berkeley_library-logging 0.2.3 → 0.2.6

data/CHANGES.md

@@ -1,3 +1,22 @@
+# 0.2.6 (2022-03-14)
+
+- Add support for Rails 7.
+
+# 0.2.5 (2021-11-04)
+
+- Rails event logs now include a subset of session attributes (`session_id` and `_csrf_token`).
+  Set `Rails.config.lograge.verbose_session_logging` to log the full session hash.
+
+# 0.2.4 (2021-11-02)
+
+- Rails event logs now include the following, in addition to the
+  headers already logged:
+
+  - `request.origin`
+  - `request.base_url`
+  - `request.x_csrf_token`
+  - `params[:authenticity_token]`
+
 # 0.2.3 (2021-09-02)
 
 - JSON formatter now strips all ANSI 7-bit C1 escapes from strings

data/Rakefile

@@ -19,9 +19,11 @@ end
 # ------------------------------------------------------------
 # Custom tasks
 
-desc 'Remove artifacts directory'
+desc 'Remove artifacts directory, except for .keep file'
 task :clean do
   FileUtils.rm_rf('artifacts')
+  FileUtils.mkdir('artifacts')
+  FileUtils.touch(File.join('artifacts', '.keep'))
 end
 
 desc 'Check test coverage, check code style, check gems for vulnerabilities'

data/berkeley_library-logging.gemspec

@@ -20,12 +20,12 @@ Gem::Specification.new do |spec|
   spec.homepage = BerkeleyLibrary::Logging::ModuleInfo::HOMEPAGE
 
   spec.files = `git ls-files -z`.split("\x0")
-  spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
+  spec.test_files    = spec.files.grep(%r{^(test|spec|features|artifacts)/})
   spec.require_paths = ['lib']
 
   spec.required_ruby_version = ">= #{ruby_version}"
 
-  spec.add_dependency 'activesupport', '~> 6.0'
+  spec.add_dependency 'activesupport', '>= 6.0'
   spec.add_dependency 'amazing_print', '~> 1.1'
   spec.add_dependency 'colorize', '~> 0.8.1'
   spec.add_dependency 'lograge', '~> 0.11'
@@ -37,11 +37,14 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency 'dotenv', '~> 2.7'
   spec.add_development_dependency 'irb', '~> 1.2' # workaroundfor https://github.com/bundler/bundler/issues/6929
   spec.add_development_dependency 'listen', '>= 3.0.5', '< 3.2'
-  spec.add_development_dependency 'rails', '~> 6.0'
+  spec.add_development_dependency 'rails', '>= 6.0'
   spec.add_development_dependency 'rake', '~> 13.0'
   spec.add_development_dependency 'rspec-support', '~> 3.9'
-  spec.add_development_dependency 'rubocop', '~> 0.91.0'
+  spec.add_development_dependency 'rubocop', '~> 1.26.0'
+  spec.add_development_dependency 'rubocop-rspec', '~> 2.4.0'
   spec.add_development_dependency 'simplecov', '~> 0.21.1'
   spec.add_development_dependency 'simplecov-console', '~> 0.9.1'
   spec.add_development_dependency 'simplecov-rcov', '~> 0.2'
+
+  spec.metadata['rubygems_mfa_required'] = 'true'
 end

data/lib/berkeley_library/logging/configurator.rb

@@ -22,9 +22,13 @@ module BerkeleyLibrary
         def configure_lograge(config)
           return unless config.respond_to?(:lograge)
 
-          config.lograge.tap do |lograge|
+          lograge_config = config.lograge
+
+          custom_options = Events.extract_data_for_lograge(lograge_config)
+
+          lograge_config.tap do |lograge|
             lograge.enabled = true
-            lograge.custom_options = Events.extract_data_for_lograge
+            lograge.custom_options = custom_options
             lograge.formatter = Formatters.lograge_formatter
           end
         end

data/lib/berkeley_library/logging/env.rb

@@ -11,7 +11,7 @@ module BerkeleyLibrary
         return Rails.env if defined?(Rails)
 
