Log details obfuscated to not leak info

backend/app/api/user_config.py

@@ -7,7 +7,7 @@ from io import BytesIO
 from datetime import datetime, timedelta, timezone
 from uuid import uuid4
 
-from fastapi import APIRouter, Depends, File, HTTPException, UploadFile
+from fastapi import APIRouter, Depends, File, HTTPException, Request, UploadFile
 from PIL import Image, UnidentifiedImageError
 from pydantic import BaseModel
 
@@ -20,8 +20,11 @@ from backend.app.services.email_service import send_verification_email, smtp_con
 from backend.app.core.config import settings
 from backend.app.services.secret_store import decrypt_secret, encrypt_secret
 from backend.app.services.audit_service import record_audit_event
+from backend.app.core.errors import public_error, redacted_error, request_id
+import logging
 
 router = APIRouter()
+logger = logging.getLogger(__name__)
 
 MAX_AVATAR_BYTES = 2 * 1024 * 1024
 MAX_AVATAR_PIXELS = 25_000_000
@@ -186,7 +189,7 @@ def get_additional_emails(user: dict = Depends(get_current_user)):
 
 
 @router.post('/emails', status_code=201)
-def add_additional_email(payload: AdditionalEmail, user: dict = Depends(get_current_user)):
+def add_additional_email(payload: AdditionalEmail, request: Request, user: dict = Depends(get_current_user)):
     email = payload.email.strip().lower()
     if email == user['email'].lower():
         raise HTTPException(status_code=409, detail='This is already the primary email address')
@@ -209,7 +212,8 @@ def add_additional_email(payload: AdditionalEmail, user: dict = Depends(get_curr
         try:
             send_verification_email(email_address, user['username'], verification_url)
         except Exception as error:
-            raise HTTPException(status_code=503, detail=f'Email address added but verification email could not be sent: {error}') from error
+            logger.error('Additional email verification failed request_id=%s error=%s', request_id(request), redacted_error(error))
+            raise HTTPException(status_code=503, detail=public_error(request, 'Email address added but verification email could not be sent.')) from error
         with get_connection() as conn:
             conn.execute(
                 '''INSERT INTO app_settings (name, value, updated_at) VALUES (?, ?, CURRENT_TIMESTAMP)
@@ -221,7 +225,7 @@ def add_additional_email(payload: AdditionalEmail, user: dict = Depends(get_curr
 
 
 @router.post('/emails/{address_id}/resend')
-def resend_additional_email(address_id: str, user: dict = Depends(get_current_user)):
+def resend_additional_email(address_id: str, request: Request, user: dict = Depends(get_current_user)):
     now = datetime.now(timezone.utc)
     setting_name = f'email_verify_rate:{address_id}'
     with get_connection() as conn:
@@ -245,7 +249,8 @@ def resend_additional_email(address_id: str, user: dict = Depends(get_current_us
     try:
         send_verification_email(email, user['username'], verification_url)
     except Exception as error:
-        raise HTTPException(status_code=503, detail=f'Verification email could not be sent: {error}') from error
+        logger.error('Verification email resend failed request_id=%s error=%s', request_id(request), redacted_error(error))
+        raise HTTPException(status_code=503, detail=public_error(request, 'Verification email could not be sent.')) from error
     sends = int(rate.get('sends', 0)) + 1
     updated = {'sends': sends, 'last_sent': now.isoformat()}
     if sends >= 5: