activesupport-json_logging 1.2.2 → 1.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 71ac52d26c4cca14a0eaed618927f9432880865ad9b24e43232b5801ce10a055
-  data.tar.gz: 81ef2c90e5d44fc7910f319acdbbd4bb9b56572075c6a28050fd05759349e91b
+  metadata.gz: 8860a79aadc768a5173400d8c56041edde0fcd66b9e3f2f50e4918956c31b451
+  data.tar.gz: 07420fcc1f8aa91271ebf0484a338b921dba8fd41c16e2e50adf789a9eaaed33
 SHA512:
-  metadata.gz: 0f8ebdfeb94e456cdffd8e8d176c9dde7dff4187f2547b721dd4ec33e229c290663386a1f1c091ee54e95821be3bc11eb8f02fbf645f3a9bd8a54ab1e79596b9
-  data.tar.gz: cbfdad0f75642ec096bf18ca154a9aef9ce3364d92a43c263ceea81f877f018db3459b1a3fc239b2025aa6d96815db8f37063675f33a29d24fd24de4eaeb2299
+  metadata.gz: df9baad44f3b33dce3e18b795691fd6e7d8d620930826d2d9e423808b266b294b6ab3355619df9a2a406d51c7c0d3338be984599871579fbc67b69c5fc198a42
+  data.tar.gz: c93486338ce6906fb91bd96b55732a67525883971d7b7551690b34a4280337482160c096459b63623f0c2e629cb41b6af028fa008b274fc756137e5f21fc9958

data/CHANGELOG.md

@@ -1,5 +1,25 @@
 # CHANGELOG
 
+## Unreleased
+
+## 1.3.1 (2026-09-04)
+
+- Copy large structured hashes before Rails parameter filtering so caller fields stay intact
+- Keep original key names on the large-hash encoder path when a Rails parameter filter is present
+- Isolate nested hashes in `with_context` from later caller mutations
+- Match fallback sensitive-key detection to Rails default filter substrings including email, otp, ssn, token, and credentials
+- Rebuild the compiled Rails parameter filter after in-place `filter_parameters` changes
+- Treat JSON object and array strings longer than 10,000 characters as truncated text
+- Replace home-directory prefixes in log strings and backtraces with a tilde
+- Skip EventSubscriber writes when the logger has INFO disabled; keep the Rails event timestamp as an integer
+- Keep overflow sensitive keys as filtered after the 50-key hash cap without copying their values
+- Require json 2.21.2 or newer
+
+## 1.3.0 (2026-07-25)
+
+- BREAKING: Require Ruby 3.2+ and Rails 7+ (drop Ruby 2.7–3.1 and Rails 6 support)
+- Add opt-in `JsonLogging::EventSubscriber` for Rails 8.1 `ActiveSupport::EventReporter` / `Rails.event` structured events
+
 ## 1.2.3 (2026-07-13)
 
 - Reduce per-line work for plain string, hash, tagged, and context-scoped log messages on common shapes

data/README.md

@@ -1,17 +1,10 @@
 # activesupport-json_logging
 
-[![Gem Version](https://badge.fury.io/rb/activesupport-json_logging.svg)](https://badge.fury.io/rb/activesupport-json_logging) [![Test Status](https://github.com/amkisko/activesupport-json_logging.rb/actions/workflows/test.yml/badge.svg)](https://github.com/amkisko/activesupport-json_logging.rb/actions/workflows/test.yml) [![codecov](https://codecov.io/gh/amkisko/activesupport-json_logging.rb/graph/badge.svg?token=UX80FTO0Y0)](https://codecov.io/gh/amkisko/activesupport-json_logging.rb) [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=amkisko_activesupport-json_logging.rb&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=amkisko_activesupport-json_logging.rb)
+[![Gem Version](https://badge.fury.io/rb/activesupport-json_logging.svg)](https://badge.fury.io/rb/activesupport-json_logging) [![Test Status](https://github.com/amkisko/activesupport-json_logging.rb/actions/workflows/test.yml/badge.svg)](https://github.com/amkisko/activesupport-json_logging.rb/actions/workflows/test.yml) [![codecov](https://codecov.io/gh/amkisko/activesupport-json_logging.rb/graph/badge.svg?token=UX80FTO0Y0)](https://app.codecov.io/github/amkisko/activesupport-json_logging.rb) [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=amkisko_activesupport-json_logging.rb&metric=alert_status)](https://sonarcloud.io/project/overview?id=amkisko_activesupport-json_logging.rb)
 
 Structured JSON logging for Rails and ActiveSupport with a safe, single-line formatter.
 No dependencies beyond Rails and Activesupport.
-Supports Rails versions from 6 to 8.
-
-Sponsored by [Kisko Labs](https://www.kiskolabs.com).
-
-<a href="https://www.kiskolabs.com">
-  <img src="kisko.svg" width="200" alt="Sponsored by Kisko Labs" />
-</a>
-
+Supports Ruby 3.2+ and Rails 7–8.
 
