TypeScript / Tested teaching helper
Allowlist safe authentication telemetry
Create a structured outcome without recording the input's token or password.
TypeScript
export function authEvent(input: {
operation: string; outcome: 'allowed' | 'denied';
token?: string; password?: string;
}) {
return {
event: 'auth.decision',
operation: input.operation,
outcome: input.outcome
};
}What matters
Only preapproved fields are copied to the event. Real systems additionally need access controls, retention limits, identifier policies and tests for exception-handler logging.
Test these cases
- Serialized output omits token
- Serialized output omits password
- Public error does not enumerate account state
Sources and limits
This is a reference snippet, not a substitute for reviewing the full vendor API contract, concurrency rules or production threat model. Do not paste secrets into sample code.
This pure helper has runnable Node.js tests in the downloadable educational bundle. Those tests do not verify a full production security system.