auditea 0.1.0.beta.2 → 0.1.0.beta.4

data/lib/auditea/instrumentation/exception.rb

@@ -2,28 +2,56 @@
 
 module Auditea
   module Instrumentation
+    # Structured exception → `exception.raised` evidence.
+    #
+    # Capture paths (fail-open at the Auditea boundary):
+    # - explicit Auditea.capture_exception
+    # - Rails ErrorReporter subscriber (preferred when available)
+    # - process_action.action_controller fallback when ErrorReporter is absent
     module Exception
+      MAX_FRAMES = 40
+      MESSAGE_MAX = 500
+
       module_function
 
+      def capture(error, handled: false, mechanism: nil, severity: "error",
+                  context: nil, metadata: nil, evidence: nil, claim: true)
+        return { ok: false, skipped: true, reason: "disabled" } unless Auditea.configuration.capture_exceptions
+        return { ok: false, skipped: true, reason: "not_an_exception" } unless error.is_a?(::Exception)
+        return { ok: false, skipped: true, reason: "duplicate" } if claim && !Deduper.claim!(error)
+
+        merged_evidence = merge_evidence(error, handled: handled, mechanism: mechanism, evidence: evidence)
+        meta = { "sdk_event_kind" => "auto_observed" }
+        meta.merge!(stringify_keys(metadata)) if metadata
+
+        Auditea.capture(
+          "exception.raised",
+          category: "error",
+          severity: severity || "error",
+          evidence: merged_evidence,
+          context: context,
+          metadata: meta
+        )
+      rescue StandardError => error
+        Auditea.handle_error(error)
+      end
+
       def capture_from_notification(event)
+        # Prefer Rails ErrorReporter when installed so handled/source semantics stay
+        # consistent and ActionDispatch does not double-emit with process_action.
+        return if ErrorSubscriber.installed?
+
         payload = event.payload || {}
         exception = payload[:exception_object]
         exception ||= build_from_array(payload[:exception])
         return unless exception
 
-        frames = safe_frames(exception)
         path = payload[:path].to_s.split("?", 2).first
-
-        Auditea.capture(
-          "exception.raised",
-          category: "error",
-          severity: "error",
+        capture(
+          exception,
+          handled: false,
+          mechanism: "action_controller.process_action",
           evidence: {
-            "exception" => {
-              "type" => exception.class.name,
-              "message" => Sanitizer.truncate_string(exception.message.to_s, 500),
-              "frames" => frames
-            }.compact,
             "http" => {
               "method" => payload[:method],
               "path" => path,
@@ -33,15 +61,46 @@ module Auditea
               "controller" => payload[:controller],
               "action" => payload[:action]
             }.compact
-          },
-          metadata: {
-            "sdk_event_kind" => "auto_observed"
           }
         )
       rescue StandardError => error
         Auditea.handle_error(error)
       end
 
+      def merge_evidence(error, handled:, mechanism:, evidence:)
+        base = stringify_keys(evidence || {})
+        exception = base["exception"].is_a?(Hash) ? base["exception"].dup : {}
+        exception["type"] ||= error.class.name
+        exception["message"] ||= Sanitizer.truncate_string(error.message.to_s, MESSAGE_MAX)
+        exception["frames"] ||= safe_frames(error)
+        exception["handled"] = handled ? true : false unless exception.key?("handled")
+        exception["mechanism"] = mechanism.to_s if mechanism && !exception.key?("mechanism")
+
+        http = base["http"].is_a?(Hash) ? base["http"].dup : {}
+        enrich_http_from_context!(http)
+
+        rails = base["rails"].is_a?(Hash) ? base["rails"].dup : {}
+
+        {
+          "exception" => exception.compact,
+          "http" => compact_hash(http),
+          "rails" => compact_hash(rails)
+        }.compact.merge(base.except("exception", "http", "rails"))
+      end
+
+      def compact_hash(hash)
+        cleaned = hash.compact
+        cleaned.empty? ? nil : cleaned
+      end
+
+      def enrich_http_from_context!(http)
+        ctx = CurrentContext.to_h
+        http_ctx = ctx["http"].is_a?(Hash) ? ctx["http"] : {}
+        http["method"] ||= http_ctx["method"]
+        path = http_ctx["path"].to_s.split("?", 2).first
+        http["path"] ||= path unless path.nil? || path.empty?
+      end
+
       def build_from_array(pair)
         return nil unless pair.is_a?(Array) && pair.size >= 2
 