 ## Installation
 
@@ -46,6 +39,7 @@ end
 - Native `tagged` method support - use it just like Rails' tagged logger
 - Service-specific tagged loggers - create loggers with permanent tags using `logger.tagged("service")` without a block
 - Full compatibility with `ActiveSupport::BroadcastLogger` (Rails 7.1+)
+- Opt-in `JsonLogging::EventSubscriber` for Rails 8.1 `ActiveSupport::EventReporter` / `Rails.event`
 - Automatic Rails integration via Railtie (auto-requires the gem in Rails apps)
 
 ## Basic usage
@@ -132,6 +126,37 @@ sidekiq_logger.info("Job enqueued")      # Tagged with "sidekiq"
 api_logger.info("Request received")      # Tagged with "api"
 ```
 
+### Rails 8.1 Event Reporter
+
+Rails 8.1 adds `Rails.event` (`ActiveSupport::EventReporter`) for structured events that complement `Rails.logger`. Setting `config.logger` to a `JsonLogging` logger does not subscribe you to events. Register a subscriber:
+
+```ruby
+# config/initializers/json_logging.rb
+subscriber = JsonLogging::EventSubscriber.new(logger: -> { Rails.logger })
+Rails.event.subscribe(subscriber)
+
+# Optional: only a subset of events
+Rails.event.subscribe(subscriber) { |event| event[:name].start_with?("app.") }
+```
+
+Pass either `logger:` or `io:`, not both. A callable `logger:` is resolved on each emit (the Railtie opt-in uses this so a later `Rails.logger=` swap is picked up).
+
+Or enable the Railtie opt-in (off by default):
+
+```ruby
+# config/application.rb or an environment file
+config.json_logging.subscribe_event_reporter = true
+```
+
+The subscriber writes one JSON line per event and keeps the Rails event shape (`name`, `payload`, `tags`, `context`, `timestamp`, `source_location`). It writes through `Logger#<<` so the logger formatter does not wrap the event again. It skips that write when the logger reports that INFO is disabled (`logger.level` above INFO). An IO destination always writes. `timestamp` stays the Rails event integer (nanoseconds), not the ISO8601 string used by `JsonLoggerExtension`. Payload and tag objects that implement `#serialize` are encoded via that method. Encode and write failures never raise from `#emit`.
+
+```ruby
+Rails.event.set_context(request_id: "abc123")
+Rails.event.tagged("billing") do
+  Rails.event.notify("invoice.created", invoice_id: 3)
+end
+```
+
 ### BroadcastLogger integration
 
 `ActiveSupport::BroadcastLogger` (Rails 7.1+) allows writing logs to multiple destinations simultaneously. `JsonLogging` works seamlessly with `BroadcastLogger`:
@@ -460,6 +485,16 @@ formatter.call("INFO", Time.now, nil, "message")  # Output includes both tags
 
 **Note:** When used with a logger (via `JsonLogging.new`), the logger uses `FormatterWithTags` which automatically includes tags from the logger's tagged context. Use `Formatter` directly only when you need a standalone formatter without a logger instance.
 
+### JsonLogging::EventSubscriber
+
+Rails 8.1+ subscriber for `ActiveSupport::EventReporter`. See [Rails 8.1 Event Reporter](#rails-81-event-reporter).
+
+```ruby
+subscriber = JsonLogging::EventSubscriber.new(logger: -> { Rails.logger })
+# or: JsonLogging::EventSubscriber.new(io: $stdout)
+Rails.event.subscribe(subscriber)
+```
+
 ### JsonLogging.with_context
 
 Add thread-local context that appears in all log entries within the block:
@@ -554,7 +589,7 @@ This is useful for:
 - Temporary verbose logging in background jobs
 - Per-request log level changes
 
-**Note:** `local_level` is available in Rails 7.1+. In Rails 6-7.0, only the global `level` is available.
+**Note:** `local_level` is available in Rails 7.1+. In Rails 7.0, only the global `level` is available.
 
 #### Standard Logger Methods
 
@@ -581,9 +616,9 @@ logger.reopen                       # Reopen the logger (if supported by logdev)
 ## Security & privacy
 
 - **Rails ParameterFilter integration**: Automatically uses `Rails.application.config.filter_parameters` to filter sensitive data (passwords, tokens, etc.). This includes encrypted attributes automatically. See [Rails parameter filtering guide](https://thoughtbot.com/blog/parameter-filtering).
-- **Input sanitization**: Removes control characters, truncates long strings, and limits structure depth/size:
+- **Input sanitization**: Removes control characters, truncates long strings, redacts home-directory prefixes to `~`, and limits structure depth/size:
   - Maximum string length: 10,000 characters (truncated with `...[truncated]` suffix)
-  - Maximum context hash size: 50 keys (additional keys are truncated)
+  - Maximum context hash size: 50 keys (additional keys are truncated; overflow keys that match sensitive patterns or `filter_parameters` still appear as `[FILTERED]`)
   - Maximum nesting depth: 10 levels (deeper structures return `{"error" => "max_depth_exceeded"}`)
   - Maximum backtrace lines: 20 lines per exception
 - **Single-line JSON**: Emits single-line JSON to avoid log injection via newlines
@@ -597,7 +632,7 @@ This gem automatically uses Rails' `config.filter_parameters` when available. Co
 
