fix(speakers): stop logging access_token and raw filter PII in bulk send debug/error logs

SpeakerService::triggerSendEmails's debug log json_encode()'d the full
payload, including access_token - confirmed leaking a live bearer token in
a real dev send today. Replaced with summit id, flow_event, speaker_ids
count and whether a filter was given.

ProcessSpeakersEmailRequestJob::failed()'s error log json_encode()'d the
raw filter, which can carry email/full_name PII (valid speaker filter
fields). New redactFilterFieldNames() logs only the filter's field names.

Found and confirmed via adversarial review of CodeRabbit's full-review
findings on PR #595.

test(speakers): add red-green verified regression test for filter PII redaction

testFailedChunkLogsFilterFieldNamesButNotTheirValues asserts the failed()
error log contains the filter's field names but not an email value from
it; reverting the redaction makes it fail (Mockery 0 matching calls).

Author: smarcet

app/Jobs/Emails/PresentationSubmissions/ProcessSpeakersEmailRequestJob.php

@@ -125,15 +125,15 @@ public function failed(\Throwable $e): void
         (
             sprintf
             (
-                "ProcessSpeakersEmailRequestJob::failed summit %s flow_event %s: chunk of %s speaker(s) failed (%s: %s); up to %s of them may not have been processed. Speaker ids in the chunk: [%s] filter %s. %s.",
+                "ProcessSpeakersEmailRequestJob::failed summit %s flow_event %s: chunk of %s speaker(s) failed (%s: %s); up to %s of them may not have been processed. Speaker ids in the chunk: [%s] filter fields %s. %s.",
                 $this->summit_id,
                 $flow_event,
                 count($speaker_ids),
                 get_class($e),
                 $e->getMessage(),
                 count($speaker_ids),
                 $ids_list,
-                json_encode($this->filter),
+                json_encode($this->redactFilterFieldNames($this->filter)),
                 $resend_hint
             )
         );
@@ -187,4 +187,19 @@ public function failed(\Throwable $e): void
             Log::error($ex);
         }
     }
+
+    /**
+     * Reduces a raw filter (["email==foo@bar.com", "presentations_selection_plan_id==78"]) to
+     * just its field names (["email", "presentations_selection_plan_id"]) so error logs never
+     * carry filter values that may be PII - email and full_name are valid filter fields
+     * (ISpeakerFilterFields::OPERATORS).
+     *
+     * @param mixed $filter
+     * @return string[]
+     */
+    private function redactFilterFieldNames($filter): array
+    {
+        if (empty($filter) || !is_array($filter)) return [];
+        return array_map(fn($condition) => preg_replace('/[=<>@!].*/', '', (string)$condition), $filter);
+    }
 }

app/Services/Model/Imp/SpeakerService.php

@@ -1243,9 +1243,11 @@ public function triggerSendEmails(Summit $summit, array $payload, $filter = null
         (
             sprintf
             (
-                "SpeakerService::triggerSendEmails summit %s payload %s process_db_chunk_size %s process_jon_chunk_size %s",
+                "SpeakerService::triggerSendEmails summit %s email_flow_event %s speaker_ids_count %s has_filter %s process_db_chunk_size %s process_jon_chunk_size %s",
                 $summit->getId(),
-                json_encode($payload),
+                $payload['email_flow_event'] ?? '',
+                isset($payload['speaker_ids']) ? count($payload['speaker_ids']) : 0,
+                !is_null($filter) ? 'yes' : 'no',
                 $process_db_chunk_size,
                 $process_jon_chunk_size
             )

tests/ProcessSpeakersEmailRequestJobFailedHookTest.php

@@ -194,4 +194,27 @@ public function testFailedChunkWithoutOutcomeRecipientOnlyLogsTheUnprocessedIds(
             ->withArgs(fn($message) => is_string($message) && str_contains($message, '44, 55'))
             ->once();
     }
+
+    public function testFailedChunkLogsFilterFieldNamesButNotTheirValues(): void
+    {
+        // email and full_name are valid speaker filter fields (ISpeakerFilterFields::OPERATORS),
+        // so the raw filter can carry PII. The error log must still say which fields were used
+        // (useful to reproduce the failed send) without writing the PII value itself.
+        Queue::fake();
+        Log::spy();
+
+        $job = new ProcessSpeakersEmailRequestJob(self::$summit->getId(), [
+            'email_flow_event' => 'SUMMIT_SUBMISSIONS_PRESENTATION_SPEAKER_ACCEPTED_ALTERNATE',
+            'speaker_ids' => [11, 22],
+        ], ['email==foo@bar.com', 'presentations_selection_plan_id==78']);
+
+        $job->failed(new \RuntimeException('worker killed mid-chunk'));
+
+        Log::shouldHaveReceived('error')
+            ->withArgs(fn($message) => is_string($message)
+                && str_contains($message, 'email')
+                && str_contains($message, 'presentations_selection_plan_id')
+                && !str_contains($message, 'foo@bar.com'))
+            ->once();
+    }
 }