@@ -56,9 +115,12 @@ module Auditea
       def safe_frames(exception)
         return [] unless exception.respond_to?(:backtrace) && exception.backtrace
 
-        exception.backtrace.first(20).map do |line|
+        exception.backtrace.first(MAX_FRAMES).map do |line|
           file, linenum, method_name = parse_frame(line)
-          { "file" => file, "line" => linenum, "method" => method_name }.compact
+          frame = { "file" => file, "line" => linenum, "method" => method_name }.compact
+          in_app = classify_in_app(file)
+          frame["in_app"] = in_app unless in_app.nil?
+          frame
         end
       end
 
@@ -70,6 +132,62 @@ module Auditea
           [line, nil, nil]
         end
       end
+
+      # Deterministic app-vs-framework marking. Returns nil when unknown (omit key).
+      def classify_in_app(file)
+        path = file.to_s
+        return nil if path.empty?
+
+        return true if path.start_with?("app/") || path.include?("/app/")
+        return false if path.include?("/gems/") || path.include?("/ruby/") ||
+                        path.include?("/vendor/bundle/") || path.include?("/lib/ruby/")
+
+        if defined?(::Rails) && ::Rails.respond_to?(:root) && ::Rails.root
+          root = ::Rails.root.to_s
+          if path.start_with?(root)
+            return false if path.start_with?("#{root}/vendor")
+
+            return true
+          end
+        end
+
+        nil
+      end
+
+      def stringify_keys(value)
+        EventBuilder.stringify_keys(value)
+      end
+
+      # Identity-safe claim set: WeakMap keys are the exception objects themselves.
+      # GC removes entries when exceptions are collected, so recycled object_ids cannot
+      # falsely suppress a distinct raise. Still cleared at request/job boundaries.
+      module Deduper
+        class << self
+          def claim!(error)
+            map = store
+            return false if map.key?(error)
+
+            map[error] = true
+            true
+          end
+
+          def claimed?(error)
+            store.key?(error)
+          rescue StandardError
+            false
+          end
+
+          def clear!
+            Thread.current[:auditea_exception_claims] = ObjectSpace::WeakMap.new
+          end
+
+          private
+
+          def store
+            Thread.current[:auditea_exception_claims] ||= ObjectSpace::WeakMap.new
+          end
+        end
+      end
     end
   end
 end

data/lib/auditea/instrumentation/structural_request.rb

@@ -0,0 +1,136 @@
+# frozen_string_literal: true
+
+module Auditea
+  module Instrumentation
+    # Derive scalar request/controller fields from Rails ErrorReporter context.
+    # Never retains controller/request objects; never reads params/body/cookies/session.
+    module StructuralRequest
+      module_function
+
+      def from_reporter_context(context)
+        hash = context.is_a?(Hash) ? context : {}
+        controller = hash[:controller] || hash["controller"]
+
+        rails = {}
+        http = {}
+        event_context = {}
+
+        if controller && !controller.is_a?(String) && controller.respond_to?(:class)
+          rails["controller"] = controller.class.name
+          if controller.respond_to?(:action_name)
+            action = controller.action_name
+            rails["action"] = action.to_s if present?(action)
+          end
+
+          request = safe_request(controller)
+          if request
+            method = safe_request_method(request)
+            http["method"] = method if present?(method)
+
+            path = safe_path(request)
+            http["path"] = path if present?(path)
+
+            request_id = safe_request_id(request)
+            event_context["request_id"] = request_id if present?(request_id)
+          end
+
+          status = safe_status(controller)
+          http["status"] = status unless status.nil?
+        end
+
+        {
+          "evidence" => {
+            "rails" => compact_hash(rails),
+            "http" => compact_hash(http)
+          }.compact,
+          "context" => compact_hash(event_context)
+        }
+      rescue StandardError
+        { "evidence" => {}, "context" => {} }
+      end
+
+      def safe_request(controller)
+        return nil unless controller.respond_to?(:request)
+
+        request = controller.request
+        return nil if request.nil?
+        return nil unless request.respond_to?(:request_method) || request.respond_to?(:path)
+
+        request
+      rescue StandardError
+        nil
+      end
+
+      def safe_request_method(request)
+        return request.request_method.to_s if request.respond_to?(:request_method)
+
+        nil
+      rescue StandardError
+        nil
+      end
+
+      def safe_path(request)
+        raw =
+          if request.respond_to?(:path)
+            request.path
+          elsif request.respond_to?(:fullpath)
+            request.fullpath
+          end
+        return nil unless present?(raw)
+
+        raw.to_s.split("?", 2).first
+      rescue StandardError
+        nil
+      end
+
+      def safe_request_id(request)
+        if request.respond_to?(:request_id)
+          value = request.request_id
+          return value.to_s if present?(value)
+        end
+
+        if request.respond_to?(:env)
+          env = request.env
+          if env.is_a?(Hash)
+            value = env["action_dispatch.request_id"] || env["HTTP_X_REQUEST_ID"]
+            return value.to_s if present?(value)
+          end
+        end
+
+        nil
+      rescue StandardError
+        nil
+      end
+
+      def safe_status(controller)
+        return nil unless controller.respond_to?(:response)
+
+        response = controller.response
+        return nil unless response
+        return nil unless response.respond_to?(:status)
+
+        status = response.status
+        return nil unless status.is_a?(Integer)
+        return nil unless status.between?(100, 599)
+
+        # Unhandled failures often still have the default 200 before rendering;
+        # only keep status when the response looks finalized or already erroneous.
+        committed = response.respond_to?(:committed?) && response.committed?
+        return status if committed || status >= 400
+
+        nil
+      rescue StandardError
+        nil
+      end
+
+      def compact_hash(hash)
+        cleaned = hash.compact
+        cleaned.empty? ? nil : cleaned
+      end
+
+      def present?(value)
+        !(value.nil? || (value.respond_to?(:empty?) && value.empty?))
+      end
+    end
+  end
+end

