refinement phase 9

server/src/Infrastructure/Baya.Infrastructure.CrossCutting/Seams/LoggingSmsSender.cs

@@ -4,22 +4,24 @@ using Microsoft.Extensions.Logging;
 namespace Baya.Infrastructure.CrossCutting.Seams;
 
 /// <summary>
-/// Mock <see cref="ISmsSender"/>: "delivers" by logging. The OTP code is written to the log so a
-/// developer can complete the login flow; the phone number is never logged in full (PII policy) —
-/// only its last four digits. The real implementation swaps to an Iranian SMS gateway
-/// (Kavenegar/Ghasedak/SMS.ir) behind the same interface via a registration change.
+/// Mock <see cref="ISmsSender"/>: "delivers" by logging. The OTP <b>code is never logged</b> (refinement-phase-9
+/// §9.3 — no secrets/PII in logs, in any environment): a developer retrieves it from the Development-only
+/// <c>GET /api/v1/dev/last_otp/{phone}</c> helper (the <c>DevCapturingSmsSender</c> decorator), never the log.
+/// The phone number is logged only as its last four digits. The real implementation swaps to an Iranian SMS
+/// gateway (Kavenegar/Ghasedak/SMS.ir) behind the same interface via a registration change.
 /// </summary>
 public sealed class LoggingSmsSender(ILogger<LoggingSmsSender> logger) : ISmsSender
 {
     public Task SendOtpAsync(string phone, string code, CancellationToken cancellationToken = default)
     {
-        logger.LogWarning("MOCK SMS — OTP code {OtpCode} for phone ending in {PhoneTail}", code, Tail(phone));
+        // Deliberately does NOT log the OTP code — it is a login secret. Retrieve it via /dev/last_otp in Development.
+        logger.LogInformation("MOCK SMS — OTP issued to phone ending in {PhoneTail}", Tail(phone));
         return Task.CompletedTask;
     }
 
     public Task SendAsync(string phone, string message, CancellationToken cancellationToken = default)
     {
-        logger.LogWarning("MOCK SMS — message to phone ending in {PhoneTail}: {Message}", Tail(phone), message);
+        logger.LogInformation("MOCK SMS — message to phone ending in {PhoneTail}: {Message}", Tail(phone), message);
         return Task.CompletedTask;
     }