Log details obfuscated to not leak info

backend/app/core/errors.py

@@ -0,0 +1,23 @@
+import re
+from uuid import uuid4
+
+from fastapi import Request
+
+
+SENSITIVE_PATTERN = re.compile(
+    r'(?i)(authorization\s*[:=]\s*bearer\s+[^\s,;]+|'
+    r'(?:token|password|secret|otp|code)(?:[_-](?:token|password|secret|code))?\s*[:=]\s*[^\s,;&]+|'
+    r'([?&](?:token|code|password|secret|otp)=[^&#\s]+))'
+)
+
+
+def request_id(request: Request) -> str:
+    return getattr(request.state, 'request_id', None) or str(uuid4())
+
+
+def redacted_error(error: Exception) -> str:
+    return SENSITIVE_PATTERN.sub('[REDACTED]', str(error))
+
+
+def public_error(request: Request, message: str) -> str:
+    return f'{message} Reference: {request_id(request)}'