chronos-ruby 0.1.0.pre.2 → 0.2.0.pre.1

data/lib/chronos/configuration.rb

@@ -19,12 +19,19 @@ module Chronos
   #   config.host = 'https://chronos.example.com'
   #   snapshot = config.snapshot
   class Configuration
+    DEFAULT_BLOCKLIST_KEYS = %w(
+      password password_confirmation passwd secret api_key apikey authorization
+      token access_token refresh_token private_key client_secret cookie set-cookie
+      session credit_card card_number cvv cpf cnpj
+    ).freeze
+
     ATTRIBUTES = [
       :project_id, :project_key, :host, :environment, :app_version,
       :service_name, :root_directory, :logger, :timeout, :open_timeout,
       :queue_size, :workers, :enabled, :error_notifications,
       :ignored_environments, :proxy, :ssl_verify, :user_agent,
-      :max_payload_size, :gzip
+      :max_payload_size, :gzip, :blocklist_keys, :allowlist_keys,
+      :filters, :hash_keys, :anonymize_ip
     ].freeze
 
     attr_accessor(*ATTRIBUTES)
@@ -50,6 +57,11 @@ module Chronos
       @user_agent = "chronos-ruby/#{Chronos::VERSION}"
       @max_payload_size = 1_048_576
       @gzip = false
+      @blocklist_keys = DEFAULT_BLOCKLIST_KEYS.dup
+      @allowlist_keys = []
+      @filters = []
+      @hash_keys = []
+      @anonymize_ip = true
     end
 
     def snapshot
@@ -75,6 +87,7 @@ module Chronos
       errors << "queue_size must be a positive integer" unless positive_integer?(queue_size)
       errors << "workers must be a positive integer" unless positive_integer?(workers)
       errors << "max_payload_size must be a positive integer" unless positive_integer?(max_payload_size)
+      errors.concat(privacy_errors)
       errors
     end
 
@@ -83,8 +96,53 @@ module Chronos
     def to_hash
       ATTRIBUTES.each_with_object({}) do |attribute, values|
         value = public_send(attribute)
-        value = value.dup if value.is_a?(Array) || value.is_a?(Hash) || value.is_a?(String)
-        values[attribute] = value
+        values[attribute] = deep_copy(value)
+      end
+    end
+
+    def privacy_errors
+      errors = []
+      errors << "blocklist_keys must be an array" unless blocklist_keys.is_a?(Array)
+      errors << "allowlist_keys must be an array" unless allowlist_keys.is_a?(Array)
+      errors << "hash_keys must be an array" unless hash_keys.is_a?(Array)
+      errors.concat(matcher_errors("blocklist_keys", blocklist_keys))
+      errors.concat(matcher_errors("allowlist_keys", allowlist_keys))
+      errors.concat(matcher_errors("hash_keys", hash_keys))
+      errors.concat(filter_errors)
+      errors.concat(anonymization_errors)
+      errors
+    end
+
+    def filter_errors
+      return ["filters must be an array"] unless filters.is_a?(Array)
+      return [] if filters.all? { |filter| filter.respond_to?(:call) }
+
+      ["filters must contain only callable objects"]
+    end
+
+    def anonymization_errors
+      return [] if anonymize_ip == true || anonymize_ip == false
+
+      ["anonymize_ip must be true or false"]
+    end
+
+    def matcher_errors(name, values)
+      return [] unless values.is_a?(Array)
+      return [] if values.all? { |value| value.is_a?(String) || value.is_a?(Symbol) || value.is_a?(Regexp) }
+
+      ["#{name} must contain only String, Symbol, or Regexp values"]
+    end
+
+    def deep_copy(value)
+      case value
+      when Hash
+        value.each_with_object({}) { |(key, child), result| result[deep_copy(key)] = deep_copy(child) }
+      when Array
+        value.map { |child| deep_copy(child) }
+      when String, Regexp
+        value.dup
+      else
+        value
       end
     end
 
