+     * isBlockPermission, so a team's explicit BLOCK row for one of these
+     * permissions must never be counted as a grant of it.
+     */
+    const grantedPermissions: Array<Permission> =
+      DatabaseCommonInteractionPropsUtil.getUserPermissions(
+        data.databaseProps,
+        PermissionType.Allow,
+      ).map((userPermission: UserPermission) => {
+        return userPermission.permission;
+      });
+
+    if (
+      !PermissionHelper.doesPermissionsIntersect(
+        grantedPermissions,
+        requiredPermissions,
+      )
+    ) {
+      throw new NotAuthorizedException(
+        data.errorMessage ||
+          "You do not have permission to access this project's data.",
+      );
+    }
+  }
+
   @CaptureSpan()
   public static async getDatabaseCommonInteractionProps(
     req: ExpressRequest,

package/Server/API/MicrosoftTeamsAPI.ts

@@ -177,6 +177,16 @@ export default class MicrosoftTeamsAPI {
               type: "Application",
               name: "ChatMember.Read.Chat",
             },
+            /*
+             * Lets OneUptime confirm, per team, that the installed OneUptime app
+             * is the package built from THIS deployment before telling an admin
+             * their app is missing. Without it the installed-apps read falls back
+             * to "unknown" and the send is handed to Microsoft to reject.
+             */
+            {
+              type: "Application",
+              name: "TeamsAppInstallation.Read.Group",
+            },
           ],
         },
       },
@@ -386,12 +396,13 @@ export default class MicrosoftTeamsAPI {
               "https://graph.microsoft.com/User.Read https://graph.microsoft.com/Team.ReadBasic.All https://graph.microsoft.com/Channel.ReadBasic.All https://graph.microsoft.com/ChannelMessage.Send",
           };
 
+          /*
+           * The token request body holds the app client secret and the
+           * authorization code, and the response holds the user access and
+           * refresh tokens -- neither is logged.
+           */
           logger.debug(
-            "Microsoft Teams Token Request Body (static redirect): ",
-            getLogAttributesFromRequest(req as any),
-          );
-          logger.debug(
-            tokenRequestBody,
+            "Exchanging Microsoft Teams authorization code for an access token.",
             getLogAttributesFromRequest(req as any),
           );
 
@@ -420,10 +431,9 @@ export default class MicrosoftTeamsAPI {
 
           const tokenData: JSONObject = tokenResponse.data;
           logger.debug(
-            "Microsoft Teams Token Response (static redirect): ",
+            "Microsoft Teams token exchange completed.",
             getLogAttributesFromRequest(req as any),
           );
-          logger.debug(tokenData, getLogAttributesFromRequest(req as any));
 
           if (!tokenData["access_token"]) {
             return Response.sendErrorResponse(
@@ -725,11 +735,12 @@ export default class MicrosoftTeamsAPI {
             Date.now() + Math.max(0, (expiresInSec - 60) * 1000),
           ).toISOString();
 
+          // tokenData carries the app access token; only its expiry is logged.
           logger.debug(
-            "App Access Token acquired via admin consent: ",
+            "Microsoft Graph app token acquired via admin consent. expiresAt: " +
+              expiresAtIso,
             getLogAttributesFromRequest(req as any),
           );
-          logger.debug(tokenData, getLogAttributesFromRequest(req as any));
 
           // Get available teams from user auth token
           const userId: string = stateParts[1]!;

package/Server/API/SlackAPI.ts

@@ -164,11 +164,15 @@ export default class SlackAPI {
           redirect_uri: redirectUri.toString(),
         };
 
+        /*
+         * Neither the token request nor the token response is logged: the
+         * request carries the app client secret and the authorization code,
+         * and the response carries the bot and user access tokens.
+         */
         logger.debug(
-          "Slack Auth Request Body: ",
+          "Exchanging Slack authorization code for an access token.",
           getLogAttributesFromRequest(req as any),
         );
-        logger.debug(requestBody, getLogAttributesFromRequest(req as any));
 
         // send the request to slack api to get the access token https://slack.com/api/oauth.v2.access
 
@@ -188,10 +192,9 @@ export default class SlackAPI {
         const responseBody: JSONObject = response.data;
 
         logger.debug(
-          "Slack Auth Request Body: ",
+          "Slack token exchange completed. ok: " + String(responseBody["ok"]),
           getLogAttributesFromRequest(req as any),
         );
-        logger.debug(responseBody, getLogAttributesFromRequest(req as any));
 
         let slackTeamId: string | undefined = undefined;
         let slackBotAccessToken: string | undefined = undefined;
@@ -384,11 +387,11 @@ export default class SlackAPI {
           redirect_uri: redirectUri.toString(),
         };
 
+        // Same as above: the body holds the client secret and the auth code.
         logger.debug(
-          "Slack Auth Request Body: ",
+          "Exchanging Slack authorization code for a user token.",
           getLogAttributesFromRequest(req as any),
         );
-        logger.debug(requestBody, getLogAttributesFromRequest(req as any));
 
         // send the request to slack api to get the access token https://slack.com/api/oauth.v2.access
 
@@ -408,10 +411,10 @@ export default class SlackAPI {
         const responseBody: JSONObject = response.data;
 
         logger.debug(
-          "Slack User Auth Request Body: ",
+          "Slack user token exchange completed. ok: " +
+            String(responseBody["ok"]),
           getLogAttributesFromRequest(req as any),
         );
-        logger.debug(responseBody, getLogAttributesFromRequest(req as any));
 
         if (
           responseBody["id_token"] &&
@@ -425,11 +428,11 @@ export default class SlackAPI {
               "base64",
             ).toString("utf8"),
           );
+          // The decoded ID token is identity material; only the fact is logged.
           logger.debug(
-            "Decoded ID Token: ",
+            "Decoded Slack ID token.",
             getLogAttributesFromRequest(req as any),
           );
-          logger.debug(decodedIdToken, getLogAttributesFromRequest(req as any));
           responseBody["id_token"] = decodedIdToken;
         }