debugbundle 1.4.0 → 1.5.0

data/spec/rails_relay_spec.rb

@@ -1,121 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-require 'json'
-require 'stringio'
-
-RSpec.describe DebugBundle::Rails::RelayEndpoint do
-  let(:relay_options_class) do
-    Struct.new(
-      :project_mode,
-      :project_token,
-      :service,
-      :environment,
-      :relay_durable_write,
-      :relay_allowed_origins,
-      :relay_forward_transport,
-      :relay_rate_limit_per_minute,
-      :relay_handler,
-      keyword_init: true
-    )
-  end
-  let(:app_config_class) { Struct.new(:debugbundle, keyword_init: true) }
-  let(:fake_app_class) { Struct.new(:config, keyword_init: true) }
-
-  it 'builds a relay handler from Rails config and forwards browser events' do
-    transport_events = []
-    forward_transport = Class.new do
-      define_method(:initialize) do |transport_events|
-        @transport_events = transport_events
-      end
-
-      define_method(:call) do |request|
-        @transport_events << request
-        DebugBundle::Transport::Result.new(status_code: 202)
-      end
-    end.new(transport_events)
-
-    app = fake_app_class.new(
-      config: app_config_class.new(
-        debugbundle: relay_options_class.new(
-          project_mode: :connected,
-          project_token: 'dbundle_proj_test',
-          service: 'rails-checkout',
-          environment: 'production',
-          relay_durable_write: false,
-          relay_allowed_origins: ['https://app.example.com'],
-          relay_forward_transport: forward_transport,
-          relay_rate_limit_per_minute: 10
-        )
-      )
-    )
-
-    endpoint = described_class.new(app: app)
-    status, headers, body = endpoint.call(
-      'REQUEST_METHOD' => 'POST',
-      'CONTENT_TYPE' => 'application/json',
-      'HOST' => 'app.example.com',
-      'HTTP_ORIGIN' => 'https://app.example.com',
-      'rack.input' => StringIO.new(
-        JSON.generate(
-          'batch' => [
-            {
-              'schema_version' => '2026-03-01',
-              'event_id' => 'evt-1',
-              'event_type' => 'frontend_exception',
-              'sdk_name' => '@debugbundle/sdk-browser',
-              'sdk_version' => '0.1.0',
-              'occurred_at' => Time.now.utc.iso8601,
-              'service' => { 'name' => 'browser-app', 'environment' => 'production' },
-              'correlation' => { 'trace_id' => 'trace-1' },
-              'payload' => { 'message' => 'boom' }
-            }
-          ]
-        )
-      )
-    )
-
-    expect(status).to eq(202)
-    expect(headers).to include('Content-Type' => 'application/json')
-    expect(JSON.parse(body.join)).to include('accepted' => 1, 'rejected' => 0)
-    expect(transport_events.fetch(0).fetch(:events).fetch(0).fetch('service')).to include(
-      'name' => 'rails-checkout',
-      'environment' => 'production'
-    )
-  end
-
-  it 'uses an explicit relay handler override when provided' do
-    custom_handler = Class.new do
-      attr_reader :requests
-
-      def initialize
-        @requests = []
-      end
-
-      def handle(request)
-        @requests << request
-        DebugBundle::Relay::Response.new(status: 202, body: { 'accepted' => 0, 'rejected' => 0, 'errors' => [] })
-      end
-    end.new
-
-    app = fake_app_class.new(
-      config: app_config_class.new(
-        debugbundle: relay_options_class.new(
-          relay_handler: custom_handler
-        )
-      )
-    )
-
-    endpoint = described_class.new(app: app)
-    status, = endpoint.call(
-      'REQUEST_METHOD' => 'POST',
-      'CONTENT_TYPE' => 'application/json',
-      'HOST' => 'example.com',
-      'HTTP_ORIGIN' => 'https://example.com',
-      'rack.input' => StringIO.new('{"batch":[]}')
-    )
-
-    expect(status).to eq(202)
-    expect(custom_handler.requests.fetch(0)).to include(method: 'POST')
-  end
-end