@@ -125,7 +183,7 @@ module Chronos
       def initialize(values)
         ATTRIBUTES.each do |attribute|
           value = values[attribute]
-          value.freeze if value.is_a?(Array) || value.is_a?(Hash) || value.is_a?(String)
+          deep_freeze(value)
           instance_variable_set("@#{attribute}", value)
         end
         freeze
@@ -134,6 +192,23 @@ module Chronos
       def enabled_for_environment?
         enabled && !ignored_environments.map(&:to_s).include?(environment.to_s)
       end
+
+      private
+
+      def deep_freeze(value)
+        return value if value.respond_to?(:call)
+
+        case value
+        when Hash
+          value.each do |key, child|
+            deep_freeze(key)
+            deep_freeze(child)
+          end
+        when Array
+          value.each { |child| deep_freeze(child) }
+        end
+        value.freeze
+      end
     end
   end
 end

data/lib/chronos/core/notice.rb

@@ -4,7 +4,7 @@ module Chronos
     #
     # @responsibility Carry exception and diagnostic context through the pipeline.
     # @motivation Keep transport details separate from exception normalization.
-    # @limits It does not sanitize, serialize, enqueue, or send itself.
+    # @limits It does not sanitize, serialize, enqueue, or send itself; raw values live only in memory.
     # @collaborators NoticeBuilder and PayloadSerializer.
     # @thread_safety Immutable after construction and safe to share.
     # @compatibility Ruby 2.2.10 through Ruby 2.6; independent of Rails.

data/lib/chronos/core/payload_serializer.rb

@@ -26,30 +26,27 @@ module Chronos
 
     # Converts a Notice into the versioned Chronos JSON envelope.
     #
-    # @responsibility Normalize values to JSON primitives and enforce size limits.
-    # @motivation Prevent arbitrary application objects or invalid encodings from breaking capture.
-    # @limits Version 0.1 applies structural limits, not the advanced privacy rules from 0.2.
-    # @collaborators Notice and SerializedEvent.
+    # @responsibility Sanitize an event, normalize it to JSON primitives, and enforce size limits.
+    # @motivation Ensure sensitive or unsafe application values never reach transport unchanged.
+    # @limits Detection is bounded and does not replace application-specific data governance.
+    # @collaborators Notice, Sanitizer, SafeSerializer, and SerializedEvent.
     # @thread_safety Stateless apart from immutable configuration.
     # @compatibility Uses the JSON standard library available on Ruby 2.2.10.
     # @example
     #   event = serializer.call(notice)
     #   event.body #=> "{...}"
     # @errors Serialization failures are handled by CaptureException.
-    # @performance Linear in payload size with bounded depth and collection sizes.
+    # @performance Linear in payload size with bounded depth, nodes, and collection sizes.
     class PayloadSerializer
-      MAX_DEPTH = 10
-      MAX_KEYS = 100
-      MAX_ITEMS = 100
-      MAX_STRING_BYTES = 8192
-
-      def initialize(config, clock = nil)
+      def initialize(config, clock = nil, options = {})
         @config = config
         @clock = clock || proc { Time.now }
+        @sanitizer = options[:sanitizer] || Sanitizer.new(config)
+        @safe_serializer = options[:safe_serializer] || SafeSerializer.new
       end
 
       def call(notice)
-        envelope = build_envelope(notice)
+        envelope = @safe_serializer.call(@sanitizer.call(build_envelope(notice)))
         body = JSON.generate(envelope)
         body = JSON.generate(compact_envelope(envelope)) if body.bytesize > @config.max_payload_size
         raise Error, "event exceeds max_payload_size" if body.bytesize > @config.max_payload_size
@@ -66,44 +63,44 @@ module Chronos
           "event_type" => "exception",
           "occurred_at" => notice.timestamp,
           "sent_at" => @clock.call.utc.iso8601(6),
-          "project_key" => safe_string(@config.project_id),
-          "environment" => safe_string(notice.environment),
+          "project_key" => @config.project_id,
+          "environment" => notice.environment,
           "service" => {
-            "name" => safe_string(@config.service_name),
-            "version" => safe_string(@config.app_version),
-            "instance_id" => safe_string(notice.host)
+            "name" => @config.service_name,
+            "version" => @config.app_version,
+            "instance_id" => notice.host
           },
-          "runtime" => normalize(notice.runtime, 0),
-          "context" => normalize(notice.context, 0),
+          "runtime" => notice.runtime,
+          "context" => notice.context,
           "payload" => payload(notice)
         }
       end
 