 ```ruby
 Rails.application.config.filter_parameters += [
-  :passw, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn
+  :passw, :email, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn
 ]
 ```
 
@@ -652,7 +687,28 @@ gem build activesupport-json_logging.gemspec
 gem push activesupport-json_logging-*.gem
 ```
 
+## Links
+
+- [GitHub](https://github.com/amkisko/activesupport-json_logging.rb)
+- [GitLab](https://gitlab.com/amkisko/activesupport-json_logging.rb)
+- [RubyGems](https://rubygems.org/gems/activesupport-json_logging)
+- [Versions Atom](https://rubygems.org/gems/activesupport-json_logging/versions.atom) (feed id `9801944970071`)
+- [libraries.io](https://libraries.io/rubygems/activesupport-json_logging)
+- [Deps.dev](https://deps.dev/rubygems/activesupport-json_logging)
+- [SonarCloud](https://sonarcloud.io/project/overview?id=amkisko_activesupport-json_logging.rb)
+- [Snyk](https://snyk.io/test/github/amkisko/activesupport-json_logging.rb)
+- [Codecov](https://app.codecov.io/github/amkisko/activesupport-json_logging.rb)
+- [OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/amkisko/activesupport-json_logging.rb)
+
 ## License
 
 The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
 
+## Sponsors
+
+Sponsored by [Kisko Labs](https://www.kiskolabs.com).
+
+<a href="https://www.kiskolabs.com">
+  <img src="kisko.svg" width="200" alt="Sponsored by Kisko Labs" />
+</a>
+

data/lib/activesupport/json_logging/railtie.rb

@@ -2,7 +2,18 @@ require "json_logging"
 
 module JsonLogging
   class Railtie < ::Rails::Railtie
+    config.json_logging = ActiveSupport::OrderedOptions.new
+    config.json_logging.subscribe_event_reporter = false
+
     # This Railtie ensures json_logging is automatically required when Rails loads
     # Without this, users would need to manually require "json_logging" in initializers
+
+    initializer "json_logging.subscribe_event_reporter", after: :load_config_initializers do |app|
+      next unless app.config.json_logging.subscribe_event_reporter
+      next unless defined?(ActiveSupport::EventReporter)
+      next unless Rails.respond_to?(:event)
+
+      Rails.event.subscribe(JsonLogging::EventSubscriber.new(logger: -> { Rails.logger }))
+    end
   end
 end

