fix(logs): redact secrets from request-body logs, cut render-time debug noise

- POST /api/groups logged the full request body, which now carries the
  store's SMTP password; a redactBody() helper masks smtpPassword, apiToken
  and password in the six log sites that print request bodies
- Groups.tsx logged a debug object on every render; removed
- BLReconciliation's auto-fill mutation logged five lines per verified
  delivery; collapsed to one DEV-gated line, keeping console.error

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FHdE9nEh8zHhQNGpCgrtYe

client/src/pages/BLReconciliation.tsx

@@ -150,52 +150,31 @@ export default function BLReconciliation() {
       
       // Auto-remplissage si facture trouvée (référence facture OU numéro BL)
       if (result.exists) {
-        console.log('🔍 DEBUG - Résultat complet de vérification:', {
-          deliveryId: variables.deliveryId,
-          exists: result.exists,
-          matchType: result.matchType,
-          invoiceReference: result.invoiceReference,
-          invoiceAmount: result.invoiceAmount,
-          dueDate: result.dueDate,
-          hasInvoiceRef: !!result.invoiceReference,
-          hasAmount: result.invoiceAmount !== undefined && result.invoiceAmount !== null,
-          hasDueDate: !!result.dueDate
-        });
-        
-        // Auto-remplir les champs dans la livraison via API
         const updateData: any = {};
-        
+
         // Ajouter la référence de facture SEULEMENT si trouvée via BL (pas déjà renseignée)
         if (result.invoiceReference && result.matchType === 'bl_number') {
           updateData.invoiceReference = result.invoiceReference;
-          console.log('✅ Ajout invoiceReference:', result.invoiceReference);
-        } else {
-          console.log('⚠️ Pas d\'ajout invoiceReference:', { hasRef: !!result.invoiceReference, matchType: result.matchType });
         }
-        
+
         // TOUJOURS mettre à jour le montant si disponible (peu importe le matchType)
         if (result.invoiceAmount !== undefined && result.invoiceAmount !== null) {
           updateData.invoiceAmount = result.invoiceAmount;
-          console.log('✅ Ajout invoiceAmount:', result.invoiceAmount);
-        } else {
-          console.log('⚠️ Pas d\'ajout invoiceAmount:', { amount: result.invoiceAmount });
         }
-        
+
         // TOUJOURS mettre à jour la date d'échéance si disponible (peu importe le matchType)
         if (result.dueDate) {
           updateData.dueDate = result.dueDate;
-          console.log('✅ Ajout dueDate:', result.dueDate);
-        } else {
-          console.log('⚠️ Pas d\'ajout dueDate:', { dueDate: result.dueDate });
         }
-        
-        console.log('📝 Données finales à sauvegarder:', { deliveryId: variables.deliveryId, updateData, matchType: result.matchType });
-        
+
+        if (import.meta.env.DEV) {
+          console.log('📝 Auto-remplissage:', { deliveryId: variables.deliveryId, updateData, matchType: result.matchType });
+        }
+
         // Ne faire l'appel que si on a des données à mettre à jour
         if (Object.keys(updateData).length > 0) {
           apiRequest(`/api/deliveries/${variables.deliveryId}`, "PUT", updateData)
             .then(() => {
-              console.log('✅ Données sauvegardées avec succès');
               // Invalidation différée : sinon chaque auto-remplissage relance un
               // refetch complet de la liste, qui relance l'effet, qui relance des
               // vérifications... jusqu'à saturer le navigateur.
@@ -204,8 +183,6 @@ export default function BLReconciliation() {
             .catch((error) => {
               console.error('❌ Erreur auto-remplissage:', error);
             });
-        } else {
-          console.log('⚠️ Aucune donnée à sauvegarder');
         }
       }
       

client/src/pages/Groups.tsx

@@ -87,16 +87,6 @@ export default function Groups() {
 
   // Protection renforcée contre les erreurs TypeError
   const nocodbConfigs = Array.isArray(rawNocodbConfigs) ? rawNocodbConfigs : [];
-  
-  console.log('🔍 Groups NocoDB Debug:', { 
-    rawNocodbConfigs, 
-    rawType: typeof rawNocodbConfigs,
-    nocodbConfigs,
-    configsType: typeof nocodbConfigs,
-    isArray: Array.isArray(rawNocodbConfigs),
-    length: nocodbConfigs.length,
-    environment: window.location.hostname
-  });
 
   // Comptages agrégés en base : la page n'affiche que des totaux, inutile de
   // rapatrier l'historique complet des commandes et des livraisons.

server/routes.ts

@@ -4,6 +4,16 @@ import { storage } from "./storage";
 import { setupLocalAuth, requireAuth } from "./localAuth";
 import { requireModulePermission, requireAdmin, requirePermission } from "./permissions";
 import { stripSmtpPassword } from "./sanitize";
+
+// Corps de requête sans les champs secrets : pour les logs uniquement
+function redactBody(body: any): any {
+  if (!body || typeof body !== 'object') return body;
+  const redacted = { ...body };
+  for (const key of ['smtpPassword', 'apiToken', 'password']) {
+    if (key in redacted && redacted[key]) redacted[key] = '[REDACTED]';
+  }
+  return redacted;
+}
 import {
   sendSupplierDocumentRequest,
   verifySmtpConfig,
@@ -988,7 +998,7 @@ export async function registerRoutes(app: Express): Promise<Server> {
         'user-agent': req.headers['user-agent']?.substring(0, 50) + '...'
       });
 
-      console.log('📋 POST /api/groups - Request body:', JSON.stringify(req.body, null, 2));
+      console.log('📋 POST /api/groups - Request body:', JSON.stringify(redactBody(req.body), null, 2));
 
       // Déterminer l'ID utilisateur selon l'environnement
       let userId;
@@ -1037,7 +1047,7 @@ export async function registerRoutes(app: Express): Promise<Server> {
       console.error('❌ Failed to create group:', {
         error: error?.message || 'Unknown error',
         stack: error?.stack,
-        body: req.body,
+        body: redactBody(req.body),
         userId: req.user?.id || req.user?.claims?.sub || 'unknown'
       });
 
@@ -1160,7 +1170,7 @@ export async function registerRoutes(app: Express): Promise<Server> {
         'content-length': req.headers['content-length']
       });
 
-      console.log('📋 POST /api/suppliers - Request body:', JSON.stringify(req.body, null, 2));
+      console.log('📋 POST /api/suppliers - Request body:', JSON.stringify(redactBody(req.body), null, 2));
 
       // Déterminer l'ID utilisateur selon l'environnement
       let userId;
@@ -1209,7 +1219,7 @@ export async function registerRoutes(app: Express): Promise<Server> {
       console.error('❌ Failed to create supplier:', {
         error: (error as Error).message,
         stack: error.stack,
-        body: req.body,
+        body: redactBody(req.body),
         userId: req.user?.id || req.user?.claims?.sub || 'unknown'
       });
 
@@ -1543,7 +1553,7 @@ export async function registerRoutes(app: Express): Promise<Server> {
     try {
       console.log('📦 Order creation started:', {
         userId: req.user?.id || req.user?.claims?.sub,
-        body: req.body,
+        body: redactBody(req.body),
         environment: process.env.NODE_ENV
       });
 
@@ -1590,7 +1600,7 @@ export async function registerRoutes(app: Express): Promise<Server> {
       console.error("❌ Error creating order:", {
         error: (error as Error).message,
         stack: error.stack,
-        body: req.body,
+        body: redactBody(req.body),
         userId: req.user?.id || req.user?.claims?.sub || 'unknown'
       });