       def payload(notice)
-        normalize({
-                    "exception" => {
-                      "class" => notice.exception_class,
-                      "message" => notice.message,
-                      "backtrace" => notice.backtrace,
-                      "causes" => notice.causes
-                    },
-                    "severity" => notice.severity,
-                    "parameters" => notice.parameters,
-                    "session" => notice.session,
-                    "user" => notice.user,
-                    "versions" => notice.versions,
-                    "host" => notice.host,
-                    "process" => notice.process,
-                    "thread" => notice.thread,
-                    "tags" => notice.tags,
-                    "fingerprint" => notice.fingerprint
-                  }, 0)
+        {
+          "exception" => {
+            "class" => notice.exception_class,
+            "message" => notice.message,
+            "backtrace" => notice.backtrace,
+            "causes" => notice.causes
+          },
+          "severity" => notice.severity,
+          "parameters" => notice.parameters,
+          "session" => notice.session,
+          "user" => notice.user,
+          "versions" => notice.versions,
+          "host" => notice.host,
+          "process" => notice.process,
+          "thread" => notice.thread,
+          "tags" => notice.tags,
+          "fingerprint" => notice.fingerprint
+        }
       end
 
       def compact_envelope(envelope)
         payload = envelope["payload"]
         exception = payload["exception"]
-        exception["message"] = truncate_string(exception["message"], 1024)
+        exception["message"] = @safe_serializer.call(exception["message"], :max_string_bytes => 1024)
         exception["backtrace"] = Array(exception["backtrace"]).first(20)
         payload["parameters"] = {"_truncated" => true}
         payload["session"] = {"_truncated" => true}
@@ -111,55 +108,6 @@ module Chronos
         envelope["context"] = {"_truncated" => true}
         envelope
       end
-
-      def normalize(value, depth)
-        return "<maximum depth reached>" if depth >= MAX_DEPTH
-
-        case value
-        when nil, true, false, Integer
-          value
-        when Float
-          value.finite? ? value : value.to_s
-        when String, Symbol
-          truncate_string(safe_string(value), MAX_STRING_BYTES)
-        when Array
-          value.first(MAX_ITEMS).map { |child| normalize(child, depth + 1) }
-        when Hash
-          normalize_hash(value, depth)
-        else
-          "<#{safe_class_name(value)}>"
-        end
-      rescue StandardError
-        "<unserializable value>"
-      end
-
-      def normalize_hash(value, depth)
-        result = {}
-        value.to_a.first(MAX_KEYS).each do |key, child|
-          result[truncate_string(safe_string(key), 256)] = normalize(child, depth + 1)
-        end
-        result
-      end
-
-      def safe_string(value)
-        return nil if value.nil?
-
-        value.to_s.encode("UTF-8", :invalid => :replace, :undef => :replace, :replace => "�")
-      rescue StandardError
-        "<unreadable value>"
-      end
-
-      def truncate_string(value, limit)
-        return value if value.nil? || value.bytesize <= limit
-
-        value.byteslice(0, limit).to_s.encode("UTF-8", :invalid => :replace, :undef => :replace, :replace => "�") + "…"
-      end
-
-      def safe_class_name(value)
-        value.class.name.to_s
-      rescue StandardError
-        "Object"
-      end
     end
   end
 end

data/lib/chronos/core/runtime_info.rb

@@ -22,7 +22,7 @@ module Chronos
           },
           :host => safe_hostname,
           :process => {"pid" => Process.pid},
-          :thread => {"id" => Thread.current.object_id.to_s}
+          :thread => {"id" => "0x#{Thread.current.object_id.to_s(16)}"}
         }
       end
 