data/lib/auditea/inventory/collector.rb

@@ -3,11 +3,14 @@
 require "digest"
 require "json"
 require_relative "string_bound"
+require_relative "components"
+require_relative "database_server"
 
 module Auditea
   module Inventory
     # Collects a normalized runtime + dependency inventory for AudiTea.
     # Never includes filesystem paths, remote URLs, tokens, or env vars.
+    # rubocop:disable-next Metrics/ModuleLength -- cohesive collector + component promotion
     module Collector
       SCHEMA_VERSION = 1
       MAX_PACKAGES = 400
@@ -15,6 +18,16 @@ module Auditea
       MAX_REQUIREMENT_BYTES = 256
       # Leave headroom under Transport::Limits::SINGLE_MAX_BYTES after envelope/provenance.
       MAX_INVENTORY_BYTES = 110_000
+      PROMOTED_SERVER_GEMS = {
+        "puma" => { "product" => "Puma", "scope" => "application_server" },
+        "unicorn" => { "product" => "Unicorn", "scope" => "application_server" },
+        "passenger" => { "product" => "Phusion Passenger", "scope" => "application_server" }
+      }.freeze
+      PROMOTED_ADAPTER_GEMS = {
+        "pg" => { "product" => "pg (PostgreSQL adapter)", "scope" => "linked_library" },
+        "trilogy" => { "product" => "Trilogy", "scope" => "linked_library" },
+        "mysql2" => { "product" => "mysql2", "scope" => "linked_library" }
+      }.freeze
 
       module_function
 
@@ -41,11 +54,124 @@ module Auditea
         release = Auditea.configuration.release
         inventory["application"] = { "release" => bound_string(release) } if present?(release)
 
+        components = Components.compact_list(
+          runtime_components(inventory) +
+          promoted_gem_components(packages) +
+          [DatabaseServer.collect]
+        )
+        inventory["components"] = components unless components.empty?
+
         inventory = enforce_size_bound(inventory)
         inventory["digest"] = DigestComputer.compute(inventory)
         inventory
       end
 
