From aad763562340860145ef295373a2d1a836d385e5 Mon Sep 17 00:00:00 2001
From: curo1305 <curo1305@proton.me>
Date: Thu, 4 Jun 2026 23:10:07 +0200
Subject: [PATCH] fix(06): CR-05 hash attempted email in audit log to avoid PII
 storage

Replace raw email in auth.login_failed metadata_ with a 16-char
SHA-256 prefix (attempted_email_hash). Update AuditLogTab.vue to
display the hash field instead. This removes plaintext email PII from
the unencrypted audit_logs JSONB column as required by CLAUDE.md.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 backend/api/auth.py                           | 3 ++-
 frontend/src/components/admin/AuditLogTab.vue | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/backend/api/auth.py b/backend/api/auth.py
index 3da7e40..730b352 100644
--- a/backend/api/auth.py
+++ b/backend/api/auth.py
@@ -19,6 +19,7 @@ Security invariants:
 """
 from __future__ import annotations
 
+import hashlib
 import uuid
 from typing import Literal, Optional
 
@@ -213,7 +214,7 @@ async def login(
             actor_id=user.id if user else None,
             resource_id=None,
             ip_address=_ip,
-            metadata_={"attempted_email": str(body.email)},
+            metadata_={"attempted_email_hash": hashlib.sha256(str(body.email).encode()).hexdigest()[:16]},
         )
         await session.commit()
         raise HTTPException(
diff --git a/frontend/src/components/admin/AuditLogTab.vue b/frontend/src/components/admin/AuditLogTab.vue
index ade4021..feb5035 100644
--- a/frontend/src/components/admin/AuditLogTab.vue
+++ b/frontend/src/components/admin/AuditLogTab.vue
@@ -111,7 +111,7 @@
             <td class="px-4 py-3 text-sm text-gray-700">{{ entry.user_handle || entry.user_id || '—' }}</td>
             <td class="px-4 py-3 text-sm text-gray-500">
               <span v-if="entry.user_email">{{ entry.user_email }}</span>
-              <span v-else-if="entry.metadata_?.attempted_email" class="text-amber-600">{{ entry.metadata_.attempted_email }} <span class="text-xs">(attempted)</span></span>
+              <span v-else-if="entry.metadata_?.attempted_email_hash" class="text-amber-600 font-mono text-xs">hash:{{ entry.metadata_.attempted_email_hash }} <span class="text-xs not-italic">(attempted)</span></span>
               <span v-else>—</span>
             </td>
             <td class="px-4 py-3">