Don't return internal error details in bulk member responses; gate SSO token logging (#7777)

src/api/core/organizations.rs

@@ -1156,7 +1156,10 @@ async fn bulk_reinvite_members(
     for member_id in data.ids {
         let err_msg = match reinvite_member_impl(&org_id, &member_id, &headers.user.email, &conn).await {
             Ok(()) => String::new(),
-            Err(e) => format!("{e:?}"),
+            Err(e) => {
+                warn!("Unable to reinvite member {member_id}: {e:?}");
+                e.message().to_owned()
+            }
         };
 
         bulk_response.push(json!(
@@ -1329,7 +1332,10 @@ async fn bulk_confirm_invite(
                 let user_key = invite.key.unwrap_or_default();
                 let err_msg = match confirm_invite_impl(&org_id, &member_id, &user_key, &headers, &conn, &nt).await {
                     Ok(()) => String::new(),
-                    Err(e) => format!("{e:?}"),
+                    Err(e) => {
+                        warn!("Unable to confirm member {member_id}: {e:?}");
+                        e.message().to_owned()
+                    }
                 };
 
                 bulk_response.push(json!(
@@ -1610,7 +1616,10 @@ async fn bulk_delete_member(
     for member_id in data.ids {
         let err_msg = match delete_member_impl(&org_id, &member_id, &headers, &conn, &nt).await {
             Ok(()) => String::new(),
-            Err(e) => format!("{e:?}"),
+            Err(e) => {
+                warn!("Unable to delete member {member_id}: {e:?}");
+                e.message().to_owned()
+            }
         };
 
         bulk_response.push(json!(
@@ -2222,7 +2231,10 @@ async fn bulk_revoke_members(
             for member_id in members {
                 let err_msg = match revoke_member_impl(&org_id, &member_id, &headers, &conn).await {
                     Ok(()) => String::new(),
-                    Err(e) => format!("{e:?}"),
+                    Err(e) => {
+                        warn!("Unable to revoke member {member_id}: {e:?}");
+                        e.message().to_owned()
+                    }
                 };
 
                 bulk_response.push(json!(
@@ -2325,7 +2337,10 @@ async fn bulk_restore_members(
     for member_id in data.ids {
         let err_msg = match restore_member_impl(&org_id, &member_id, &headers, &conn).await {
             Ok(()) => String::new(),
-            Err(e) => format!("{e:?}"),
+            Err(e) => {
+                warn!("Unable to restore member {member_id}: {e:?}");
+                e.message().to_owned()
+            }
         };
 
         bulk_response.push(json!(

src/sso.rs

@@ -309,7 +309,11 @@ pub async fn exchange_code(
         user_name: user_name.clone(),
     };
 
-    debug!("Authenticated user {authenticated_user:?}");
+    if CONFIG.sso_debug_tokens() {
+        debug!("Authenticated user {authenticated_user:?}");
+    } else {
+        debug!("Authenticated user {identifier}");
+    }
     sso_auth.auth_response = Some(authenticated_user.clone());
     sso_auth.updated_at = Utc::now().naive_utc();
     sso_auth.save(conn).await?;