fix(telemetry): keep participant identity out of log message bodies - #7156
Open
omChauhanDev wants to merge 1 commit into
Open
fix(telemetry): keep participant identity out of log message bodies#7156omChauhanDev wants to merge 1 commit into
omChauhanDev wants to merge 1 commit into
Conversation
Redaction is field level: the PII log processor and the trace level logging
handler both rewrite record.attributes and neither touches the body. The
comment in traces.py says why, that callers pass user data through
extra={"lk.pii.<name>": ...} precisely because a log body cannot be redacted.
Four call sites interpolate a participant identity or a room name into the
message itself, so those values are exported as written even when the project
has redaction enabled: the duplicate participant task warning and the
participant entrypoint error in job.py, and the caller disconnect and room move
logs in the warm transfer workflow.
Each message becomes static and the value moves to extra, keyed with the
lk.pii.<name> literal every other logger extra in the tree uses. The warning in
job.py no longer needs its noqa for line length.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Redaction here is field-level filtering of log attributes.
telemetry.pii._PIIFilteringLogProcessor.on_emitrewritesrecord.attributesand_TraceLevelLoggingHandler._translatedoes the same; neither touches the record body. The commentin
traces.pysays why:Four call sites interpolate a participant identity or a room name into the message body, so those
values are exported as written even when the project has redaction enabled:
job.py, the duplicate participant-task warning and the participant-entrypoint errorbeta/workflows/warm_transfer.py, the caller-disconnect log and the room-move logBoth categories are the ones
REVIEW.mdlists first, and both already have a marked constant intelemetry/trace_types.py:ATTR_PARTICIPANT_IDENTITYandATTR_ROOM_NAME.Changes
Each message becomes static and the value moves to
extra, with the key written as alk.pii.<name>literal, which is how every other loggerextrain the tree writes it(
llm/utils.py,beta/workflows/dtmf_inputs.py,voice/agent_activity.py). No new imports, andjob.py's warning no longer needs its# noqa: E501.exc_infoon the entrypoint error is unchanged: the exception message and stacktrace are alreadyhandled by
_TraceLevelLoggingHandler.Both files are in one change because the new test is tree-wide, so fixing only one leaves it red.
Testing
tests/test_telemetry_pii_log_bodies.pyparseslivekit-agents/andlivekit-plugins/and failswhen a plain name or attribute chain matching an identity or a room name is interpolated into a
logger message. On main it reports all five expressions across the four sites. It reads
expressions rather than values, so it stays narrow:
f"{p.identity}"is flagged,f"{identity is not None}"is not.pytest --unit --audio_eot: 2575 passed, 5 skipped, against 2574 on unmodified main.ruff checkandruff format --check(995 files) clean,scripts/check_types.pyreports noissues in 650 source files.
All at
4d03f505c.