@remit/backend 0.0.94 → 0.0.96

package/src/handlers/calendar-feed.ts

@@ -0,0 +1,291 @@
+import type {
+	CalendarFeedResponse,
+	CalendarFeedStateResponse,
+} from "@remit/api-openapi-types";
+import {
+	buildCalendarFeed,
+	calendarFeedIsUnchanged,
+	calendarFeedIsUnmodifiedSince,
+	hashCalendarFeedToken,
+	isCalendarFeedToken,
+	mintCalendarFeedToken,
+	readCalendarFeedToken,
+} from "@remit/calendar-service";
+import type { CalendarFeedTokenItem } from "@remit/data-ports";
+import { NotFoundError } from "@remit/data-ports/errors";
+import type { APIGatewayProxyEvent } from "aws-lambda";
+import { getAccountConfigIdFromEvent } from "../auth.js";
+import { type RawApiResponse, rawApiResponse } from "../response.js";
+import { getClient } from "../service/data-client.js";
+import type {
+	CalendarDetailOperationIds,
+	CalendarFeedDetailOperationIds,
+	CalendarFeedOperationIds,
+	OperationHandler,
+} from "../types.js";
+import {
+	type CalendarDeps,
+	type CalendarOutcome,
+	calendarDepsOf,
+	findCalendarFor,
+	notFound,
+	refuseCalendar,
+} from "./calendar.js";
+
+const toFeedState = (
+	token: CalendarFeedTokenItem,
+): CalendarFeedStateResponse => ({
+	calendarId: token.calendarId,
+	createdAt: token.createdAt,
+	rotatedAt: token.rotatedAt,
+});
+
+/**
+ * Mints the calendar's feed address, or replaces the one it has.
+ *
+ * The plaintext exists here and nowhere else: the store keeps a digest, so this
+ * return value is the only chance anybody has to read the token. Ownership is
+ * settled before the mint — a calendar the caller does not hold is absent, not
+ * forbidden, which is the same answer `getCalendar` gives it.
+ */
+export const putCalendarFeedFor = async (
+	deps: CalendarDeps,
+	accountConfigId: string,
+	calendarId: string,
+): Promise<CalendarOutcome<CalendarFeedResponse>> => {
+	const calendar = await findCalendarFor(deps, accountConfigId, calendarId);
+	if (!calendar.ok) return calendar;
+
+	const secret = mintCalendarFeedToken();
+	const stored = await deps.calendarFeedToken.put({
+		accountConfigId,
+		calendarId,
+		tokenHash: secret.tokenHash,
+	});
+
+	return {
+		ok: true,
+		value: {
+			calendarId: stored.calendarId,
+			feedToken: secret.token,
+			createdAt: stored.createdAt,
+			rotatedAt: stored.rotatedAt,
+		},
+	};
+};
+
+/** Whether the calendar has a feed address, and how old it is. */
+export const findCalendarFeedFor = async (
+	deps: CalendarDeps,
+	accountConfigId: string,
+	calendarId: string,
+): Promise<CalendarOutcome<CalendarFeedStateResponse>> => {
+	const calendar = await findCalendarFor(deps, accountConfigId, calendarId);
+	if (!calendar.ok) return calendar;
+
+	const stored = await deps.calendarFeedToken.findByCalendar(
+		accountConfigId,
+		calendarId,
+	);
+	if (!stored) {
+		return refuseCalendar("NotFound", `no feed on calendar ${calendarId}`);
+	}
+	return { ok: true, value: toFeedState(stored) };
+};
+
+/**
+ * Revokes the calendar's feed address.
+ *
+ * A calendar with no feed is refused rather than answered 204: the caller asked
+ * for a subscription to stop working, and reporting success for one that was
+ * never there reads as confirmation that it has.
+ */
+export const revokeCalendarFeedFor = async (
+	deps: CalendarDeps,
+	accountConfigId: string,
+	calendarId: string,
+): Promise<CalendarOutcome<null>> => {
+	const calendar = await findCalendarFor(deps, accountConfigId, calendarId);
+	if (!calendar.ok) return calendar;
+
+	const stored = await deps.calendarFeedToken.findByCalendar(
+		accountConfigId,
+		calendarId,
+	);
+	if (!stored) {
+		return refuseCalendar("NotFound", `no feed on calendar ${calendarId}`);
+	}
+
+	await deps.calendarFeedToken.delete(accountConfigId, calendarId);
+	return { ok: true, value: null };
+};
+
+/**
+ * No feed answers to this address.
+ *
+ * One answer for an unknown token, a revoked one and a malformed one, with a
+ * body that says the same thing to all three: a caller probing addresses learns
+ * only whether the one it sent works, which is what it was going to find out
+ * anyway.
+ */
+const feedNotFound = (): RawApiResponse =>
+	rawApiResponse({
+		statusCode: 404,
+		headers: { "Content-Type": "text/plain; charset=utf-8" },
+		body: "no calendar feed at this address\n",
+	});
+
+/**
+ * Serves a calendar to whoever holds its secret address.
+ *
+ * The token is the whole credential, so a value that cannot be one is refused
+ * before anything is hashed, and the digest of what arrived is what the store is
+ * asked about — the plaintext is never compared against a stored one because
+ * none is stored.
+ *
+ * `Last-Modified` is the collection's own timestamp, not the newest event in
+ * it: an event deleted from a calendar leaves every survivor older than the
+ * change, and a validator that moves backwards tells a subscriber its cached
+ * copy is still good. The collection is stamped by the same sequence bump every
