Shut the parts kiosk behind a device token, and stop the health probe leaking

shopdb/core/api/dashboard.py

@@ -317,17 +317,30 @@ def get_widgets():
 
 @dashboard_bp.route('/health', methods=['GET'])
 def health_check():
-    """Health check endpoint (no auth required)."""
-    from shopdb import __version__
+    """Health check endpoint (no auth required).
 
+    Anonymous callers get a coarse status and nothing else. The probe used to
+    format str(e) straight into the body, and a pymysql OperationalError names
+    the database account, the app host's address, the driver and the failing
+    statement - the internal topology, handed to whoever asks, on a route
+    PUBLIC_ENDPOINTS declares open because "monitoring has no account". The
+    detail is logged server-side instead, where the people who need it are.
+
+    The version goes the same way. It told an anonymous caller exactly which
+    release to look up known issues for, and monitoring does not need it.
+    """
     try:
         db.session.execute(db.text('SELECT 1'))
-        db_status = 'healthy'
-    except Exception as e:
-        db_status = f'unhealthy: {str(e)}'
+        healthy = True
+    except Exception:
+        current_app.logger.exception('Health check database probe failed')
+        healthy = False
 
+    # Status code stays 200 either way. A monitor keyed on the body's status
+    # field is the documented contract here, and turning a degraded database
+    # into a transport-level failure would change what every existing check
+    # sees - a separate decision from not leaking the exception.
     return success_response({
-        'status': 'ok' if db_status == 'healthy' else 'degraded',
-        'database': db_status,
-        'version': __version__
+        'status': 'ok' if healthy else 'degraded',
+        'database': 'healthy' if healthy else 'unhealthy',
     })