+      def runtime_components(inventory)
+        list = []
+        runtime = inventory["runtime"] || {}
+        list << Components.build(
+          product: "Ruby",
+          version: runtime["version"],
+          scope: "application_runtime",
+          observation_method: "ruby_constants"
+        )
+
+        framework = inventory["framework"]
+        if framework
+          list << Components.build(
+            product: "Rails",
+            version: framework["version"],
+            scope: "application_runtime",
+            observation_method: "rails_version"
+          )
+        end
+
+        pm = inventory["package_manager"] || {}
+        if present?(pm["rubygems_version"])
+          list << Components.build(
+            product: "RubyGems",
+            version: pm["rubygems_version"],
+            scope: "application_runtime",
+            observation_method: "rubygems_version"
+          )
+        end
+        if present?(pm["bundler_version"])
+          list << Components.build(
+            product: "Bundler",
+            version: pm["bundler_version"],
+            scope: "application_runtime",
+            observation_method: "bundler_version"
+          )
+        end
+
+        openssl = inventory["openssl"] || {}
+        openssl_version = first_present(
+          openssl["library_version"],
+          openssl["build_version"],
+          openssl["extension_version"]
+        )
+        if present?(openssl_version)
+          list << Components.build(
+            product: "OpenSSL",
+            version: openssl_version,
+            scope: "linked_library",
+            observation_method: "ruby_openssl_constants",
+            evidence: {
+              "extension_version" => openssl["extension_version"],
+              "build_version" => openssl["build_version"],
+              "library_version" => openssl["library_version"]
+            }.compact
+          )
+        end
+
+        list
+      end
+
+      def promoted_gem_components(packages)
+        by_name = Array(packages).to_h { |pkg| [pkg["name"].to_s, pkg] }
+        list = []
+
+        PROMOTED_SERVER_GEMS.each do |gem_name, meta|
+          pkg = by_name[gem_name]
+          next unless pkg
+
+          list << Components.build(
+            product: meta["product"],
+            version: pkg["version"],
+            scope: meta["scope"],
+            observation_method: "bundler_package",
+            package: {
+              "ecosystem" => pkg["ecosystem"],
+              "name" => pkg["name"],
+              "version" => pkg["version"]
+            }
+          )
+        end
+
+        PROMOTED_ADAPTER_GEMS.each do |gem_name, meta|
+          pkg = by_name[gem_name]
+          next unless pkg
+
+          list << Components.build(
+            product: meta["product"],
+            version: pkg["version"],
+            scope: meta["scope"],
+            observation_method: "bundler_package",
+            package: {
+              "ecosystem" => pkg["ecosystem"],
+              "name" => pkg["name"],
+              "version" => pkg["version"]
+            }
+          )
+        end
+
+        list
+      end
+
+      def first_present(*values)
+        values.find { |value| present?(value) }
+      end
+
       def runtime_metadata
         {
           "language" => "ruby",

data/lib/auditea/inventory/components.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+module Auditea
+  module Inventory
+    # Normalized platform/software component observations (inventory only — not vulnerability).
+    module Components
+      SCOPES = %w[
+        application_runtime
+        application_server
+        database_server
+        linked_library
+        host_os
+        host_component
+        reverse_proxy
+        externally_observed
+      ].freeze
+
+      MAX_COMPONENTS = 40
+      MAX_PRODUCT = 128
+      MAX_VERSION = 128
+      MAX_METHOD = 64
+      MAX_EVIDENCE_VALUE = 64
+      # Strict allowlist — never transmit raw command output, paths, or host details.
+      EVIDENCE_KEYS = %w[command adapter].freeze
+
+      module_function
+
+      def build(product:, version:, scope:, observation_method:, package: nil, evidence: nil)
+        return nil unless SCOPES.include?(scope.to_s)
+        return nil if blank?(product) || blank?(version)
+
+        entry = {
+          "product" => truncate(product, MAX_PRODUCT),
+          "version" => truncate(version, MAX_VERSION),
+          "scope" => scope.to_s,
+          "observation_method" => truncate(observation_method, MAX_METHOD)
+        }
+        entry["package"] = package if package.is_a?(Hash) && !package.empty?
+        sanitized = sanitize_evidence(evidence)
+        entry["evidence"] = sanitized if sanitized
+        entry
+      end
+
+      def sanitize_evidence(value)
+        return nil unless value.is_a?(Hash)
+
+        out = {}
+        value.each do |key, child|
+          key_s = key.to_s
+          next unless EVIDENCE_KEYS.include?(key_s)
+          next if child.nil?
+
+          case child
+          when String
+            next if child.empty?
+
+            out[key_s] = truncate(child, MAX_EVIDENCE_VALUE)
+          when Numeric, TrueClass, FalseClass
+            out[key_s] = child
+          else
+            next
+          end
+        end
+        out.empty? ? nil : out
+      end
+
+      def compact_list(list)
+        Array(list).compact.first(MAX_COMPONENTS)
+      end
+
+      def truncate(value, max)
+        StringBound.truncate(value.to_s, max)
+      end
+
+      def blank?(value)
+        value.nil? || value.to_s.strip.empty?
+      end
+    end
+  end
+end

