fix(frontend,backend): all stories panel groups by peer again, missing trashed file answers 404, access log hides the token

backend/src/api/access_log.py

@@ -1,19 +1,23 @@
 import logging
+import re
 
 QUERYLESS_PREFIXES = ("/mcp",)
 _PATH_ARG = 2
+_TOKEN = re.compile(r"(?<=[?&]token=)[^&]+")
 
 
-class DropQueryFilter(logging.Filter):
+class ScrubQueryFilter(logging.Filter):
     def filter(self, record: logging.LogRecord) -> bool:
         args = record.args
         if isinstance(args, tuple) and len(args) > _PATH_ARG:
             path = str(args[_PATH_ARG])
             if path.startswith(QUERYLESS_PREFIXES):
-                bare = path.partition("?")[0]
-                record.args = (*args[:_PATH_ARG], bare, *args[_PATH_ARG + 1 :])
+                path = path.partition("?")[0]
+            else:
+                path = _TOKEN.sub("***", path)
+            record.args = (*args[:_PATH_ARG], path, *args[_PATH_ARG + 1 :])
         return True
 
 
-def hide_mcp_query() -> None:
-    logging.getLogger("uvicorn.access").addFilter(DropQueryFilter())
+def scrub_access_log() -> None:
+    logging.getLogger("uvicorn.access").addFilter(ScrubQueryFilter())

backend/src/api/app.py

@@ -10,7 +10,7 @@ from fastapi.responses import FileResponse, RedirectResponse
 from fastmcp.utilities.lifespan import combine_lifespans
 from starlette.applications import Starlette
 
-from api.access_log import hide_mcp_query
+from api.access_log import scrub_access_log
 from api.auth import BearerAuthMiddleware
 from api.mcp.server import mcp
 from api.realtime import hub
@@ -50,7 +50,7 @@ if env.auth.token is None:
     raise RuntimeError(msg)
 _token = env.auth.token.get_secret_value()
 
-hide_mcp_query()
+scrub_access_log()
 
 mcp_app = mcp.http_app(path="/")
 

backend/src/api/routers/storage.py

@@ -98,7 +98,7 @@ async def serve_trashed(
     storage_key: str,
 ) -> FileResponse:
     item = await storage_read.get_trash_item(pool, storage_key)
-    if item is None:
+    if item is None or not storage.trashed(storage_key):
         raise HTTPException(status_code=404, detail="file is not in trash")
     return FileResponse(
         storage.trash_url(storage_key),