feat: see exactly what telemetry and log bundles send

[builtbyproxy]

Layer 8 of the audit fix stack (releases 2.11.0, a minor feature release). Fixes audit findings DOC-1, DOC-2, DOC-3, SEC-7, SEC-8, SEC-10 and MNT-3. Stacked on #153.

New admin-only endpoint POST Telemetry/RegenerateId; Telemetry/PreviewLogs moves from GET to POST so the note never sits in a URL (it had no caller before).

Release notes

You can now see exactly what Jellyscribe would send before anything leaves your server. In the admin settings, Integrations has a Preview of the anonymous telemetry ping, the exact JSON, with Copy and "Copy + regenerate ID" for bug reports, and a Regenerate ID button that gives your server a fresh anonymous identity whenever you like. The admin Overview asks once whether you would like to turn telemetry on, and never again after you answer. "Send to developer" on the Logs tab now has a Preview of the full bundle, your note included, and its confirmation lists everything the bundle holds. Email addresses no longer appear in Jellyscribe's logs or in a bundle: Serializd accounts are named by a short tag, and any address in older log lines is masked. A successful review's reply is no longer written to the log, and replies that older versions logged are cut from what you can send. The telemetry description is also more precise: usage counts are rough buckets, error counts are exact per week, and an extra ping goes out at most once a day when a new kind of error starts.

What's broken

• The README, the spec, the site's release notes and the bug report form point admins to "Preview exact JSON", "Regenerate ID", "Copy + regenerate ID" and a one-time opt-in banner. None of these exist.
  • The telemetry section has only a checkbox.
  • GET Telemetry/Preview has no caller, and BannerDismissed is never read.
  • Turning telemetry off and on keeps the same instance ID, so there is no way to unlink it.
• "Send logs to developer" promises a preview of exactly what is sent. The confirm box has none.
• A log bundle carries Serializd login emails, and every Jellyfin and Letterboxd username. The consent text mentions only "titles or a username".
• After a review is posted, up to 500 characters of Letterboxd's reply are logged at Info. The reply can echo the review.
• The telemetry checkbox says "one ping a week … never exact numbers". In fact:
  • error counts are exact;
  • an error ping goes out straight away when a new kind of error starts;
  • the README sample payload omits three error categories.

Why it happens

• The dashboard redesign dropped the telemetry preview, regenerate and banner UI, and the send-logs preview button. The endpoints and the flag stayed behind.
• The Serializd log calls name accounts by their login, which is an email.
• The log reader passes lines through as they are.
• The review logging predates the decision never to log review text.
• The consent copy was written for the usage buckets, before error categories were added. The ingest Worker accepts only numeric error counts and adds them within a week, so bucketing them is not an option.

What this PR does

• Integrations → Anonymous telemetry:
  • shows the instance ID;
  • Preview opens a dialog with the exact JSON, plus Copy and Copy + regenerate ID (which regenerates only if the copy worked);
  • Regenerate ID, confirmed in the page, calls the new admin-only POST Telemetry/RegenerateId.
• Admin Overview: a one-time notice (Enable / No thanks / See exactly what is sent) while telemetry is off and unanswered. Any answer, or turning telemetry on anywhere, sets BannerDismissed.
• Logs → Send to developer:
  • Preview shows the exact bundle, note included. It is a POST, so the note never lands in a URL.
  • The confirmation lists everything the bundle holds.
  • The preview and the send share one ID per server run, and the same note cap, so they match byte for byte.
• Logs:
  • Serializd accounts are logged as a short tag (serializd-3fa2b1), never by email.
  • The shared log reader masks email addresses, encoded forms included, for the Logs tab, the preview and the send alike.
  • It also cuts review-reply bodies that older releases logged.
• Review posting: logs only status and length on success. On failure it logs a short start of the reply, with the review text cut out.
• Telemetry copy and README: say usage counts are bucketed and error counts exact, describe the error pings, and list every error category in the sample.
• Specs: updated to match: the notice on the Overview, exact error counts, the regenerate endpoint, and the preview POST with masking.
• Cleanup: removes the unused SerializdAccount.SerializdUsername.

How it was tested

• dotnet test: 1309 passed.
• New tests cover:
  • email masking, in the Logs tab, the preview and the send;
  • the Serializd account tag;
  • legacy review lines;
  • review reply logging, on success, on failure, and when the reply quotes the review;
  • regenerate, its admin-only policy, and the expected admin set in the authorization test;
  • the opt-in notice flag;
  • exact error counts;
  • preview and send being byte-for-byte equal, including a long note;
  • the admin page markup.
• Each key test was shown to fail with its production line reverted.
• Playwright on throwaway Jellyfin 12.0 and 10.11 (under /jellyfin): 28 checks of the notice, Preview, Copy, Copy + regenerate, Regenerate with its confirm, and the bundle Preview. They ran with faked replies and against the real local endpoints, with config writes held in the browser, SendLogs blocked and telemetry left off on both servers.
• Live, RegenerateId returns 403 to a non-admin and 401 anonymously.

Screenshots

Taken on throwaway Jellyfin test servers with placeholder users and data; telemetry stayed off and nothing was sent.

Telemetry panel

Before	After

Send to developer

Before	After

Telemetry Preview

Regenerate ID confirm

Log bundle Preview (emails masked)

One-time telemetry question on the admin Overview