         @env ||= begin
-          # Note: can't just self.env= b/c it returns the wrong value -- see
+          # NOTE: can't just self.env= b/c it returns the wrong value -- see
           # https://stackoverflow.com/q/65226532/27358
           env = (ENV['RAILS_ENV'] || ENV['RACK_ENV'] || FALLBACK_ENV)
           ensure_rails_env_like(env)

data/lib/berkeley_library/logging/events.rb

@@ -1,37 +1,93 @@
+require 'berkeley_library/logging/safe_serializer'
+
 module BerkeleyLibrary
   module Logging
     module Events
+      LOGGED_REQUEST_ATTRIBUTES = %i[origin base_url x_csrf_token].freeze
+      LOGGED_SESSION_ATTRIBUTES = %i[session_id _csrf_token].freeze
+      LOGGED_PARAMETERS = [:authenticity_token].freeze
+      LOGGED_HEADERS = {
+        # yes, RFC 2616 uses a variant spelling for 'referrer', it's a known issue
+        # https://tools.ietf.org/html/rfc2616#section-14.36
+        referer: 'HTTP_REFERER',
+        request_id: 'action_dispatch.request_id',
+        remote_ip: 'action_dispatch.remote_ip',
+        remote_addr: 'REMOTE_ADDR',
+        x_forwarded_for: 'HTTP_X_FORWARDED_FOR',
+        forwarded: 'HTTP_FORWARDED' # RFC 7239
+      }.freeze
+
       class << self
-        def extract_data_for_lograge
-          ->(event) { extract_event_data(event) }
+
+        def extract_data_for_lograge(lograge_config)
+          verbose_session_logging = lograge_config.verbose_session_logging
+
+          ->(event) { extract_event_data(event.payload, verbose_session_logging) }
         end
 
         private
 
-        def extract_event_data(event)
-          event_data = { time: Time.now }
-          extracted_headers = extract_headers(event)
-          event_data.merge(extracted_headers)
+        def extract_event_data(payload, verbose_session_logging)
+          [
+            extract_headers(payload),
+            extract_request_attributes(payload),
+            extract_param_values(payload),
+            extract_session(payload, verbose_session_logging)
+          ].inject({ time: Time.now }) do |data, values|
+            clean_values = SafeSerializer.serialize(values)
+            data.merge(clean_values)
+          end
         end
 
-        def extract_headers(event)
-          return {} unless (headers = event.payload[:headers])
-
-          extracted_headers = {
-            # yes, RFC 2616 uses a variant spelling for 'referrer', it's a known issue
-            # https://tools.ietf.org/html/rfc2616#section-14.36
-            referer: headers['HTTP_REFERER'],
-            request_id: headers['action_dispatch.request_id'],
-            remote_ip: headers['action_dispatch.remote_ip'],
-            remote_addr: headers['REMOTE_ADDR'],
-            x_forwarded_for: headers['HTTP_X_FORWARDED_FOR'],
-            forwarded: headers['HTTP_FORWARDED'] # RFC 7239
-          }
-
-          # Some of these 'headers' include recursive structures
-          # that cause SystemStackErrors in JSON serialization,
-          # so we convert them all to strings
-          extracted_headers.transform_values(&:to_s)
+        def extract_param_values(payload)
+          return {} unless (params = payload[:params])
+
+          LOGGED_PARAMETERS.each_with_object({}) do |param, values|
+            next unless (param_val = params[param])
+
+            values[param] = param_val
+          end
+        end
+
+        def extract_request_attributes(payload)
+          return {} unless (request = payload[:request])
+
+          LOGGED_REQUEST_ATTRIBUTES.each_with_object({}) do |attr, values|
+            next unless request.respond_to?(attr)
+            next if (attr_val = request.send(attr)).nil?
+
+            values[attr] = attr_val
+          end
+        end
+
+        def extract_headers(payload)
+          return {} unless (headers = payload[:headers])
+
+          LOGGED_HEADERS.each_with_object({}) do |(key, header), values|
+            next unless (header_val = headers[header])
+
+            values[key] = header_val
+          end
+        end
+
+        def extract_session(payload, verbose_session_logging)
+          return {} unless (request = payload[:request])
+          return {} unless (session = request.session)
+          return {} unless session.respond_to?(:to_hash)
+
+          session_hash = session_hash(session, verbose_session_logging)
+
+          { session: session_hash }
+        end
+
+        def session_hash(session, verbose)
+          raw_session_hash = session.to_hash
+          return raw_session_hash if verbose
+
+          LOGGED_SESSION_ATTRIBUTES.filter_map do |attr|
+            attr_str = attr.to_s
+            [attr, raw_session_hash[attr_str]] if raw_session_hash.key?(attr_str)
+          end.to_h
         end
       end
     end

