rewirite to new name

run.py

@@ -1,25 +1,38 @@
-"""Entrypoint. Runs the Flask app over plain HTTP on a local port.
-
-TLS is NOT terminated here: a trusted reverse proxy (nginx/caddy/...)
-in front handles HTTPS and forwards to this internal HTTP port. The
-proxy must be the only thing reachable from outside; bind this app to
-127.0.0.1 (or a private interface) only.
-"""
-
 import os
 
-from backend.app import app
-from backend import storage
+from werkzeug.serving import WSGIRequestHandler
+
+from backend.app import create_app
+
+app = create_app()
 
 
-def main():
-    storage.init_db()
+class RedactingRequestHandler(WSGIRequestHandler):
+    """Werkzeug access log handler that never writes query strings to the log.
 
-    host = os.environ.get("HOST", "127.0.0.1")
-    port = int(os.environ.get("PORT", "8085"))
+    Credentials must never be sent in URLs, but as defense in depth this also
+    prevents any accidental query value (tokens, emails, passwords) from being
+    recorded in the server log.
+    """
 
-    app.run(host=host, port=port)
+    def log_request(self, code="-", size="-"):
+        try:
+            target = self.path or self.requestline.split(" ")[1]
+        except Exception:
+            target = self.requestline
+        if "?" in target:
+            target = target.split("?", 1)[0] + "?[redacted]"
+        try:
+            msg = f"{self.command} {target} {self.request_version}"
+        except Exception:
+            msg = self.requestline
+        code = str(code)
+        level = "warning" if code[:1] in ("4", "5") else "info"
+        self.log(level, '"%s" %s %s', msg, code, size)
 
 
 if __name__ == "__main__":
-    main()
+    host = os.environ.get("FLASK_HOST", "127.0.0.1")
+    port = int(os.environ.get("FLASK_PORT", "8085"))
+    debug = os.environ.get("FLASK_DEBUG", "false").lower() == "true"
+    app.run(host=host, port=port, debug=debug, request_handler=RedactingRequestHandler)