Say AsScalar instead of restating ToString

Same output, but it states the intent: leave a SecretString whole rather
than transform it. The comment now separates the two lines by what they
do, because they are not the same kind of thing - the policy is the
protection, and without it a masked object is written out property by
property, while this line only decides whether a secret reads as its
length or as {"HasValue":true}.

Co-authored-by: rmcrackan <rmcrackan@gmail.com>
This commit is contained in:
Cursor Agentandrmcrackan committed 2026-08-17 02:08:57 +00:00
1 parent 742e58d2e8
commit 4ac94d1ff2
1 file changed
+5 -3
@@ -163,10 +163,12 @@ public partial class Configuration
.ReadFrom.Configuration(configuration, readerOptions)
.Destructure.ByTransforming<LongPath>(lp => lp.Path)
.Destructure.With<LogFileFilter>()
// last lines of defense for structured logging: a masked identity instead of the object, and a
// secret that renders as its shape instead of its contents
// protection: without this, an ILogMasked logged as {@Account} is written out property by property
.Destructure.With<MaskedLogEntryPolicy>()
.Destructure.ByTransforming<SecretString>(secret => secret.ToString())
// legibility rather than protection. A SecretString is already safe wherever it lands - it has no
// public member holding the value - but asking Serilog to take one apart yields
// {"HasValue":true,"$type":"SecretString"} instead of the length, so tell Serilog to leave it whole.
.Destructure.AsScalar<SecretString>()
.CreateLogger();
SerilogInitialized = true;
}