src/server/jobs/logger.ts

import pino, { type DestinationStream } from 'pino';

export function createWorkerLogger(destination?: DestinationStream) {
  const allowed = [
    'fatal',
    'error',
    'warn',
    'info',
    'debug',
    'trace',
    'silent',
  ];
  const level = process.env.LOG_LEVEL ?? 'info';
  if (!allowed.includes(level)) throw new Error('LOG_LEVEL 配置无效');
  // JSON 一行一条，Docker/日志平台可以按 taskId、run、event 检索。
  // 不传入原始 Error（可能带连接串或 SQL）、job.data 全文、Cookie 或工单正文；脱敏是额外防线。
  const options = {
    level,
    base: { service: 'teamdesk-worker', pid: process.pid },
    timestamp: pino.stdTimeFunctions.isoTime,
    redact: {
      paths: [
        'password',
        'secret',
        'token',
        'cookie',
        'authorization',
        '*.password',
        '*.secret',
        '*.token',
        'headers.cookie',
        'headers.authorization',
        'DATABASE_URL',
        'REDIS_URL',
        'BETTER_AUTH_SECRET',
      ],
      censor: '[已隐藏]',
    },
  };
  return destination ? pino(options, destination) : pino(options);
}