data/lib/berkeley_library/logging/exception_serializer.rb

@@ -0,0 +1,15 @@
+module BerkeleyLibrary
+  module Logging
+    module ExceptionSerializer
+      def serialize_exc(ex, serialized = Set.new)
+        raw_result = { name: ex.class.name, message: ex.message, stack: ex.backtrace }
+        raw_result.tap do |result|
+          next unless (cause = ex.cause)
+          next if (serialized << ex).include?(cause) # prevent circular references
+
+          result[:cause] = serialize_exc(cause, serialized)
+        end
+      end
+    end
+  end
+end

data/lib/berkeley_library/logging/formatters.rb

@@ -1,4 +1,5 @@
 require 'ougai'
+require 'berkeley_library/logging/exception_serializer'
 
 module BerkeleyLibrary
   module Logging
@@ -41,21 +42,8 @@ module BerkeleyLibrary
       # ------------------------------------------------------------
       # Private helper classes
 
-      module ErrorCauseSerializer
-        def serialize_exc(ex, serialized = Set.new)
-          super(ex).tap do |result|
-            next unless (cause = ex.cause)
-            next if (serialized << ex).include?(cause) # prevent circular references
-
-            result[:cause] = serialize_exc(cause, serialized)
-          end
-        end
-      end
-
-      private_constant :ErrorCauseSerializer
-
       class Readable < Ougai::Formatters::Readable
-        include ErrorCauseSerializer
+        include ExceptionSerializer
 
         protected
 
@@ -71,9 +59,11 @@ module BerkeleyLibrary
           "  #{err_hash[:name]} (#{err_hash[:message]}):".tap do |msg|
             next unless (stack = err_hash[:stack])
 
-            msg << "\n"
-            msg << (' ' * @trace_indent)
-            msg << stack
+            trace_indent = (' ' * @trace_indent)
+            trace_separator = "\n#{trace_indent}"
+
+            msg << trace_separator
+            msg << stack.join(trace_separator)
 
             next unless (cause_hash = err_hash[:cause])
 
@@ -87,7 +77,7 @@ module BerkeleyLibrary
 
       class Bunyan < Ougai::Formatters::Bunyan
         include Ougai::Logging::Severity
-        include ErrorCauseSerializer
+        include ExceptionSerializer
 
         def _call(severity, time, progname, data)
           original_data = Formatters.ensure_hash(data)

data/lib/berkeley_library/logging/logger.rb

@@ -1,3 +1,4 @@
+require 'active_support/isolated_execution_state'
 require 'active_support/logger'
 require 'ougai'
 require 'berkeley_library/logging/tagged_logging_extensions'

data/lib/berkeley_library/logging/module_info.rb

@@ -7,7 +7,7 @@ module BerkeleyLibrary
       SUMMARY = 'Opinionated Ruby/Rails logging for UC Berkeley Library'.freeze
       DESCRIPTION = 'A gem providing shared logging code for UC Berkeley Library gems and Rails applications'.freeze
       LICENSE = 'MIT'.freeze
-      VERSION = '0.2.3'.freeze
+      VERSION = '0.2.6'.freeze
       HOMEPAGE = 'https://github.com/BerkeleyLibrary/logging'.freeze
 
