Summary

Redact sensitive database connection details (host, port, database name) from error-level log messages in the main chain follower module. This addresses security audit finding PM-19904 (Least Authority Issue AF) — information leakage through verbose error logging.

🎫 Ticket 📐 Engineering

Motivation

When the node encounters a database connection failure, error-level logs previously included the database host, port, and name. These details are routinely collected by monitoring tools and could aid targeted attacks if logs are exposed. This change moves infrastructure details to debug-level logging while preserving the error indication and underlying cause at error level.

Changes

• Error redaction: Simplified PostgresConnectionError from 4 fields (host, port, db, error) to 1 field (error only) in both node/src/main_chain_follower.rs and primitives/mainchain-follower/src/data_source/mod.rs
• Debug logging: Added log::debug! calls that emit full connection details at debug level for authorized troubleshooting
• Idiomatic error handling: Return typed PostgresConnectionError directly from map_err closures (no intermediate .to_string())
• Tests: Added connection_error_redacts_infrastructure_details unit test in node crate; rewrote connection_error_redacts_host_port_and_database integration test in primitives crate to verify redaction
• Change file: changes/changed/audit-redact-db-connection-logging.md

Submission Checklist

• Changes are backward-compatible (or flagged if breaking)
• Pull request description explains why the change is needed
• Self-reviewed the diff
• I have included a change file, or skipped for this reason: [reason]
• If the changes introduce a new feature, I have bumped the node minor version
• Update documentation (if relevant)
• No new todos introduced

Fork Strategy

• Node Runtime Update
• Node Client Update
• Other
• N/A