data/lib/json_logging/event_subscriber.rb

@@ -0,0 +1,150 @@
+module JsonLogging
+  # Opt-in subscriber for ActiveSupport::EventReporter (Rails 8.1+).
+  # Preserves the Rails event hash shape as a single JSON line.
+  class EventSubscriber
+    def initialize(logger: nil, io: nil)
+      if !logger.nil? && !io.nil?
+        raise ArgumentError, "JsonLogging::EventSubscriber accepts only one of logger: or io:"
+      end
+      if logger.nil? && io.nil?
+        raise ArgumentError, "JsonLogging::EventSubscriber requires logger: or io:"
+      end
+
+      @logger = logger
+      @io = io
+    end
+
+    def emit(event)
+      line = begin
+        encode_event(event)
+      rescue => error
+        encode_fallback(event, error)
+      end
+
+      write_line(line)
+    rescue => error
+      report_write_error(error)
+      nil
+    end
+
+    private
+
+    def encode_event(event)
+      payload = {
+        "name" => Helpers.safe_string(event_field(event, :name)),
+        "payload" => serialize_payload(event_field(event, :payload)),
+        "tags" => serialize_tags(event_field(event, :tags)),
+        "context" => hash_or_empty(event_field(event, :context)),
+        "timestamp" => event_field(event, :timestamp)
+      }
+      source_location = event_field(event, :source_location)
+      payload["source_location"] = hash_or_empty(source_location) if source_location
+
+      LineEncoder.to_json_line(Sanitizer.sanitize_hash(payload))
+    end
+
+    def encode_fallback(event, error)
+      event_name = begin
+        Helpers.safe_string(event && event_field(event, :name))
+      rescue
+        nil
+      end
+
+      LineEncoder.to_json_line(
+        Sanitizer.sanitize_hash(
+          {
+            "name" => "json_logging.event_encode_error",
+            "event_name" => event_name,
+            "error" => {
+              "class" => error.class.name,
+              "message" => Helpers.safe_string(error.message)
+            }
+          }
+        )
+      )
+    end
+
+    def event_field(event, key)
+      return nil unless event.is_a?(Hash)
+
+      if event.key?(key)
+        event[key]
+      elsif event.key?(key.to_s)
+        event[key.to_s]
+      end
+    end
+
+    def serialize_payload(payload)
+      case payload
+      when Hash
+        payload
+      when nil
+        {}
+      else
+        serialize_object(payload)
+      end
+    end
+
+    def serialize_tags(tags)
+      return {} unless tags.is_a?(Hash)
+
+      tags.transform_values { |value| serialize_tag_value(value) }
+    end
+
+    def serialize_tag_value(value)
+      case value
+      when Hash, TrueClass, FalseClass, Numeric, NilClass, String
+        value
+      else
+        serialize_object(value)
+      end
+    end
+
+    def serialize_object(object)
+      if object.respond_to?(:serialize)
+        serialized = object.serialize
+        serialized.is_a?(Hash) ? serialized : {"value" => serialized}
+      elsif object.respond_to?(:to_h)
+        object.to_h
+      else
+        {
+          "class" => object.class.name,
+          "value" => Helpers.safe_string(object)
+        }
+      end
+    end
+
+    def hash_or_empty(value)
+      value.is_a?(Hash) ? value : {}
+    end
+
+    def write_line(line)
+      if @io
+        @io.write(line)
+        return
+      end
+
+      logger = resolve_logger
+      return if logger.respond_to?(:info?) && !logger.info?
+
+      logger << line
+    end
+
+    def resolve_logger
+      logger = @logger
+      # Proc responds to << (composition); Logger responds to add.
+      return logger.call if logger.respond_to?(:call) && !logger.respond_to?(:add)
+
+      logger
+    end
+
+    def report_write_error(error)
+      return unless defined?(ActiveSupport) && ActiveSupport.respond_to?(:error_reporter)
+      return if ActiveSupport.error_reporter.nil?
+
+      ActiveSupport.error_reporter.report(error, handled: true, severity: :error)
+    rescue
+      nil
+    end
+  end
+end

data/lib/json_logging/json_logger.rb

@@ -8,18 +8,16 @@ module JsonLogging
 
     def initialize(*args, **kwargs)
       # Initialize with minimal args to avoid ActiveSupport::Logger threading issues
-      # Rails 7+ supports kwargs, Rails 6 uses positional args only
       logdev = args.first || $stdout
       shift_age = args[1] || 0
       shift_size = args[2]
 
-      # Handle both positional and keyword arguments for Rails 6-8 compatibility
+      # Handle both positional and keyword arguments for Rails 7–8 compatibility
       if kwargs.empty? && shift_size
         super(logdev, shift_age, shift_size)
       elsif kwargs.empty?
         super(logdev, shift_age)
       else
-        # Rails 7+ may pass kwargs - delegate to parent
         super
       end
 

data/lib/json_logging/json_logger_extension.rb

@@ -95,7 +95,7 @@ module JsonLogging
 
     def current_tags
       # Use IsolatedExecutionState (Rails 7.1+) for better thread/Fiber safety
-      # Falls back to Thread.current for Rails 6-7.0
+      # Falls back to Thread.current for Rails 7.0
       if defined?(ActiveSupport::IsolatedExecutionState)
         ActiveSupport::IsolatedExecutionState[tags_key] ||= []
       else
@@ -105,7 +105,7 @@ module JsonLogging
 