       private_class_method :new

data/lib/berkeley_library/logging/safe_serializer.rb

@@ -0,0 +1,77 @@
+require 'time'
+require 'berkeley_library/logging/exception_serializer'
+
+module BerkeleyLibrary
+  module Logging
+    # Some of values include recursive structures
+    # that cause SystemStackErrors in JSON serialization,
+    # so we convert them all to strings
+    class SafeSerializer
+      include ExceptionSerializer
+
+      RAW_TYPES = [NilClass, FalseClass, TrueClass, Numeric, String, Symbol, Date, Time].freeze
+
+      def initialize(value)
+        @value = value
+      end
+
+      class << self
+        def serialize(value)
+          SafeSerializer.new(value).serialized_value
+        end
+
+        def placeholder_for(value)
+          "#<#{value.class}:#{value.object_id}> (recursive reference)"
+        end
+      end
+
+      def serialized_value
+        @serialized_value ||= serialize(@value)
+      end
+
+      private
+
+      # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity
+      def serialize(value)
+        return value if safe_raw_value?(value)
+        return SafeSerializer.placeholder_for(value) if serialized_values.include?(value)
+
+        serialized_values << value
+
+        return serialize_hash(value) if value.is_a?(Hash)
+        return serialize_hash(value.to_hash) if value.respond_to?(:to_hash)
+        return serialize_array(value) if value.is_a?(Array)
+        return serialize_array(value.to_ary) if value.respond_to?(:to_ary)
+        return serialize_exc(value, serialized_values) if value.is_a?(Exception)
+
+        value.to_s
+      end
+      # rubocop:enable Metrics/AbcSize, Metrics/CyclomaticComplexity
+
+      def safe_raw_value?(value)
+        return true if rails_time_with_zone?(value)
+
+        RAW_TYPES.any? { |t| value.is_a?(t) }
+      end
+
+      def rails_time_with_zone?(value)
+        defined?(ActiveSupport::TimeWithZone) && value.is_a?(ActiveSupport::TimeWithZone)
+      end
+
+      def serialize_array(value)
+        value.map { |v| serialize(v) }
+      end
+
+      def serialize_hash(value)
+        value.each_with_object({}) do |(k, v), h|
+          k1, v1 = [k, v].map { |x| serialize(x) }
+          h[k1] = v1
+        end
+      end
+
+      def serialized_values
+        @serialized_values ||= Set.new
+      end
+    end
+  end
+end

data/spec/.rubocop.yml

@@ -1,15 +1,18 @@
 inherit_from: ../.rubocop.yml
 
+require:
+  - rubocop-rspec
+
 Style/ClassAndModuleChildren:
   Enabled: false
 
-Layout/LineLength:
+Style/OpenStructUse:
   Enabled: false
 
-Metrics/BlockLength:
+Metrics/AbcSize:
   Enabled: false
 
-Metrics/ClassLength:
+Metrics/BlockLength:
   Enabled: false
 
 Metrics/ModuleLength:
@@ -19,9 +22,87 @@ Metrics/MethodLength:
   Enabled: false
 
 ############################################################
-# Added in Rubocop 0.89
+# rubocop-rspec
+
+# believe me, it wasn't by choice
+RSpec/AnyInstance:
+  Enabled: false
+
+# we meant to do that
+RSpec/BeforeAfterAll:
+  Enabled: false
+
+# more words != more readable
+RSpec/ContextWording:
+  Enabled: false
+
+# explicit >>> implicit
+RSpec/DescribedClass:
+  Enabled: false
+
+# more punctuation != more readable
+RSpec/DescribeSymbol:
+  Enabled: false
+
+# too late now
+RSpec/ExampleLength:
+  Enabled: false
+
+# we meant to do that
+RSpec/ExpectInHook:
+  Enabled: false
+
+# if only it were that simple
+RSpec/ExpectOutput:
+  Enabled: false
+
+# your naming scheme is not in possession of all the facts
+RSpec/FilePath:
+  Enabled: false
 
