fix(usage): address review — log hash not PII, empty-env fallback, track crashes

- usage_tracking: the per-query log line logged the namespaced graph_id
  ({base64(email)}_{db}); base64 email is reversible, so log a short SHA-256
  hash instead — keeps identity out of logs and neutralizes log-injection.
- config: ORGANIZATIONS_GRAPH falls back to "Organizations" when the env var
  is empty (not just unset), so a blank value can't target an empty graph.
- routes/graphs: record success=False when run_query/run_confirmed raise
  before the _Final sentinel (e.g. get_db_description), so pipeline crashes
  are still counted instead of silently bypassing tracking.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: galshubeli

api/config.py

@@ -17,7 +17,7 @@
 # Central user-management graph holding User/Identity/Token (and UsageEvent)
 # nodes. Single source of truth for the name used across auth, tokens, and
 # usage tracking — override with the ORGANIZATIONS_GRAPH env var.
-ORGANIZATIONS_GRAPH = os.getenv("ORGANIZATIONS_GRAPH", "Organizations")
+ORGANIZATIONS_GRAPH = os.getenv("ORGANIZATIONS_GRAPH") or "Organizations"
 
 # Configure litellm logging to prevent sensitive data leakage
 def configure_litellm_logging():

api/routes/graphs.py

@@ -201,6 +201,11 @@ async def stream():
             # Don't leak stack traces (CodeQL: information exposure through
             # exception). Log internally; emit a generic error event.
             logging.exception("Streaming query failed")
+            # Pipeline crashed before _Final, so _serialize_pipeline didn't
+            # record — count this attempt as a failure here.
+            record_query_usage_background(
+                request.state.user_id, namespaced, success=False
+            )
             yield json.dumps({
                 "type": "error",
                 "final_response": True,
@@ -246,6 +251,10 @@ async def stream():
         except Exception:  # pylint: disable=broad-exception-caught
             # See note on the query endpoint above (CodeQL).
             logging.exception("Streaming confirmed-destructive query failed")
+            # Pipeline crashed before _Final — record the failed attempt here.
+            record_query_usage_background(
+                request.state.user_id, namespaced, success=False
+            )
             yield json.dumps({
                 "type": "error",
                 "final_response": True,

api/routes/usage_tracking.py

@@ -24,6 +24,7 @@
 import asyncio
 import base64
 import binascii
+import hashlib
 import logging
 from typing import Optional
 
@@ -86,11 +87,14 @@ async def _write_usage(email: str, graph_id: str, is_demo: bool, success: bool,
         },
     )
     # Structured-ish log line so usage is visible to log aggregators even
-    # before any read API exists. Email (PII) is intentionally omitted; the
-    # user-influenced graph_id has CR/LF stripped to prevent log forging.
+    # before any read API exists. graph_id is the namespaced name
+    # ({base64(email)}_{db}) and base64 email is reversible, so log a short
+    # stable hash instead of the raw value — this keeps user identity out of
+    # logs and also neutralizes the CodeQL log-injection vector.
+    graph_ref = hashlib.sha256(graph_id.encode()).hexdigest()[:12]
     logging.info(
-        "usage_event graph_id=%s is_demo=%s success=%s",
-        graph_id.replace("\r", " ").replace("\n", " "), is_demo, success,
+        "usage_event graph=%s is_demo=%s success=%s",
+        graph_ref, is_demo, success,
     )