data/spec/redaction_spec.rb

@@ -1,42 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-RSpec.describe DebugBundle::Redaction::Redactor do
-  it 'redacts segment-aware sensitive keys' do
-    redacted = described_class.new.redact_value(
-      {
-        'user_password' => 'super-secret',
-        'apiKey' => 'abc123',
-        'sessionId' => 'sess-1',
-        'safe' => { 'message' => 'ok' }
-      }
-    )
-
-    expect(redacted).to include(
-      'user_password' => '[REDACTED]',
-      'apiKey' => '[REDACTED]',
-      'sessionId' => '[REDACTED]'
-    )
-    expect(redacted.fetch('safe')).to eq({ 'message' => 'ok' })
-  end
-
-  it 'protects against circular references' do
-    value = {}
-    value['self'] = value
-
-    redacted = described_class.new.redact_value(value)
-
-    expect(redacted.fetch('self')).to eq('[Circular]')
-  end
-
-  it 'supports additional sensitive fields from framework configuration' do
-    redactor = described_class.new(
-      sensitive_fields: DebugBundle::Redaction::DEFAULT_SENSITIVE_FIELDS + %w[patient_notes]
-    )
-
-    redacted = redactor.redact_value('patient_notes' => 'diagnosis details', 'safe' => 'ok')
-
-    expect(redacted).to include('patient_notes' => '[REDACTED]', 'safe' => 'ok')
-  end
-end