-# Sometimes we're testing the operator
-Lint/BinaryOperatorWithIdenticalOperands:
+# explicit >>> implicit
+RSpec/InstanceVariable:
   Enabled: false
-  
+
+# maybe when 'all' has a corresponding 'none' matcher
+RSpec/IteratedExpectation:
+  Enabled: false
+
+# TODO: clean these up & de-disable this
+RSpec/LeakyConstantDeclaration:
+  Enabled: false
+
+# too late now
+RSpec/MultipleMemoizedHelpers:
+  Enabled: false
+
+# setup cost / time >>> failure granularity
+RSpec/MultipleExpectations:
+  Enabled: false
+
+# cure is worse than the disease
+RSpec/NestedGroups:
+  Enabled: false
+
+# more quotation marks != more readable
+RSpec/SharedExamples:
+  Enabled: false
+
+# we meant to do that
+RSpec/StubbedMock:
+  Enabled: false
+
+# we meant to do that
+RSpec/VerifiedDoubles:
+  Enabled: false
+
+############################################################
+# rubocop-rspec
+
+# enable newer rubocop-rspec cops
+
+RSpec/IdenticalEqualityAssertion: # new in 2.4
+  Enabled: true
+
+RSpec/Rails/AvoidSetupHook: # new in 2.4
+  Enabled: true

data/spec/rails/ucblit/logging/configurator_spec.rb

@@ -10,7 +10,7 @@ module BerkeleyLibrary
 
         attr_reader :config
 
-        before(:each) do
+        before do
           app = Class.new(Rails::Application).new
           allow(Rails).to receive(:application).and_return(app)
           @config = app.config
@@ -30,36 +30,106 @@ module BerkeleyLibrary
             expect(lograge.enabled).to eq(true)
           end
 
-          it 'extracts request info from log events' do
-            Configurator.configure(config)
-            lograge = config.lograge
+          context 'events' do
+            let(:params) { { authenticity_token: '8675309' } }
+
+            let(:session_hash) do
+              {
+                'session_id' => '17cd06b1b7cb9744e8fa626ef5f37c67',
+                'user' => {
+                  'id' => 71,
+                  'user_name' => 'Ms. Magoo',
+                  'created_at' => '2021-10-14T09:24:42.730-07:00',
+                  'updated_at' => '2021-10-14T09:24:42.729-07:00',
+                  'user_role' => 'Administrator',
+                  'user_active' => true,
+                  'uid' => 1_684_944,
+                  'updated_by' => 'Dr. Pibb'
+                },
+                'expires_at' => '2021-11-03T12:30:01.281-07:00',
+                '_csrf_token' => 'HiN1xUxFcOvWvoe2nwoBSGlmGSN6x0jprpSqDrzquxA='
+              }
+            end
+
+            let(:request_headers) do
+              {
+                'HTTP_REFERER' => 'value from HTTP_REFERER',
+                'action_dispatch.request_id' => 'value from action_dispatch.request_id',
+                'action_dispatch.remote_ip' => 'value from action_dispatch.remote_ip',
+                'REMOTE_ADDR' => 'value from REMOTE_ADDR',
+                'HTTP_X_FORWARDED_FOR' => 'value from HTTP_X_FORWARDED_FOR',
+                'HTTP_FORWARDED' => 'value from HTTP_FORWARDED'
+              }
+            end
+
+            let(:expected_header_map) do
+              {
+                referer: 'HTTP_REFERER',
+                request_id: 'action_dispatch.request_id',
+                remote_ip: 'action_dispatch.remote_ip',
+                remote_addr: 'REMOTE_ADDR',
+                x_forwarded_for: 'HTTP_X_FORWARDED_FOR',
+                forwarded: 'HTTP_FORWARDED'
+              }
+            end
+
+            attr_reader :session, :request, :payload, :event
+
+            before do
+              @session = instance_double(ActionDispatch::Request::Session)
+              allow(session).to receive(:to_hash).and_return(session_hash)
+
+              @request = instance_double(ActionDispatch::Request)
+              allow(request).to receive(:origin).and_return('http://example.org:3000')
+              allow(request).to receive(:base_url).and_return('https://example.org:3443')
+              allow(request).to receive(:x_csrf_token).and_return('5551212')
+              allow(request).to receive(:session).and_return(session)
+
+              @payload = {
+                params: params,
+                request: request,
+                headers: request_headers
+              }
+
+              @event = instance_double(ActiveSupport::Notifications::Event)
+              allow(event).to receive(:payload).and_return(payload)
+            end
+
+            it 'extracts request info from log events' do
+              Configurator.configure(config)
+              data = config.lograge.custom_options.call(event)
 
