Dev debuglog

[chakl]

various improvements:

• make log level configurable from config-exsaml.xml
• do not store SAML request ids unless needed
• remove console:log()
• doc clarifications

[line-o]

I believe the custom logging logic introduced with $exsaml:logdebug is for convenience, right?
If this was set to "debug" level by default one would have to change the global setting of an existdb instance and then restart and with this feature it can be switched on and off while the db is running.
But you could argue that changing the level of these log entries should require a restart because it would log sensitive data. What is your though on this?

[line-o]

Since this value is rather static I would argue it is better to have it built once as declared variable of the module.

[chakl]

That would mean

declare %private variable $exsaml:saml-coll-reqid-base := "/db/apps/existdb-saml";
declare %private variable $exsaml:saml-coll-reqid := $exsaml:saml-coll-reqid-base || "/" || "saml-request-ids";

and that looks dirty to me.

[line-o]

I was thinking more like:

declare %private variable $exsaml:saml-coll-reqid-base := "/db/apps/existdb-saml";
declare %private variable $exsaml:saml-coll-reqid-name := "saml-request-ids";
declare %private variable $exsaml:saml-coll-reqid := $exsaml:saml-coll-reqid-base || "/" || $exsaml:saml-coll-reqid-name;

[chakl]

I was arguing that declareing a variable value derived from a previously declared variable might be wrong. Does the Xquery standard specify that declarations get processed sequentially? Don't think so, but I may be wrong.

[chakl]

I believe the custom logging logic introduced with $exsaml:logdebug is for convenience, right?

Actually, it was introduced to stop people editing the module code, just because they want to see a certain log message.
They can now enable "debug mode" and see all log messages from this module, including more detailed debug log messages that are not logged in normal operation.
Debug mode is for debugging the module's operation. It should not be enabled in normal setups.

This is controlled by the config-exsaml.xml:/config/@debug attribute. false (default) means standard logging, true means verbose debug logging.

But you could argue that changing the level of these log entries should require a restart because it would log sensitive data. What is your though on this?

• the module must not log sensitive persistent data (passwords, secrets). It may log sensitive volatile data (SAML assertions) when in debug mode
• debug mode is for developers and admins, who can access sensitive data anyway

[joewiz]

@chakl @line-o Is this PR good to go?