+ * write and every delete goes through, so it only ever moves forward.
+ *
+ * A row whose collection is gone is the same 404. It should not exist — a
+ * calendar's delete takes its token with it, in one transaction — and serving a
+ * blank calendar for one would be worse than saying nothing.
+ */
+export const serveCalendarFeed = async (
+	deps: CalendarDeps,
+	feedToken: string,
+	conditions: {
+		ifNoneMatch: string | undefined;
+		ifModifiedSince: string | undefined;
+	},
+): Promise<RawApiResponse> => {
+	if (!isCalendarFeedToken(feedToken)) return feedNotFound();
+
+	const stored = await deps.calendarFeedToken.findByTokenHash(
+		hashCalendarFeedToken(feedToken),
+	);
+	if (!stored) return feedNotFound();
+
+	const collection = await deps.calendarCollection
+		.get(stored.accountConfigId, stored.calendarId)
+		.catch((error: unknown) => {
+			if (error instanceof NotFoundError) return null;
+			throw error;
+		});
+	if (!collection) return feedNotFound();
+
+	const objects = await deps.calendarObject.listByCalendar(stored.calendarId);
+	const feed = buildCalendarFeed(collection, objects);
+	const etag = `"${feed.etag}"`;
+	const lastModified = new Date(collection.updatedAt).toUTCString();
+
+	// `If-None-Match` wins outright when both arrive (RFC 9110 13.2.2): the tag
+	// is exact where the date is truncated to the second, so honouring the date
+	// as well could only turn a 200 the tag asked for into a 304.
+	const unchanged =
+		conditions.ifNoneMatch === undefined
+			? calendarFeedIsUnmodifiedSince(
+					conditions.ifModifiedSince,
+					collection.updatedAt,
+				)
+			: calendarFeedIsUnchanged(conditions.ifNoneMatch, feed.etag);
+
+	if (unchanged) {
+		return rawApiResponse({
+			statusCode: 304,
+			headers: { ETag: etag, "Last-Modified": lastModified },
+			body: "",
+		});
+	}
+
+	return rawApiResponse({
+		statusCode: 200,
+		headers: {
+			"Content-Type": "text/calendar; charset=utf-8",
+			ETag: etag,
+			"Last-Modified": lastModified,
+		},
+		body: feed.icalData,
+	});
+};
+
+export const CalendarFeedDetailOperations: Record<
+	CalendarFeedDetailOperationIds,
+	OperationHandler<CalendarDetailOperationIds>
+> = {
+	CalendarDetailOperations_getCalendarFeed: async (
+		context,
+		...args: unknown[]
+	) => {
+		const event = args[0] as APIGatewayProxyEvent;
+		const accountConfigId = getAccountConfigIdFromEvent(event);
+		const { calendarId } = context.request.params as { calendarId: string };
+		const deps = calendarDepsOf(await getClient());
+
+		const found = await findCalendarFeedFor(deps, accountConfigId, calendarId);
+		if (!found.ok) return notFound(found.error.message);
+		return found.value;
+	},
+
+	CalendarDetailOperations_putCalendarFeed: async (
+		context,
+		...args: unknown[]
+	) => {
+		const event = args[0] as APIGatewayProxyEvent;
+		const accountConfigId = getAccountConfigIdFromEvent(event);
+		const { calendarId } = context.request.params as { calendarId: string };
+		const deps = calendarDepsOf(await getClient());
+
+		const minted = await putCalendarFeedFor(deps, accountConfigId, calendarId);
+		if (!minted.ok) return notFound(minted.error.message);
+		return minted.value;
+	},
+
+	CalendarDetailOperations_revokeCalendarFeed: async (
+		context,
+		...args: unknown[]
+	) => {
+		const event = args[0] as APIGatewayProxyEvent;
+		const accountConfigId = getAccountConfigIdFromEvent(event);
+		const { calendarId } = context.request.params as { calendarId: string };
+		const deps = calendarDepsOf(await getClient());
+
+		const revoked = await revokeCalendarFeedFor(
+			deps,
+			accountConfigId,
+			calendarId,
+		);
+		if (!revoked.ok) return notFound(revoked.error.message);
+		return { statusCode: 204 };
+	},
+};
+
+export const CalendarFeedOperations: Record<
+	CalendarFeedOperationIds,
+	OperationHandler<CalendarFeedOperationIds>
+> = {
+	CalendarFeedOperations_getCalendarFeedIcal: async (
+		context,
+		...args: unknown[]
+	) => {
+		// From the raw path, not from the router's captured parameter: the matcher
+		// substitutes the parameter into the literal path and leaves the dot of
+		// ".ics" as a regex dot, so /feeds/calendar/<token>Xics routes here too —
+		// and answering it would serve the feed at an address nobody was handed.
+		const event = args[0] as APIGatewayProxyEvent;
+		const feedToken = readCalendarFeedToken(event.path);
+		if (feedToken === null) return feedNotFound();
+
+		const ifNoneMatch = context.request.headers["if-none-match"];
+		const ifModifiedSince = context.request.headers["if-modified-since"];
+		const deps = calendarDepsOf(await getClient());
+
+		return serveCalendarFeed(deps, feedToken, {
+			ifNoneMatch: typeof ifNoneMatch === "string" ? ifNoneMatch : undefined,
+			ifModifiedSince:
+				typeof ifModifiedSince === "string" ? ifModifiedSince : undefined,
+		});
+	},
+};