data/lib/chronos/core/safe_serializer.rb

@@ -0,0 +1,119 @@
+module Chronos
+  module Core
+    # Converts bounded Ruby structures to values accepted by JSON.generate.
+    #
+    # @responsibility Normalize only JSON primitives while enforcing structural budgets.
+    # @motivation Prevent application objects, cycles, or invalid encoding from breaking capture.
+    # @limits It does not redact secrets; Sanitizer must run before this component.
+    # @collaborators PayloadSerializer.
+    # @thread_safety Each call owns its traversal state and can run concurrently.
+    # @compatibility Ruby 2.2.10 through Ruby 2.6.
+    # @example
+    #   serializer.call(:status => :ok) #=> {"status"=>"ok"}
+    # @errors Individual unreadable values become bounded placeholders.
+    # @performance Depth, nodes, keys, items, and string bytes are bounded.
+    class SafeSerializer
+      DEFAULTS = {
+        :max_depth => 10,
+        :max_keys => 100,
+        :max_items => 100,
+        :max_string_bytes => 8192,
+        :max_nodes => 2_000
+      }.freeze
+
+      def initialize(options = {})
+        @options = DEFAULTS.merge(options).freeze
+      end
+
+      def call(value, overrides = {})
+        settings = @options.merge(overrides)
+        normalize(value, 0, {}, {:nodes => 0}, settings)
+      rescue StandardError
+        "<unserializable value>"
+      end
+
+      private
+
+      def normalize(value, depth, seen, state, settings)
+        state[:nodes] += 1
+        return "<node limit reached>" if state[:nodes] > settings[:max_nodes]
+        return "<maximum depth reached>" if depth >= settings[:max_depth]
+
+        return normalize_array(value, depth, seen, state, settings) if value.is_a?(Array)
+        return normalize_hash(value, depth, seen, state, settings) if value.is_a?(Hash)
+
+        normalize_scalar(value, settings)
+      rescue StandardError
+        "<unserializable value>"
+      end
+
+      def normalize_scalar(value, settings)
+        case value
+        when nil, true, false, Integer
+          value
+        when Float
+          value.finite? ? value : value.to_s
+        when String
+          truncate_string(safe_string(value), settings[:max_string_bytes])
+        when Symbol
+          truncate_string(value.to_s, settings[:max_string_bytes])
+        else
+          "<#{safe_class_name(value)}>"
+        end
+      end
+
+      def normalize_array(value, depth, seen, state, settings)
+        return "<circular reference>" if seen[value.object_id]
+
+        seen[value.object_id] = true
+        result = value.first(settings[:max_items]).map do |child|
+          normalize(child, depth + 1, seen, state, settings)
+        end
+        seen.delete(value.object_id)
+        result
+      end
+
+      def normalize_hash(value, depth, seen, state, settings)
+        return "<circular reference>" if seen[value.object_id]
+
+        seen[value.object_id] = true
+        result = {}
+        value.to_a.first(settings[:max_keys]).each do |key, child|
+          result[safe_key(key)] = normalize(child, depth + 1, seen, state, settings)
+        end
+        seen.delete(value.object_id)
+        result
+      end
+
+      def safe_key(value)
+        string = if value.is_a?(String) || value.is_a?(Symbol) || value.is_a?(Numeric)
+                   value.to_s
+                 else
+                   "<#{safe_class_name(value)}>"
+                 end
+        truncate_string(safe_string(string), 256)
+      rescue StandardError
+        "<unreadable key>"
+      end
+
+      def safe_string(value)
+        value.encode("UTF-8", :invalid => :replace, :undef => :replace, :replace => "�")
+      rescue StandardError
+        "<unreadable value>"
+      end
+
+      def truncate_string(value, limit)
+        return value if value.bytesize <= limit
+
+        prefix = value.byteslice(0, limit).to_s
+        safe_string(prefix) + "…"
+      end
+
+      def safe_class_name(value)
+        value.class.name.to_s
+      rescue StandardError
+        "Object"
+      end
+    end
+  end
+end

