Production Checklist — Logging, Monitoring & Hardening

# ── 1. Structured JSON logging ──
import json, logging, sys

class JsonFormatter(logging.Formatter):
    def format(self, record):
        entry = {"ts": self.formatTime(record), "level": record.levelname,
                 "logger": record.name, "msg": record.getMessage()}
        for key in ("request_id", "method", "path", "status", "ms", "user_id"):
            if hasattr(record, key):
                entry[key] = getattr(record, key)
        return json.dumps(entry)

handler = logging.StreamHandler(sys.stdout)      # stdout — the platform collects
handler.setFormatter(JsonFormatter())
logging.basicConfig(level=logging.INFO, handlers=[handler])

# access middleware logs with extra= (marries the Middleware chapter):
# log.info("request", extra={"request_id": rid, "method": m,
#                            "path": p, "status": s, "ms": elapsed})
# → {"ts":"...","level":"INFO","msg":"request","request_id":"7f3a",
#    "method":"GET","path":"/orders/42","status":200,"ms":3.2}
# Incident flow: user reports error ref 7f3a → filter request_id=7f3a →
# the request's whole story. NEVER log: passwords, tokens, OTPs, full cards.

# ── 2. Error tracking (Sentry) ──
import sentry_sdk
sentry_sdk.init(dsn=settings.sentry_dsn, environment=settings.env,
                traces_sample_rate=0.1)          # + FastAPI auto-integration
# unhandled exceptions → grouped issues, stack + request context, alerts.
# Your catch-all handler (Errors chapter) and Sentry coexist: user gets
# the bland 500 + ref id; Sentry gets the truth.

# ── 3. Metrics: the RED trio ──
# pip install prometheus-fastapi-instrumentator
from prometheus_fastapi_instrumentator import Instrumentator
Instrumentator().instrument(app).expose(app)     # → GET /metrics
# Rate, Errors, Duration (p50/p95/p99 histograms) per route.
# Alert on what users feel:  5xx ratio > 1% (5 min)  ·  p99 > 2s
#   · readiness failing  ·  DB pool exhausted. Not on CPU%.

# Security headers (one middleware):
@app.middleware("http")
async def security_headers(request, call_next):
    resp = await call_next(request)
    resp.headers.update({
        "X-Content-Type-Options": "nosniff",         # no MIME guessing
        "X-Frame-Options": "DENY",                   # no clickjacking iframes
        "Strict-Transport-Security": "max-age=63072000; includeSubDomains",
        "Referrer-Policy": "strict-origin-when-cross-origin",
    })
    return resp

# ── THE LAUNCH GATE — every box is a chapter you've done ──
# Config & secrets
#   □ all config via Settings/env; missing required = boot failure
#   □ secrets in platform store; .env gitignored; docs_url=None in prod
# Auth
#   □ Argon2/bcrypt hashes · short JWT + refresh · algorithms pinned
#   □ rate limit /token and /otp/* · vague login errors (no enumeration)
# Data
#   □ migrations via Alembic release step · pool sized vs max_connections
#   □ pool_pre_ping · N+1 audited on list endpoints · size caps (le=100)
# Resilience
#   □ timeout on EVERY external call · retries only with backoff+jitter
#     and idempotency · graceful shutdown verified (SIGTERM test!)
# HTTP surface
#   □ CORS explicit origins · security headers · upload caps (app + proxy)
#   □ response_model everywhere (no leaks) · error envelope, no tracebacks
# Observability
#   □ JSON logs w/ request_id · Sentry wired · RED alerts · /health/live
#     + /health/ready wired to the platform
# Tests & deploy
#   □ CI green: validation tables, authz matrix, race tests
#   □ image non-root · exec-form CMD · same image staging→prod
#
# Ship it. 🚀  (Then read the Kafka and Microservices tracks —
# this service is about to have siblings.)