package/src/handlers/calendar.ts

@@ -13,6 +13,7 @@ import type {
 	CalendarCollectionItem,
 	ICalendarCollectionRepository,
 	ICalendarEventIndexRepository,
+	ICalendarFeedTokenRepository,
 	ICalendarObjectRepository,
 	ICalendarUnitOfWork,
 	UpdateCalendarCollectionInput,
@@ -24,6 +25,7 @@ import { getAccountConfigIdFromEvent } from "../auth.js";
 import type { RemitClient } from "../service/data-client.js";
 import { getClient } from "../service/data-client.js";
 import type {
+	CalendarCollectionDetailOperationIds,
 	CalendarDetailOperationIds,
 	CalendarOperationIds,
 	OperationHandler,
@@ -34,6 +36,7 @@ export interface CalendarDeps {
 	calendarCollection: ICalendarCollectionRepository;
 	calendarObject: ICalendarObjectRepository;
 	calendarEventIndex: ICalendarEventIndexRepository;
+	calendarFeedToken: ICalendarFeedTokenRepository;
 	calendarUnitOfWork: ICalendarUnitOfWork;
 }
 
@@ -78,6 +81,7 @@ export const calendarDepsOf = (client: RemitClient): CalendarDeps => ({
 	calendarCollection: client.calendarCollection,
 	calendarObject: client.calendarObject,
 	calendarEventIndex: client.calendarEventIndex,
+	calendarFeedToken: client.calendarFeedToken,
 	calendarUnitOfWork: client.calendarUnitOfWork,
 });
 
