kolaenteandkolaente e983fa10c7 fix(web): stop logging the full auth object on permission denials ...

log.Warningf formatted a web.Auth with %v on the create, read, update and
delete denial paths. That holds a *user.User, which has a Password field
carrying the bcrypt hash and no String method, so every denied request wrote
a password hash into the log at warning level. Log the user id instead.

2026-07-29 07:58:17 +00:00

..

core.go

fix(web): stop logging the full auth object on permission denials

2026-07-29 07:58:17 +00:00

create.go

refactor(handler): extract DoCreate from CreateWeb

2026-04-21 09:23:13 +00:00

delete.go

refactor(handler): extract DoDelete from DeleteWeb

2026-04-21 09:23:13 +00:00

error.go

refactor(handler): return domain error for forbidden instead of echo.HTTPError

2026-04-21 09:23:13 +00:00

helper.go

…

read_all.go

refactor(handler): extract DoReadAll from ReadAllWeb

2026-04-21 09:23:13 +00:00

read_one.go

refactor(handler): extract DoReadOne from ReadOneWeb

2026-04-21 09:23:13 +00:00

update.go

refactor(handler): extract DoUpdate from UpdateWeb

2026-04-21 09:23:13 +00:00