data/spec/relay_spec.rb

@@ -1,274 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-require 'json'
-require 'stringio'
-require 'tmpdir'
-
-RSpec.describe DebugBundle::Relay::Handler do
-  let(:browser_event) do
-    {
-      'schema_version' => '2026-03-01',
-      'event_id' => 'evt_1',
-      'event_type' => 'frontend_exception',
-      'sdk_version' => '0.1.0',
-      'occurred_at' => Time.now.utc.iso8601,
-      'project_token' => 'browser-token',
-      'organization_id' => 'org_1',
-      'sdk_name' => 'spoofed',
-      'service' => {
-        'name' => 'checkout-web',
-        'environment' => 'production'
-      },
-      'correlation' => {
-        'trace_id' => 'trace-1',
-        'request_id' => 'req-1',
-        'session_id' => nil,
-        'user_id_hash' => 'user-1'
-      },
-      'payload' => { 'message' => 'boom' }
-    }
-  end
-
-  it 'validates, sanitizes, and writes local-only relay batches' do
-    Dir.mktmpdir do |directory|
-      handler = described_class.new(project_mode: :local_only, project_token: 'dbundle_proj_server',
-                                    local_events_dir: directory)
-      response = handler.handle(
-        method: 'POST',
-        headers: {
-          'host' => 'app.example.com',
-          'origin' => 'https://app.example.com',
-          'content-type' => 'application/json'
-        },
-        body: JSON.generate('batch' => [browser_event]),
-        ip_address: '127.0.0.1'
-      )
-
-      expect(response.status).to eq(202)
-
-      file_name = Dir.children(directory).find { |entry| entry.end_with?('.events.json') }
-      parsed = JSON.parse(File.read(File.join(directory, file_name)))
-      event = parsed.fetch(0)
-
-      expect(event).to include('sdk_name' => '@debugbundle/sdk-browser', 'project_token' => 'dbundle_proj_server')
-      expect(event).not_to have_key('organization_id')
-      expect(event.fetch('correlation')).to include('trace_id' => 'trace-1', 'request_id' => 'req-1')
-    end
-  end
-
-  it 'preserves analytics correlation fields for analytics relay events' do
-    analytics_event = browser_event.merge(
-      'event_type' => 'analytics_event',
-      'correlation' => {
-        'session_id' => 'session-analytics',
-        'visitor_id_hash' => "sha256:#{'a' * 64}",
-        'user_id_hash' => nil,
-        'trace_id' => 'trace-analytics',
-        'deploy_id' => 'deploy-analytics'
-      },
-      'payload' => { 'kind' => 'page_view', 'privacy' => { 'mode' => 'standard', 'consent_granted' => true } }
-    )
-
-    Dir.mktmpdir do |directory|
-      handler = described_class.new(project_mode: :local_only, project_token: 'dbundle_proj_server',
-                                    local_events_dir: directory)
-      response = handler.handle(
-        method: 'POST',
-        headers: {
-          'host' => 'app.example.com',
-          'origin' => 'https://app.example.com',
-          'content-type' => 'application/json'
-        },
-        body: JSON.generate('batch' => [analytics_event]),
-        ip_address: '127.0.0.2'
-      )
-
-      expect(response.status).to eq(202)
-      file_name = Dir.children(directory).find { |entry| entry.end_with?('.events.json') }
-      event = JSON.parse(File.read(File.join(directory, file_name))).fetch(0)
-      expect(event.fetch('correlation')).to eq(analytics_event.fetch('correlation'))
-    end
-  end
-
-  it 'rejects wrong origins' do
-    handler = described_class.new(project_mode: :local_only, project_token: 'dbundle_proj_server')
-    response = handler.handle(
-      method: 'POST',
-      headers: {
-        'host' => 'app.example.com',
-        'origin' => 'https://evil.example.com',
-        'content-type' => 'application/json'
-      },
-      body: JSON.generate('batch' => [browser_event]),
-      ip_address: '127.0.0.1'
-    )
-
-    expect(response.status).to eq(403)
-  end
-
-  it 'answers allowed cross-origin preflight without delivering events' do
-    handler = described_class.new(project_mode: :local_only, project_token: 'dbundle_proj_server',
-                                  allowed_origins: ['https://web.example.com'])
-    response = handler.handle(
-      method: 'OPTIONS',
-      headers: {
-        'host' => 'api.example.com',
-        'origin' => 'https://web.example.com',
-        'access-control-request-method' => 'POST',
-        'access-control-request-headers' => 'content-type'
-      },
-      body: '',
-      ip_address: '127.0.0.1'
-    )
-
-    expect(response.status).to eq(204)
-    expect(response.headers).to include(
-      'Access-Control-Allow-Origin' => 'https://web.example.com',
-      'Access-Control-Allow-Methods' => 'POST, OPTIONS'
-    )
-  end
-
-  it 'adds CORS headers to accepted cross-origin relay posts' do
-    handler = described_class.new(project_mode: :local_only, project_token: 'dbundle_proj_server',
-                                  allowed_origins: ['https://web.example.com'])
-    response = handler.handle(
-      method: 'POST',
-      headers: {
-        'host' => 'api.example.com',
-        'origin' => 'https://web.example.com',
-        'content-type' => 'application/json'
-      },
-      body: JSON.generate('batch' => [browser_event]),
-      ip_address: '127.0.0.1'
-    )
-
-    expect(response.status).to eq(202)
-    expect(response.headers).to include('Access-Control-Allow-Origin' => 'https://web.example.com', 'Vary' => 'Origin')
-  end
-
-  it 'supports a shared rate-limit store interface' do
-    Dir.mktmpdir do |directory|
-      store = Class.new do
-        attr_reader :writes
-
-        def initialize
-          @counts = Hash.new(0)
-          @writes = []
-        end
-
-        def increment(key, amount, expires_in:)
-          @writes << [key, expires_in]
-          @counts[key] += amount
-        end
-      end.new
-
-      handler = described_class.new(
-        project_mode: :local_only,
-        project_token: 'dbundle_proj_server',
-        local_events_dir: directory,
-        rate_limit_per_minute: 1,
-        rate_limit_store: store
-      )
-
-      request = {
-        method: 'POST',
-        headers: {
-          'host' => 'app.example.com',
-          'origin' => 'https://app.example.com',
-          'content-type' => 'application/json'
-        },
-        body: JSON.generate('batch' => [browser_event]),
-        ip_address: '127.0.0.1'
-      }
-
-      expect(handler.handle(request).status).to eq(202)
-      expect(handler.handle(request).status).to eq(429)
-      expect(store.writes.length).to eq(2)
-    end
-  end
-
-  it 'writes durable spool files and forwards connected events' do
-    Dir.mktmpdir do |directory|
-      forwarded = []
-      transport = Class.new do
-        define_method(:initialize) do |forwarded|
-          @forwarded = forwarded
-        end
-
-        define_method(:call) do |request|
-          @forwarded << request
-          DebugBundle::Transport::Result.new(status_code: 202)
-        end
-      end.new(forwarded)
-
-      handler = described_class.new(
-        project_mode: :connected,
-        project_token: 'dbundle_proj_server',
-        spool_dir: directory,
-        forward_transport: transport
-      )
-
-      response = handler.handle(
-        method: 'POST',
-        headers: {
-          'host' => 'app.example.com',
-          'origin' => 'https://app.example.com',
-          'content-type' => 'application/json'
-        },
-        body: JSON.generate('batch' => [browser_event]),
-        ip_address: '127.0.0.1'
-      )
-
-      expect(response.status).to eq(202)
-      expect(Dir.children(directory).any? { |entry| entry.end_with?('.events.json') }).to be(true)
-      expect(forwarded.length).to eq(1)
-      expect(forwarded.fetch(0).fetch(:project_token)).to eq('dbundle_proj_server')
-    end
-  end
-
-  it 'exposes a Rack relay adapter' do
-    Dir.mktmpdir do |directory|
-      middleware = DebugBundle::Rack::RelayMiddleware.new(
-        nil,
-        handler: described_class.new(project_mode: :local_only, project_token: 'dbundle_proj_server',
-                                     local_events_dir: directory)
-      )
-
-      status, headers, body = middleware.call(
-        'REQUEST_METHOD' => 'POST',
-        'HTTP_HOST' => 'app.example.com',
-        'HTTP_ORIGIN' => 'https://app.example.com',
-        'CONTENT_TYPE' => 'application/json',
-        'REMOTE_ADDR' => '127.0.0.1',
-        'rack.input' => StringIO.new(JSON.generate('batch' => [browser_event]))
-      )
-
-      expect(status).to eq(202)
-      expect(headers).to include('Content-Type' => 'application/json')
-      expect(headers).to include('Access-Control-Allow-Origin' => 'https://app.example.com')
-      expect(JSON.parse(body.fetch(0))).to include('accepted' => 1)
-    end
-  end
-
-  it 'exposes Rack preflight headers' do
-    middleware = DebugBundle::Rack::RelayMiddleware.new(
-      nil,
-      handler: described_class.new(project_mode: :local_only, project_token: 'dbundle_proj_server',
-                                   allowed_origins: ['https://web.example.com'])
-    )
-
-    status, headers, body = middleware.call(
-      'REQUEST_METHOD' => 'OPTIONS',
-      'HTTP_HOST' => 'api.example.com',
-      'HTTP_ORIGIN' => 'https://web.example.com',
-      'HTTP_ACCESS_CONTROL_REQUEST_METHOD' => 'POST',
-      'REMOTE_ADDR' => '127.0.0.1',
-      'rack.input' => StringIO.new('')
-    )
-
-    expect(status).to eq(204)
-    expect(headers).to include('Access-Control-Allow-Origin' => 'https://web.example.com')
-    expect(body.fetch(0)).to eq('')
-  end
-end