@@ -225,6 +229,7 @@ export const deleteCalendarFor = async (
 			);
 			await repos.calendarObject.delete(calendarId, object.calendarObjectId);
 		}
+		await repos.calendarFeedToken.delete(accountConfigId, calendarId);
 		await repos.calendarCollection.delete(accountConfigId, calendarId);
 	});
 	return { ok: true, value: null };
@@ -326,7 +331,7 @@ export const CalendarOperations: Record<
 };
 
 export const CalendarDetailOperations: Record<
-	CalendarDetailOperationIds,
+	CalendarCollectionDetailOperationIds,
 	OperationHandler<CalendarDetailOperationIds>
 > = {
 	CalendarDetailOperations_getCalendar: async (context, ...args: unknown[]) => {

package/src/handlers/config.ts

@@ -14,6 +14,10 @@ import type { AccountConfigItem, MailboxItem } from "@remit/data-ports";
 import { ConfigNotEmptyError, NotFoundError } from "@remit/data-ports/errors";
 import type { CanonicalMailboxRoleValue } from "@remit/data-ports/folder-role";
 import { logger } from "@remit/logger-lambda";
+import {
+	EMBEDDING_PROVIDER_OFF,
+	readEmbeddingProviderFromEnv,
+} from "@remit/search-service/from-env";
 import type { APIGatewayProxyEvent } from "aws-lambda";
 import { env } from "expect-env";
 import type { Context } from "openapi-backend";
@@ -138,9 +142,22 @@ const emptyConfigResponse = (
 			updatedAt: now,
 		},
 		accounts: [],
+		semanticSearchEnabled: semanticSearchEnabled(),
 	};
 };
 
+/**
+ * Whether this instance embeds anything, read from the same
+ * `SEARCH_EMBEDDING_PROVIDER` the search-index worker and the `remit` wrapper
+ * read. It rides GET /config because the semantic surfaces need it before they
+ * have a query to send: an off instance stores no vectors, so the Organize
+ * widen and semantic filters have nothing to read, and a client that learns
+ * that only from an empty result cannot tell it from a mailbox with nothing
+ * similar in it (#1068).
+ */
+const semanticSearchEnabled = (): boolean =>
+	readEmbeddingProviderFromEnv() !== EMBEDDING_PROVIDER_OFF;
+
 export const ConfigOperations: Record<
 	ConfigOperationIds,
 	OperationHandler<ConfigOperationIds>
@@ -220,6 +237,7 @@ export const ConfigOperations: Record<
 
 		return {
 			accountConfig: toAccountConfigResponse(accountConfig),
+			semanticSearchEnabled: semanticSearchEnabled(),
 			...(pendingImport ? { pendingImport } : {}),
 			accounts: activeAccounts.map((acc) =>
 				toAccountResponse(

package/src/handlers/index.ts

@@ -8,6 +8,10 @@ import {
 	CalendarEventOperations,
 	CalendarFreeBusyOperations,
 } from "./calendar-event.js";
+import {
+	CalendarFeedDetailOperations,
+	CalendarFeedOperations,
+} from "./calendar-feed.js";
 import {
 	CalendarSuggestionActionOperations,
 	CalendarSuggestionOperations,
@@ -55,6 +59,8 @@ export const handlers: Record<OperationIds, OperationHandler<any>> = {
 	...OrganizeJobDetailOperations,
 	...CalendarOperations,
 	...CalendarDetailOperations,
+	...CalendarFeedDetailOperations,
+	...CalendarFeedOperations,
 	...CalendarEventOperations,
 	...CalendarEventDetailOperations,
 	...CalendarFreeBusyOperations,

package/src/index.ts

@@ -2,6 +2,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { inspect } from "node:util";
+import { redactCalendarFeedPath } from "@remit/calendar-service";
 import { logger, withLogContext, withTelemetry } from "@remit/logger-lambda";
 import type { APIGatewayProxyEvent, Context } from "aws-lambda";
 import {
@@ -89,19 +90,17 @@ const api = new OpenAPIBackend({
 
 api.register("postResponseHandler", postResponseHandler);
 
+// The errors and the operation, and nothing that came off the wire. A request
+// that fails validation is logged at error level, and the request it carries
+// holds the caller's headers and cookies — an Authorization bearer among them,
+// and for a calendar feed the token in the path is itself the credential
+// (issue #1065). The path is redacted the same way the request scope redacts it.
 api.register("validationFail", (c: OpenAPIContext, req: Request) => {
-	const operation = api.router.getOperation(c.operation?.operationId ?? "");
 	logger.error(
 		{
 			errors: c.validation.errors,
-			method: req.method,
-			path: req.path,
+			path: redactCalendarFeedPath(req.path),
 			operation: c.operation?.operationId,
-			operationParameters: operation?.parameters,
-			validationContext: {
-				parsedRequest: c.request,
-				validationTarget: c.validation,
-			},
 		},
 		"Validation failed",
 	);
@@ -146,17 +145,19 @@ const readOriginHeader = (
 // so a line gets attributed to the wrong request. The scope follows the request
 // through its own async continuations and nothing else. It nests inside the one
 // `withTelemetry` opens, which is where `requestId` comes from.
-const rawHandler = async (event: APIGatewayProxyEvent, context: Context) =>
-	withLogContext(
+const rawHandler = async (event: APIGatewayProxyEvent, context: Context) => {
+	// A calendar feed carries its credential in the path, so the raw path is a
+	// secret and cannot be a log field (issue #1065). Redacted once, here, where
+	// every line inside the request picks it up from the scope.
+	const path = redactCalendarFeedPath(event.path);
+
+	return withLogContext(
 		{
-			path: event.path,
+			path,
 			method: event.httpMethod,
 		},
 		async () => {
-			logger.debug(
-				{ method: event.httpMethod, path: event.path },
-				"Request received",
-			);
+			logger.debug({ method: event.httpMethod, path }, "Request received");
 
