SECURITY: Add TableOptions flag for unsafe entity logging

[ahallctr-jpg]

2. Sensitive Data Logged in Production Code (Information Disclosure)

Files:

• TableController.Create.cs
• TableController.Replace.cs
• TableController.Read.cs
• TableController.cs

Issue: Full entity contents are logged via entity.ToJsonString() at LogInformaion level. This means all entity field values (potentially including PII, secrets, or sensitive business data) are written to application logs in production. The authorization failure log at line 163 also serializes the full entity.

TO DO:

Add an option to the table options UnsafeEntityLogging: boolean (defaults to false)
If UnsafeEntityLogging == true, then the entity ID is logged at Information and the Serialization is logged at Debug.
If UnsafeEntityLogging == false, then only the entity ID is logged at Information.

[ahallctr-jpg]

Analysis: UnsafeEntityLogging Flag

Summary

Six ToJsonString() calls across 4 controller files serialize full entity contents (potentially PII/secrets) at LogInformation level:

#	File	Line	Statement
1	TableController.Create.cs	27	"CreateAsync: {entity}", entity.ToJsonString()
2	TableController.Create.cs	34	"CreateAsync: created {entity}", entity.ToJsonString()
3	TableController.Replace.cs	28	"ReplaceAsync: {id} {entity}", id, entity.ToJsonString()
4	TableController.Replace.cs	60	"ReplaceAsync: replaced {entity}", updatedEntity.ToJsonString()
5	TableController.Read.cs	45	"ReadAsync: read {entity}", entity.ToJsonString()
6	TableController.cs	163	"{operation} {entity} statusCode=401 unauthorized", operation, entity?.ToJsonString()

T-Shirt Size: S

• 5 source files to change, 6 log statements to guard
• ~8 new test methods
• Estimated effort: 1–2 hours

Breaking Change Assessment

Not a breaking change. The new UnsafeEntityLogging property defaults to false, which changes the default logging behavior — full entity serialization is demoted from Information to Debug, and Information logs only the entity ID. However:

• Logging output is not part of the public API contract
• No existing tests assert on log output content (confirmed — zero logging assertions in the test suite)
• The Logger defaults to NullLogger.Instance, so most users never see these logs anyway
• Any user who was depending on full-entity logs at Information level can set UnsafeEntityLogging = true to restore the old behavior

This is a safe behavioral change with an opt-in escape hatch.

Implementation (5 files)

File	Change
TableControllerOptions.cs	Add public bool UnsafeEntityLogging { get; set; } (default false)
TableController.Create.cs	Guard 2 log calls with conditional
TableController.Replace.cs	Guard 2 log calls with conditional
TableController.Read.cs	Guard 1 log call with conditional
TableController.cs	Guard 1 log call with conditional (in AuthorizeRequestAsync)

The pattern at each call site:

// Before:
Logger.LogInformation("CreateAsync: created {entity}", entity.ToJsonString());

// After:
Logger.LogInformation("CreateAsync: created {id}", entity.Id);
if (Options.UnsafeEntityLogging)
{
    Logger.LogDebug("CreateAsync: entity {entity}", entity.ToJsonString());
}

Testing Impact

Existing Test	Action
Ctor_DefaultsDontChange	Add assertion: sut.UnsafeEntityLogging.Should().BeFalse()
Ctor_Roundtrips	Add assertion: set UnsafeEntityLogging = true, verify
All existing controller tests	No changes — none assert on logging

New tests needed:

New Test	Purpose
CreateAsync_UnsafeEntityLogging_False_LogsIdOnly	Verify LogInformation is called with entity ID, not full JSON
CreateAsync_UnsafeEntityLogging_True_LogsFullEntity	Verify LogDebug is called with full entity JSON
Same pattern for Replace, Read, AuthorizeRequest	~4 more test pairs

This requires setting up a mock ILogger to capture log calls. The test infrastructure already uses NSubstitute, so this is straightforward but adds ~8 new test methods.