     def set_tags(new_tags)
       # Use IsolatedExecutionState (Rails 7.1+) for better thread/Fiber safety
-      # Falls back to Thread.current for Rails 6-7.0
+      # Falls back to Thread.current for Rails 7.0
       if defined?(ActiveSupport::IsolatedExecutionState)
         ActiveSupport::IsolatedExecutionState[tags_key] = new_tags
       else

data/lib/json_logging/line_encoder.rb

@@ -223,14 +223,6 @@ module JsonLogging
       "#{JSON.generate(payload)}\n"
     end
 
-    def build_sanitized_hash_payload(message:, severity:, timestamp:)
-      hash = message.is_a?(Hash) ? message : message.to_hash
-      payload = Sanitizer.sanitize_hash(hash)
-      payload["severity"] = severity
-      payload["timestamp"] = timestamp
-      payload
-    end
-
     def deep_stringify_structure(obj)
       case obj
       when Hash

data/lib/json_logging/message_parser.rb

@@ -25,6 +25,8 @@ module JsonLogging
     end
 
     def json_string?(str)
+      return false if str.length > Sanitizer::MAX_STRING_LENGTH
+
       (str.start_with?("{") && str.end_with?("}")) ||
         (str.start_with?("[") && str.end_with?("]"))
     end

data/lib/json_logging/sanitizer.rb

@@ -1,4 +1,5 @@
 require_relative "structured_hash_sanitizer"
+require_relative "sanitizer_hash_limit"
 
 module JsonLogging
   module Sanitizer
@@ -18,7 +19,7 @@ module JsonLogging
     MAX_BACKTRACE_LINES = 20
 
     # Common sensitive key patterns (case insensitive) - fallback when Rails ParameterFilter not available
-    SENSITIVE_KEY_PATTERNS = /\b(password|passwd|pwd|secret|token|api_key|apikey|access_token|auth_token|private_key|credential)\b/i
+    SENSITIVE_KEY_PATTERNS = /(passw|pwd|email|secret|token|_key|crypt|salt|certificate|otp|ssn|cvv|cvc|credential)/i
 
     @parameter_filter = nil
     @parameter_filter_config = nil
@@ -38,7 +39,7 @@ module JsonLogging
         return @parameter_filter
       end
 
-      @parameter_filter_config = filter_params
+      @parameter_filter_config = filter_params.dup.freeze
       @parameter_filter_requires_full_tree_walk = parameter_filter_requires_full_tree_walk?(filter_params)
       @parameter_filter = ActiveSupport::ParameterFilter.new(filter_params)
     rescue
@@ -76,12 +77,14 @@ module JsonLogging
     # Sanitize a string by removing/escaping control characters and truncating
     def sanitize_string(str)
       return str unless str.is_a?(String)
-      return str if str.length <= MAX_STRING_LENGTH && !str.match?(CONTROL_CHARS)
 
-      # Remove or replace control characters
+      home_prefix = home_directory_prefix
+      has_home_directory = home_prefix && str.include?(home_prefix)
+      return str if str.length <= MAX_STRING_LENGTH && !str.match?(CONTROL_CHARS) && !has_home_directory
+
       sanitized = str.gsub(CONTROL_CHARS, "")
+      sanitized = redact_home_directory(sanitized, home_prefix) if has_home_directory
 
-      # Truncate if too long
       if sanitized.length > MAX_STRING_LENGTH
         sanitized = sanitized[0, MAX_STRING_LENGTH] + "...[truncated]"
       end
@@ -91,12 +94,8 @@ module JsonLogging
       "<sanitization_error>"
     end
 
-    # Sanitize a hash, removing sensitive keys and limiting size/depth
-    # Uses Rails ParameterFilter when available, falls back to pattern matching
     def sanitize_hash(hash, depth: 0)
       return hash unless hash.is_a?(Hash)
-
-      # Prevent excessive nesting
       return {"error" => "max_depth_exceeded"} if depth > MAX_DEPTH
 
       limited_hash = limited_hash_for_sanitization(hash)
@@ -109,13 +108,7 @@ module JsonLogging
     end
 
