From e14fbf86b0efef830a528d86912dc532b4721789 Mon Sep 17 00:00:00 2001
From: Dave Liu <7david12liu@gmail.com>
Date: Mon, 13 Jul 2026 04:20:14 -0700
Subject: [PATCH 1/2] test: prove signup logs redact private data (#146)

---
 functions/ensureMemberProfile.test.js | 63 +++++++++++++++++++++++++++
 1 file changed, 63 insertions(+)

diff --git a/functions/ensureMemberProfile.test.js b/functions/ensureMemberProfile.test.js
index 67380576..7a875667 100644
--- a/functions/ensureMemberProfile.test.js
+++ b/functions/ensureMemberProfile.test.js
@@ -296,4 +296,67 @@ describe('signup profile compatibility', () => {
     expect(admin.__read(AUTH_USER.uid)).toMatchObject({ role: 'unverified' });
     expect(admin.__mocks.setCustomUserClaims).not.toHaveBeenCalled();
   });
+
+  test('logs only the fixed failure outcome and never user or provider data', async () => {
+    const canaries = [
+      'signup-member@example.test',
+      '+1-555-010-4242',
+      'oauth-token-canary',
+      'provider-response-canary',
+      'request-body-canary',
+      'https://runmprc.com/account?token=capability-canary#private',
+      'signup-uid-canary',
+      'Private Signup Name Canary',
+    ];
+    const hostileUser = {
+      ...AUTH_USER,
+      uid: canaries[6],
+      email: canaries[0],
+      displayName: canaries[7],
+      phoneNumber: canaries[1],
+      providerData: [{ providerId: canaries[3] }],
+    };
+    const providerFailure = Object.assign(new Error(canaries.join(' ')), {
+      email: canaries[0],
+      phone: canaries[1],
+      token: canaries[2],
+      response: { message: canaries[3] },
+      request: { body: canaries[4] },
+      url: canaries[5],
+    });
+    const consoleError = jest.spyOn(console, 'error').mockImplementation(() => {});
+    const { onSignUp } = require('./signup');
+
+    try {
+      await onSignUp(AUTH_USER);
+      expect(consoleError).not.toHaveBeenCalled();
+
+      admin.__mocks.firestoreApi.runTransaction.mockRejectedValueOnce(providerFailure);
+      let caught;
+      try {
+        await onSignUp(hostileUser);
+      } catch (error) {
+        caught = error;
+      }
+
+      expect(caught).toMatchObject({
+        code: 'internal',
+        message: 'Failed to create member record',
+      });
+      expect(caught).not.toBe(providerFailure);
+      expect(caught.cause).toBeUndefined();
+      expect(consoleError.mock.calls).toEqual([
+        ['Member profile setup failed during account creation.'],
+      ]);
+
+      const serializedConsole = JSON.stringify(consoleError.mock.calls);
+      const returnedError = `${caught.code}: ${caught.message}`;
+      canaries.forEach((canary) => {
+        expect(serializedConsole).not.toContain(canary);
+        expect(returnedError).not.toContain(canary);
+      });
+    } finally {
+      consoleError.mockRestore();
+    }
+  });
 });

From 329b58808b8e09d0f284c2f6b7369920aa6afdc6 Mon Sep 17 00:00:00 2001
From: Dave Liu <7david12liu@gmail.com>
Date: Mon, 13 Jul 2026 04:21:50 -0700
Subject: [PATCH 2/2] test: cover every signup console level (#146)

---
 functions/ensureMemberProfile.test.js | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/functions/ensureMemberProfile.test.js b/functions/ensureMemberProfile.test.js
index 7a875667..d9bba6a9 100644
--- a/functions/ensureMemberProfile.test.js
+++ b/functions/ensureMemberProfile.test.js
@@ -324,12 +324,18 @@ describe('signup profile compatibility', () => {
       request: { body: canaries[4] },
       url: canaries[5],
     });
+    const consoleDebug = jest.spyOn(console, 'debug').mockImplementation(() => {});
     const consoleError = jest.spyOn(console, 'error').mockImplementation(() => {});
+    const consoleInfo = jest.spyOn(console, 'info').mockImplementation(() => {});
+    const consoleLog = jest.spyOn(console, 'log').mockImplementation(() => {});
+    const consoleWarn = jest.spyOn(console, 'warn').mockImplementation(() => {});
+    const otherConsoleSpies = [consoleDebug, consoleInfo, consoleLog, consoleWarn];
+    const allConsoleSpies = [consoleError, ...otherConsoleSpies];
     const { onSignUp } = require('./signup');
 
     try {
       await onSignUp(AUTH_USER);
-      expect(consoleError).not.toHaveBeenCalled();
+      allConsoleSpies.forEach((spy) => expect(spy).not.toHaveBeenCalled());
 
       admin.__mocks.firestoreApi.runTransaction.mockRejectedValueOnce(providerFailure);
       let caught;
@@ -348,15 +354,18 @@ describe('signup profile compatibility', () => {
       expect(consoleError.mock.calls).toEqual([
         ['Member profile setup failed during account creation.'],
       ]);
+      otherConsoleSpies.forEach((spy) => expect(spy).not.toHaveBeenCalled());
 
-      const serializedConsole = JSON.stringify(consoleError.mock.calls);
+      const serializedConsole = JSON.stringify(
+        allConsoleSpies.map((spy) => spy.mock.calls),
+      );
       const returnedError = `${caught.code}: ${caught.message}`;
       canaries.forEach((canary) => {
         expect(serializedConsole).not.toContain(canary);
         expect(returnedError).not.toContain(canary);
       });
     } finally {
-      consoleError.mockRestore();
+      allConsoleSpies.forEach((spy) => spy.mockRestore());
     }
   });
 });