logging_config

Centralized logging configuration for Alkiviades.

SensitiveDataFilter

Bases: Filter

Scrub user content and credentials from every log record.

Installed on the root handlers regardless of ENCRYPTION_ENABLED — logging hygiene protects production from day one (add.md 14).

Rewrites record.msg so both the on-disk file and the admin /api/admin/logs endpoint only ever see redacted text.

filter(record)

Scrub a single log record in place; always returns True.

Formats record.msg with its args first (so scrubbing sees the final text), applies every sensitive-data pattern, and replaces record.msg with the redacted result. Exceptions are swallowed — scrubbing must never break logging.

setup_logging(log_file=None, level=logging.INFO)

Configure root logger with console and optional rotating file handler.

Parameters:

Name	Type	Description	Default
log_file	str | None	Path to log file. If None, only console logging is used.	None
level	int	Logging level (default INFO).	INFO

In production (Render), structured JSON lines are logged to stdout. In development, a rotating file handler keeps up to 3 files × 10 MB.

All handlers carry the SensitiveDataFilter so query strings, tokens, and credentials are redacted before they reach any sink.

tail_log(log_file, lines=100)

Return the last N lines of the log file.