     def limited_hash_for_sanitization(hash)
-      if hash.size > MAX_CONTEXT_SIZE
-        truncated = hash.first(MAX_CONTEXT_SIZE).to_h
-        truncated["_truncated"] = true
-        truncated
-      else
-        hash
-      end
+      SanitizerHashLimit.apply(hash, filter_config: rails_parameter_filter && @parameter_filter_config)
     end
 
     def fast_path_sanitized_hash(hash, depth: 0)
@@ -126,38 +119,26 @@ module JsonLogging
     end
 
     def sanitize_hash_with_filtering(limited_hash, depth: 0)
-      # Use Rails ParameterFilter if available (handles encrypted attributes automatically)
       filter = rails_parameter_filter
       if filter
-        # ParameterFilter will filter based on Rails.config.filter_parameters
-        # This includes encrypted attributes automatically
-        # Create a deep copy since filter modifies in place (Rails 6+)
+        # ParameterFilter mutates in place; copy first
         filtered = limited_hash.respond_to?(:deep_dup) ? limited_hash.deep_dup : limited_hash.dup
         filtered = filter.filter(filtered)
-
-        # Then sanitize values (strings, control chars, etc.) preserving filtered structure
         filtered.each_with_object({}) do |(key, value), result|
           result[key.to_s] = sanitize_value(value, depth: depth + 1)
         end
-
       else
-        # Fallback: use pattern matching for sensitive keys
         limited_hash.each_with_object({}) do |(key, value), result|
           key_string = key.to_s
-
-          # Skip sensitive keys
           if SENSITIVE_KEY_PATTERNS.match?(key_string)
             result[sensitive_filtered_key_name(key_string)] = "[FILTERED]"
             next
           end
-
           result[key_string] = sanitize_value(value, depth: depth + 1)
         end
       end
     end
 
-    # Sanitize a value (handles strings, hashes, arrays, etc.)
-    # Preserves numeric, boolean, and nil types
     def sanitize_value(value, depth: 0)
       case value
       when String
@@ -165,24 +146,20 @@ module JsonLogging
       when Hash
         sanitize_hash(value, depth: depth)
       when Array
-        # Limit array size
         sanitized = value.first(MAX_CONTEXT_SIZE).map { |v| sanitize_value(v, depth: depth + 1) }
         sanitized << "[truncated]" if value.size > MAX_CONTEXT_SIZE
         sanitized
       when Exception
         sanitize_exception(value)
       when Numeric, TrueClass, FalseClass, NilClass
-        # Preserve numeric, boolean, and nil types
         value
       else
-        # For other types, convert to string and sanitize
         sanitize_string(value.to_s)
       end
     rescue
       "<unprintable>"
     end
 
-    # Sanitize exception, including backtrace
     def sanitize_exception(ex)
       {
         "error" => {
@@ -195,11 +172,9 @@ module JsonLogging
       {"error" => {"class" => "Exception", "message" => "<sanitization_failed>"}}
     end
 
-    # Sanitize backtrace - truncate and remove sensitive paths
     def sanitize_backtrace(backtrace)
       return [] unless backtrace.is_a?(Array)
 
-      # Take first MAX_BACKTRACE_LINES, sanitize each
       backtrace.first(MAX_BACKTRACE_LINES).map do |line|
         sanitize_string(line.to_s)
       end
@@ -207,7 +182,6 @@ module JsonLogging
       []
     end
 
-    # Check if a key looks sensitive
     def sensitive_key?(key)
       SENSITIVE_KEY_PATTERNS.match?(key.to_s)
     end
@@ -255,5 +229,22 @@ module JsonLogging
     def sensitive_filtered_key_name(key_string)
       key_string.gsub(/(?<!^)(?=[A-Z])/, "_").downcase + "_filtered"
     end
+
+    def home_directory_prefix
+      prefix = ENV["HOME"]
+      prefix = Dir.home if prefix.blank?
+      prefix = prefix.to_s.chomp("/").chomp("\\")
+      return if prefix.empty?
+
+      prefix
+    rescue ArgumentError, RuntimeError
+      nil
+    end
+
+    def redact_home_directory(str, prefix)
+      return str unless prefix
+
+      str.gsub(/#{Regexp.escape(prefix)}(?=\/|\\|\z)/, "~")
+    end
   end
 end