data/lib/auditea/inventory/database_server.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module Auditea
+  module Inventory
+    # Fail-open database server version collectors.
+    # Never transmits credentials, connection strings, or DB hostnames.
+    module DatabaseServer
+      module_function
+
+      def collect
+        return nil unless defined?(::ActiveRecord::Base)
+        return nil unless ::ActiveRecord::Base.respond_to?(:connection_pool)
+
+        pool = ::ActiveRecord::Base.connection_pool
+        return nil unless pool.respond_to?(:with_connection)
+
+        pool.with_connection do |connection|
+          return nil unless connection
+
+          adapter = connection.adapter_name.to_s.downcase
+          collector = collector_for(adapter)
+          return nil unless collector
+
+          collector.call(connection)
+        end
+      rescue StandardError
+        nil
+      end
+
+      def collector_for(adapter)
+        case adapter
+        when /postgre/
+          method(:postgresql)
+        end
+      end
+
+      def postgresql(connection)
+        version = nil
+        version = connection.select_value("SHOW server_version") if connection.respond_to?(:select_value)
+        version = version.to_s.strip
+        return nil if version.empty?
+
+        Components.build(
+          product: "PostgreSQL",
+          version: version,
+          scope: "database_server",
+          observation_method: "active_record.show_server_version",
+          evidence: {
+            "adapter" => "postgresql"
+          }
+        )
+      rescue StandardError
+        nil
+      end
+    end
+  end
+end

data/lib/auditea/middleware/context.rb

@@ -12,6 +12,7 @@ module Auditea
 
       def call(env)
         CurrentContext.clear!
+        Instrumentation::Exception::Deduper.clear!
         request = ::Rack::Request.new(env)
         CurrentContext.set(
           "request_id" => env["action_dispatch.request_id"] || env["HTTP_X_REQUEST_ID"],
@@ -24,6 +25,7 @@ module Auditea
       ensure
         opportunistically_refresh_inventory
         CurrentContext.clear!
+        Instrumentation::Exception::Deduper.clear!
       end
 
       private

data/lib/auditea/railtie.rb

@@ -18,14 +18,16 @@ module Auditea
     initializer "auditea.instrumentation" do
       Auditea::Instrumentation::Request.install!
       Auditea::Instrumentation::ActiveJob.install!
+      Auditea::Instrumentation::ErrorSubscriber.install!
     end
 
     config.after_initialize do
       at_exit { Auditea.shutdown }
       begin
-        # Startup capture is explicit (force) so long-lived refresh can stay gated.
-        Auditea.capture_runtime_inventory! if Auditea.configuration.capture_runtime_inventory?
-        Auditea.capture_host_inventory! if Auditea.configuration.capture_host_inventory?
+        # Schedule via existing single-flight background refresh — never block boot on
+        # detector processes or database inventory work.
+        Auditea::Inventory.schedule_refresh! if Auditea.configuration.capture_runtime_inventory?
+        Auditea::HostInventory.schedule_refresh! if Auditea.configuration.capture_host_inventory?
       rescue StandardError => error
         Auditea.handle_error(error)
       end

data/lib/auditea/sanitizer.rb

@@ -50,8 +50,18 @@ module Auditea
       path.to_s == "evidence.inventory.packages"
     end
 
+    def inventory_components_path?(path)
+      path.to_s == "evidence.inventory.components"
+    end
+
     def array_limit_for(path)
-      inventory_packages_path?(path) ? INVENTORY_PACKAGES_ARRAY_MAX : DEFAULT_ARRAY_MAX
+      if inventory_packages_path?(path)
+        INVENTORY_PACKAGES_ARRAY_MAX
+      elsif inventory_components_path?(path)
+        40
+      else
+        DEFAULT_ARRAY_MAX
+      end
     end
 
     def deep_sanitize(value, depth:, path:, redacted:)

data/lib/auditea/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Auditea
-  VERSION = "0.1.0.beta.2"
+  VERSION = "0.1.0.beta.4"
 end