pn-new-crm/src/lib/logger.ts

import pino from 'pino';

export const logger = pino({
  level: process.env.LOG_LEVEL ?? 'info',
  redact: {
    paths: [
      'password',
      'token',
      'secret',
      'accessKey',
      'secretKey',
      'creditCard',
      '*.password',
      '*.token',
      '*.secret',
      '*.accessKey',
      '*.secretKey',
      // Encrypted credential blobs surface in storage / smtp config logs
      // unintentionally; redact them defensively even though they're
      // already AES-encrypted at rest.
      '*.secretKeyEncrypted',
      '*.smtpPassEncrypted',
      '*.imapPassEncrypted',
      '*.proxyHmacSecretEncrypted',
      // HTTP authorization headers (Bearer tokens, Basic creds) leak via
      // err.config.headers on http-client error logs.
      '*.headers.authorization',
      '*.headers.Authorization',
      '*.headers["x-documenso-secret"]',
      '*.config.headers.Authorization',
      '*.config.headers.authorization',
      // Cookie headers can carry session tokens.
      '*.headers.cookie',
      '*.headers.Cookie',
      // Two-level nesting for things like `req.headers.authorization` or
      // `cfg.s3.secretKeyEncrypted`.
      '*.*.password',
      '*.*.token',
      '*.*.secret',
      '*.*.secretKeyEncrypted',
      '*.*.headers.authorization',
      '*.*.headers.Authorization',
    ],
    censor: '[REDACTED]',
  },
  transport:
    process.env.NODE_ENV !== 'production'
      ? { target: 'pino-pretty', options: { colorize: true } }
      : undefined,
  serializers: {
    err: pino.stdSerializers.err,
    req: pino.stdSerializers.req,
    res: pino.stdSerializers.res,
  },
});