data/lib/json_logging/sanitizer_hash_limit.rb

@@ -0,0 +1,42 @@
+module JsonLogging
+  module SanitizerHashLimit
+    FILTERED = "[FILTERED]"
+
+    module_function
+
+    def apply(hash, filter_config:)
+      return hash if hash.size <= Sanitizer::MAX_CONTEXT_SIZE
+
+      truncated = {}
+      kept = 0
+      extra_filtered = 0
+      hash.each do |key, value|
+        if kept < Sanitizer::MAX_CONTEXT_SIZE
+          truncated[key] = value
+          kept += 1
+        elsif extra_filtered < Sanitizer::MAX_CONTEXT_SIZE && key_requires_filtering?(key, filter_config)
+          truncated[key] = FILTERED
+          extra_filtered += 1
+        end
+      end
+      truncated["_truncated"] = true
+      truncated
+    end
+
+    def key_requires_filtering?(key, filter_config)
+      return true if Sanitizer.sensitive_key?(key)
+
+      Array(filter_config).any? do |filter|
+        next false if filter.is_a?(Proc)
+
+        key_string = key.to_s
+        if filter.is_a?(Regexp)
+          filter.match?(key_string)
+        else
+          token = filter.to_s
+          !token.empty? && !token.include?(".") && key_string.match?(/#{Regexp.escape(token)}/i)
+        end
+      end
+    end
+  end
+end

data/lib/json_logging/structured_hash_json_encoder.rb

@@ -6,35 +6,6 @@ module JsonLogging
 
     module_function
 
-    def eligible?(hash)
-      return false if Sanitizer.primitive_log_hash?(hash)
-      return false unless Sanitizer::StructuredHash.structured_log_hash?(hash)
-      return false unless large_structured_hash?(hash)
-
-      filter = Sanitizer.rails_parameter_filter
-      return true unless filter
-
-      !Sanitizer.rails_parameter_filter_requires_full_tree_walk?
-    end
-
-    def large_structured_hash?(hash, leaf_threshold: LEAF_THRESHOLD)
-      leaf_count = 0
-      walker = lambda do |value|
-        case value
-        when Hash
-          value.each_value { |entry| walker.call(entry) }
-        when Array
-          value.each { |entry| walker.call(entry) }
-        else
-          leaf_count += 1
-          throw(:enough, true) if leaf_count > leaf_threshold
-        end
-      end
-
-      catch(:enough) { walker.call(hash) }
-      leaf_count > leaf_threshold
-    end
-
     def try_encode_line(hash, severity:, timestamp:, field_overrides: {})
       tree = prepared_tree(hash, field_overrides: field_overrides)
       return nil unless tree
@@ -88,13 +59,7 @@ module JsonLogging
       return jsonable.tree unless filter
       return jsonable.tree if Sanitizer.rails_parameter_filter_requires_full_tree_walk?
 
-      tree = if jsonable.owned
-        jsonable.tree
-      else
-        Sanitizer::StructuredHash.stringify_keys_copy(jsonable.tree)
-      end
-
-      filter.filter(tree)
+      filter.filter(Sanitizer::StructuredHash.stringify(jsonable.tree))
     end
 
     def append_json_line(tree, severity:, timestamp:, field_overrides:)

data/lib/json_logging/structured_hash_sanitizer.rb

@@ -1,7 +1,7 @@
 module JsonLogging
   module Sanitizer
     module StructuredHash
-      JsonableResult = Struct.new(:tree, :owned, :leaf_count, keyword_init: true)
+      JsonableResult = Struct.new(:tree, :owned, :leaf_count)
 
       module_function
 
@@ -44,11 +44,7 @@ module JsonLogging
 
       def sanitize_without_filter(hash, depth: 0)
         jsonable = jsonable_tree(hash, depth: depth)
-        if jsonable.owned
-          stringify(jsonable.tree)
-        else
-          jsonable.tree.dup
-        end
+        stringify(jsonable.tree)
       end
 
       def jsonable_tree(hash, depth: 0, seen: nil, parent_key: nil, omit_keys: nil, count_leaves: false, leaf_counter: nil)
@@ -99,14 +95,14 @@ module JsonLogging
         when String
           leaf_counter[0] += 1 if leaf_counter
           sanitized = Sanitizer.sanitize_string(value)
-          JsonableResult.new(tree: sanitized, owned: sanitized != value)
+          JsonableResult.new(tree: sanitized, owned: sanitized != value, leaf_count: nil)
         when Hash
           jsonable_tree(value, depth: depth + 1, seen: seen, parent_key: parent_key, leaf_counter: leaf_counter)
         when Array
           jsonable_array(value, depth: depth, seen: seen, parent_key: parent_key, leaf_counter: leaf_counter)
         else
           leaf_counter[0] += 1 if leaf_counter
-          JsonableResult.new(tree: value, owned: false)
+          JsonableResult.new(tree: value, owned: false, leaf_count: nil)
         end
       end
 