 			const origin = readOriginHeader(event.headers);
 
@@ -175,5 +176,6 @@ const rawHandler = async (event: APIGatewayProxyEvent, context: Context) =>
 			);
 		},
 	);
+};
 
 export const handler = withTelemetry(rawHandler);

package/src/jwt-auth.ts

@@ -4,6 +4,7 @@ import {
 	type JwtVerifier,
 	resolveVerifierConfig,
 } from "@remit/auth-service/verifier";
+import { readCalendarFeedToken } from "@remit/calendar-service";
 import { logger } from "@remit/logger-lambda";
 import type { APIGatewayProxyEvent, APIGatewayProxyResult } from "aws-lambda";
 
@@ -56,24 +57,39 @@ const hasLocalBypass = (): boolean =>
 	Boolean(process.env.LOCAL_ACCOUNT_CONFIG_ID);
 
 /**
- * The one route that runs without a token.
+ * The routes that run without a token.
  *
  * Microsoft redirects the browser here after consent, so the request carries no
  * Authorization header and no session to derive one from. The handler takes its
  * identity from the HMAC-signed `state` parameter and validates it there; that
  * signature is the gate, not a JWT.
  *
- * Hardcoded and single-entry, matching the edge exemption in
- * packages/apisix/src/route-table.ts. `@useAuth(NoAuth)` in the spec does not
- * open a path here — a future public route is added by hand.
+ * A calendar feed carries its credential in the path for the same reason: a
+ * subscribed client polls a URL and has no session to present, so the token is
+ * the gate and the handler compares it against a stored hash.
+ *
+ * Hardcoded, matching the edge exemption in packages/apisix/src/route-table.ts.
+ * `@useAuth(NoAuth)` in the spec does not open a path here — a future public
+ * route is added by hand.
  */
-const PUBLIC_ROUTE = {
-	method: "GET",
-	path: "/accounts/oauth/microsoft/callback",
-};
+const PUBLIC_ROUTES: readonly {
+	method: string;
+	matches: (path: string) => boolean;
+}[] = [
+	{
+		method: "GET",
+		matches: (path) => path === "/accounts/oauth/microsoft/callback",
+	},
+	{
+		method: "GET",
+		matches: (path) => readCalendarFeedToken(path) !== null,
+	},
+];
 
 const isPublicRoute = (event: APIGatewayProxyEvent): boolean =>
-	event.httpMethod === PUBLIC_ROUTE.method && event.path === PUBLIC_ROUTE.path;
+	PUBLIC_ROUTES.some(
+		(route) => route.method === event.httpMethod && route.matches(event.path),
+	);
 
 /**
  * Authenticate a self-host request from a better-auth RS256 JWT.