-            request_headers = {
-              'HTTP_REFERER' => 'value from HTTP_REFERER',
-              'action_dispatch.request_id' => 'value from action_dispatch.request_id',
-              'action_dispatch.remote_ip' => 'value from action_dispatch.remote_ip',
-              'REMOTE_ADDR' => 'value from REMOTE_ADDR',
-              'HTTP_X_FORWARDED_FOR' => 'value from HTTP_X_FORWARDED_FOR',
-              'HTTP_FORWARDED' => 'value from HTTP_FORWARDED'
-            }
-
-            expected_header_map = {
-              referer: 'HTTP_REFERER',
-              request_id: 'action_dispatch.request_id',
-              remote_ip: 'action_dispatch.remote_ip',
-              remote_addr: 'REMOTE_ADDR',
-              x_forwarded_for: 'HTTP_X_FORWARDED_FOR',
-              forwarded: 'HTTP_FORWARDED'
-            }
-
-            event = instance_double(ActiveSupport::Notifications::Event)
-            allow(event).to receive(:payload).and_return({ headers: request_headers })
-
-            custom_options = lograge.custom_options
-            data = custom_options.call(event)
-            expect(data).to be_a(Hash)
-            expect(data[:time]).to be_a(Time) # TODO: check for accuracy
-            expected_header_map.each { |xh, rh| expect(data[xh]).to eq(request_headers[rh]) }
+              expect(data).to be_a(Hash)
+              expect(data[:time]).to be_a(Time)
+              expect(data[:time].to_i).to be_within(60).of(Time.now.to_i)
+
+              expected_header_map.each { |xh, rh| expect(data[xh]).to eq(request_headers[rh]) }
+
+              expect(data[:authenticity_token]).to eq(params[:authenticity_token])
+
+              Events::LOGGED_REQUEST_ATTRIBUTES.each do |attr|
+                expect(data[attr]).to eq(request.send(attr))
+              end
+            end
+
+            it 'includes the entire session if `verbose_session_logging` is true' do
+              config.lograge.verbose_session_logging = true
+              Configurator.configure(config)
+              data = config.lograge.custom_options.call(event)
+
+              expect(data[:session]).to eq(session_hash)
+            end
+
+            it 'includes only the session ID by default' do
+              Configurator.configure(config)
+              data = config.lograge.custom_options.call(event)
+
+              expected_hash = Events::LOGGED_SESSION_ATTRIBUTES.each_with_object({}) do |attr, h|
+                h[attr] = session_hash[attr.to_s]
+              end
+
+              expect(data[:session]).to eq(expected_hash)
+            end
           end
 
           it 'formats Lograge data as a hash' do

data/spec/rails/ucblit/logging/env_spec.rb

@@ -5,11 +5,11 @@ module BerkeleyLibrary
 
     attr_reader :orig_rails_env
 
-    before(:each) do
+    before do
       @orig_rails_env = Rails.env
     end
 
-    after(:each) do
+    after do
       Rails.env = orig_rails_env
     end