@@ -123,7 +119,7 @@ module JsonLogging
           result[index] = child.tree
         end
 
-        JsonableResult.new(tree: owned ? result : array, owned: owned)
+        JsonableResult.new(tree: owned ? result : array, owned: owned, leaf_count: nil)
       end
 
       def process_jsonable_entry(key, value, depth:, seen:, parent_key:, omit_keys:, leaf_counter:)
@@ -133,7 +129,8 @@ module JsonLogging
           return
         end
 
-        if Sanitizer::SENSITIVE_KEY_PATTERNS.match?(key_string)
+        # ParameterFilter keeps original key names; fallback rename would hide them from it.
+        if Sanitizer.rails_parameter_filter.nil? && Sanitizer::SENSITIVE_KEY_PATTERNS.match?(key_string)
           return [Sanitizer.sensitive_filtered_key_name(key_string), "[FILTERED]", true]
         end
 
@@ -195,12 +192,6 @@ module JsonLogging
           value
         end
       end
-
-      def stringify_keys_copy(hash)
-        return hash if hash.keys.all? { |key| key.is_a?(String) }
-
-        hash.transform_keys(&:to_s)
-      end
     end
   end
 end

data/lib/json_logging/version.rb

@@ -1,3 +1,3 @@
 module JsonLogging
-  VERSION = "1.2.2"
+  VERSION = "1.3.1"
 end

data/lib/json_logging.rb

@@ -12,6 +12,7 @@ require_relative "json_logging/formatter"
 require_relative "json_logging/formatter_with_tags"
 require_relative "json_logging/json_logger_extension"
 require_relative "json_logging/json_logger"
+require_relative "json_logging/event_subscriber"
 
 module JsonLogging
   THREAD_CONTEXT_KEY = :__json_logging_context

data/sig/json_logging.rbs

@@ -1,3 +1,8 @@
 module JsonLogging
   VERSION: String
+
+  class EventSubscriber
+    def initialize: (?logger: untyped, ?io: untyped) -> void
+    def emit: (untyped event) -> void
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activesupport-json_logging
 version: !ruby/object:Gem::Version
-  version: 1.2.2
+  version: 1.3.1
 platform: ruby
 authors:
 - Andrei Makarov
@@ -15,7 +15,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '6.0'
+        version: '7.0'
     - - "<"
       - !ruby/object:Gem::Version
         version: '9.0'
@@ -25,7 +25,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '6.0'
+        version: '7.0'
     - - "<"
       - !ruby/object:Gem::Version
         version: '9.0'
@@ -35,7 +35,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '6.0'
+        version: '7.0'
     - - "<"
       - !ruby/object:Gem::Version
         version: '9.0'
@@ -45,10 +45,24 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '6.0'
+        version: '7.0'
     - - "<"
       - !ruby/object:Gem::Version
         version: '9.0'
+- !ruby/object:Gem::Dependency
+  name: json
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.21.2
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.21.2
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -77,20 +91,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 2.2.0
-- !ruby/object:Gem::Dependency
-  name: webmock
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -316,7 +316,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0.2'
 description: Lightweight JSON logger and formatter integrating with Rails/ActiveSupport.
-  No extra deps beyond Rails/Activesupport. Compatible with Rails 6–8.
+  No extra deps beyond Rails/Activesupport. Compatible with Rails 7–8.
 email:
 - contact@kiskolabs.com
 executables: []
@@ -329,6 +329,7 @@ files:
 - lib/activesupport/json_logging.rb
 - lib/activesupport/json_logging/railtie.rb
 - lib/json_logging.rb
+- lib/json_logging/event_subscriber.rb
 - lib/json_logging/formatter.rb
 - lib/json_logging/formatter_with_tags.rb
 - lib/json_logging/helpers.rb
@@ -338,6 +339,7 @@ files:
 - lib/json_logging/message_parser.rb
 - lib/json_logging/payload_builder.rb
 - lib/json_logging/sanitizer.rb
+- lib/json_logging/sanitizer_hash_limit.rb
 - lib/json_logging/severity.rb
 - lib/json_logging/structured_hash_json_encoder.rb
 - lib/json_logging/structured_hash_sanitizer.rb
@@ -357,14 +359,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '2.7'
+      version: '3.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.6
 specification_version: 4
 summary: Structured JSON logging for Rails/ActiveSupport with safe, single-line entries.
 test_files: []