package/src/log-redaction.test.ts

@@ -0,0 +1,148 @@
+/**
+ * Issue #1065: what a request is allowed to leave behind in the log.
+ *
+ * A calendar feed's token is in its path and is the whole credential, so the
+ * path is a secret; a validation failure is logged at error level and the
+ * request it carries holds the caller's Authorization header. Both are asserted
+ * against captured stdout rather than by reading the call sites, because the
+ * leak was a field bound two frames away from the handler that logged it.
+ */
+
+import assert from "node:assert/strict";
+import { after, before, describe, it } from "node:test";
+import type { APIGatewayProxyEvent, APIGatewayProxyResult } from "aws-lambda";
+
+// pino writes to `process.stdout` only when its `write` has been replaced, so
+// the hook goes in before the logger is imported — which every import below
+// does transitively. Writes pass through whenever nothing is capturing, so the
+// test runner's own output still reaches the terminal.
+const originalWrite = process.stdout.write.bind(process.stdout);
+const written: string[] = [];
+let capturing = false;
+
+process.stdout.write = ((
+	chunk: string | Uint8Array,
+	...rest: unknown[]
+): boolean => {
+	if (capturing && typeof chunk === "string") {
+		written.push(chunk);
+		return true;
+	}
+	return (originalWrite as (...args: unknown[]) => boolean)(chunk, ...rest);
+}) as typeof process.stdout.write;
+
+process.env.LOG_LEVEL = "trace";
+
+const { calendarFeedPath, mintCalendarFeedToken } = await import(
+	"@remit/calendar-service"
+);
+const { _resetForTest, setClient } = await import("./service/data-client.js");
+const { createCalendarSqliteClient } = await import(
+	"./handlers/calendar-sqlite-fixture.js"
+);
+
+let handler: (
+	event: APIGatewayProxyEvent,
+	context: unknown,
+) => Promise<APIGatewayProxyResult>;
+let cleanup: () => void;
+
+const capture = async (
+	run: () => Promise<APIGatewayProxyResult>,
+): Promise<{ response: APIGatewayProxyResult; logged: string }> => {
+	written.length = 0;
+	capturing = true;
+	try {
+		const response = await run();
+		return { response, logged: written.join("") };
+	} finally {
+		capturing = false;
+	}
+};
+
+const send = (
+	event: Partial<APIGatewayProxyEvent> & { httpMethod: string; path: string },
+): Promise<APIGatewayProxyResult> =>
+	handler(
+		{
+			headers: {},
+			queryStringParameters: null,
+			body: null,
+			requestContext: {},
+			...event,
+		} as unknown as APIGatewayProxyEvent,
+		{ awsRequestId: "log-redaction", functionName: "test" },
+	);
+
+before(async () => {
+	_resetForTest();
+	process.env.DATA_BACKEND = "sqlite";
+	const fixture = await createCalendarSqliteClient();
+	cleanup = fixture.cleanup;
+	setClient(fixture.client);
+	({ handler } = (await import("./index.js")) as unknown as {
+		handler: typeof handler;
+	});
+});
+
+after(() => {
+	_resetForTest();
+	process.stdout.write = originalWrite as typeof process.stdout.write;
+	cleanup();
+});
+
+describe("what a request leaves in the log", () => {
+	it("never writes the feed token a subscriber polls with", async () => {
+		const { token } = mintCalendarFeedToken();
+
+		const { response, logged } = await capture(() =>
+			send({ httpMethod: "GET", path: calendarFeedPath(token) }),
+		);
+
+		assert.equal(
+			response.statusCode,
+			404,
+			"an unknown token, but still routed",
+		);
+		assert.ok(logged.length > 0, "the request has to have logged something");
+		assert.equal(
+			logged.includes(token),
+			false,
+			"the token in the path is the credential, so the path cannot be a log field",
+		);
+		assert.ok(
+			logged.includes("/feeds/calendar/<redacted>.ics"),
+			"which route was served is what an operator reads the log for",
+		);
+	});
+
+	it("never writes the credentials a failing request arrived with", async () => {
+		// A session is already established, so the bearer is never verified and the
+		// request reaches validation — where the whole parsed request, headers and
+		// all, used to be logged. The delete refuses because it declares
+		// `calendarId` as a required query parameter and none was sent.
+		const { response, logged } = await capture(() =>
+			send({
+				httpMethod: "DELETE",
+				path: "/calendar-events/8f14e45f-ceea-467a-9c9e-9c9e9c9e9c9e",
+				headers: {
+					Authorization: "Bearer x",
+					Cookie: "session=secret-cookie-value",
+				},
+				requestContext: {
+					authorizer: { claims: { sub: "log-redaction-sub" } },
+				} as unknown as APIGatewayProxyEvent["requestContext"],
+			}),
+		);
+
+		assert.equal(response.statusCode, 400, response.body);
+		assert.ok(logged.includes("Validation failed"));
+		assert.equal(logged.includes("Bearer x"), false);
+		assert.equal(logged.includes("secret-cookie-value"), false);
+		assert.equal(
+			logged.includes("parsedRequest"),
+			false,
+			"the request that failed is not a field; its errors are",
+		);
+	});
+});