data/lib/chronos/core/sanitizer.rb

@@ -0,0 +1,161 @@
+require "digest"
+
+module Chronos
+  module Core
+    # Removes secrets and personal data from event values before serialization.
+    #
+    # @responsibility Recursively redact configured keys and recognized sensitive strings.
+    # @motivation Make privacy protection the default before transport or future persistence.
+    # @limits Detection is conservative and cannot replace an application data-governance review.
+    # @collaborators Configuration::Snapshot and application-provided filters.
+    # @thread_safety Instances are immutable; configured filters must be thread-safe.
+    # @compatibility Ruby 2.2.10 through Ruby 2.6; independent of frameworks.
+    # @example
+    #   sanitizer.call("password" => "secret") #=> {"password"=>"[FILTERED]"}
+    # @errors Unsafe values and failing custom filters become redacted placeholders.
+    # @performance Work is linear in the structurally bounded event tree.
+    class Sanitizer
+      FILTERED = SensitiveValueFilter::FILTERED
+      MAX_DEPTH = 10
+      MAX_KEYS = 100
+      MAX_ITEMS = 100
+      MAX_NODES = 2_000
+
+      def initialize(config)
+        @blocklist_names, @blocklist_patterns = compile_matchers(config.blocklist_keys)
+        @allowlist_names, @allowlist_patterns = compile_matchers(config.allowlist_keys)
+        @hash_names, @hash_patterns = compile_matchers(config.hash_keys)
+        @filters = config.filters
+        @sensitive_value_filter = SensitiveValueFilter.new(config.anonymize_ip)
+        @hash_scope = config.project_id.to_s
+        freeze
+      end
+
+      def call(value)
+        sanitize_value(value, nil, true, 0, :nodes => 0, :seen => {})
+      rescue StandardError
+        FILTERED
+      end
+
+      private
+
+      def sanitize_value(value, key, run_filters, depth, state)
+        state[:nodes] += 1
+        return "<node limit reached>" if state[:nodes] > MAX_NODES
+        return "<maximum depth reached>" if depth >= MAX_DEPTH
+
+        result = sanitize_type(value, depth, state)
+        run_filters && key && !@filters.empty? ? filter_value(key, result, depth, state) : result
+      rescue StandardError
+        FILTERED
+      end
+
+      def sanitize_type(value, depth, state)
+        return sanitize_hash(value, depth, state) if value.is_a?(Hash)
+        return sanitize_array(value, depth, state) if value.is_a?(Array)
+        return @sensitive_value_filter.call(value) if value.is_a?(String)
+
+        value
+      end
+
+      def sanitize_hash(value, depth, state)
+        return "<circular reference>" if state[:seen][value.object_id]
+
+        state[:seen][value.object_id] = true
+        result = {}
+        value.to_a.first(MAX_KEYS).each do |key, child|
+          result[key] = sanitize_hash_value(key, child, depth, state)
+        end
+        state[:seen].delete(value.object_id)
+        result
+      end
+
+      def sanitize_hash_value(key, value, depth, state)
+        return FILTERED if blocked_key?(key) && !allowed_key?(key)
+        return hash_value(value) if hashed_key?(key)
+
+        sanitize_value(value, key, true, depth + 1, state)
+      end
+
+      def sanitize_array(value, depth, state)
+        return "<circular reference>" if state[:seen][value.object_id]
+
+        state[:seen][value.object_id] = true
+        result = value.first(MAX_ITEMS).map do |child|
+          sanitize_value(child, nil, true, depth + 1, state)
+        end
+        state[:seen].delete(value.object_id)
+        result
+      end
+
+      def blocked_key?(key)
+        matches_any?(@blocklist_names, @blocklist_patterns, key, true)
+      end
+
+      def allowed_key?(key)
+        matches_any?(@allowlist_names, @allowlist_patterns, key, false)
+      end
+
+      def hashed_key?(key)
+        matches_any?(@hash_names, @hash_patterns, key, false)
+      end
+
+      def compile_matchers(matchers)
+        names = []
+        patterns = []
+        matchers.each do |matcher|
+          matcher.is_a?(Regexp) ? patterns << matcher : names << normalize_key(matcher)
+        end
+        [names.freeze, patterns.freeze]
+      end
+
+      def matches_any?(names, patterns, key, fallback)
+        candidate = safe_key(key)
+        key_name = normalize_key(candidate)
+        name_match = names.any? { |name| key_name == name || key_name.end_with?("_#{name}") }
+        name_match || patterns.any? { |pattern| pattern =~ candidate }
+      rescue StandardError
+        fallback
+      end
+
+      def normalize_key(value)
+        value.to_s.downcase.gsub(/[^a-z0-9]+/, "_").sub(/\A_+/, "").sub(/_+\z/, "")
+      end
+
+      def safe_key(value)
+        return value if value.is_a?(String)
+        return value.to_s if value.is_a?(Symbol) || value.is_a?(Numeric)
+
+        "<#{safe_class_name(value)}>"
+      rescue StandardError
+        "<unreadable key>"
+      end
+
+      def hash_value(value)
+        scalar = case value
+                 when String, Symbol, Numeric
+                   value.to_s
+                 else
+                   return FILTERED
+                 end
+        digest = Digest::SHA256.hexdigest("chronos:#{@hash_scope}:#{scalar}")
+        "[HASHED_SHA256:#{digest}]"
+      rescue StandardError
+        FILTERED
+      end
+
+      def filter_value(key, value, depth, state)
+        filtered = @filters.inject(value) { |current, filter| filter.call(key, current) }
+        sanitize_value(filtered, nil, false, depth, state)
+      rescue StandardError
+        FILTERED
+      end
+
+      def safe_class_name(value)
+        value.class.name.to_s
+      rescue StandardError
+        "Object"
+      end
+    end
+  end
+end