data/spec/remote_config_spec.rb

@@ -1,80 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-RSpec.describe DebugBundle::RemoteConfig do
-  it 'matches directives by expiry, scope, exact labels, wildcard labels, and prefixes' do
-    now = Time.iso8601('2026-07-27T08:00:00Z')
-    directive = described_class::Directive.new(
-      id: 'directive',
-      label_pattern: 'checkout.*',
-      service: 'checkout',
-      environment: '*',
-      expires_at: now + 60
-    )
-
-    expect(directive.active?(label: 'checkout', service: 'checkout', environment: 'test', now: now)).to be(true)
-    expect(directive.active?(label: 'checkout.total', service: 'checkout', environment: 'test', now: now)).to be(true)
-    expect(directive.active?(label: 'cart.total', service: 'checkout', environment: 'test', now: now)).to be(false)
-    expect(directive.active?(label: 'checkout.total', service: 'orders', environment: 'test', now: now)).to be(false)
-    expect(
-      directive.active?(label: 'checkout.total', service: 'checkout', environment: 'test', now: now + 61)
-    ).to be(false)
-
-    wildcard = directive.dup
-    wildcard.label_pattern = '*'
-    wildcard.service = '*'
-    expect(wildcard.active?(label: 'anything', service: 'orders', environment: 'test', now: now)).to be(true)
-  end
-
-  it 'parses policy, probe directives, polling, and symbol-key fallbacks' do
-    snapshot = described_class.parse(
-      {
-        probes_enabled: false,
-        remote_probes_enabled: true,
-        poll_interval_ms: 500,
-        trigger_token_key: 'key',
-        capture_policy: {
-          preset: 'investigative',
-          immediate_client_error_statuses: [409, '422'],
-          immediate_client_error_path_rules: [
-            { status_code: 422, path_pattern: '/checkout/*', methods: %w[post POST] }
-          ]
-        },
-        active_probes: [
-          {
-            id: 'directive',
-            label_pattern: 'checkout.*',
-            expires_at: '2026-07-27T09:00:00Z'
-          },
-          { id: 'invalid', expires_at: 'invalid' }
-        ]
-      },
-      60
-    )
-
-    expect(snapshot.probes_enabled).to be(false)
-    expect(snapshot.remote_probes_enabled).to be(true)
-    expect(snapshot.poll_interval_seconds).to eq(1)
-    expect(snapshot.directives.length).to eq(1)
-    expect(snapshot.capture_policy.immediate_client_error_statuses).to eq([409])
-    expect(snapshot.capture_policy.immediate_client_error_path_rules.first.http_methods).to eq(['POST'])
-  end
-
-  it 'rejects malformed directives and path-rule bounds' do
-    expect(described_class.parse(nil, 60)).to be_nil
-    expect(described_class.parse_capture_policy(nil)).to be_nil
-    expect(described_class.parse_directive(nil)).to be_nil
-    expect(described_class.parse_time(nil)).to be_nil
-    expect(described_class.parse_time('bad')).to be_nil
-    expect(described_class.valid_path_pattern?('relative')).to be(false)
-    expect(described_class.valid_path_pattern?('/path?query')).to be(false)
-    expect(described_class.valid_path_pattern?('/bad/*/suffix')).to be(false)
-    expect(described_class.parse_immediate_client_error_path_rules(Array.new(26, {}))).to eq([])
-    expect(
-      described_class.parse_immediate_client_error_path_rules(
-        [{ status_code: 500, path_pattern: '/bad', methods: ['TRACE'] }]
-      )
-    ).to eq([])
-  end
-end

data/spec/repository_metadata_spec.rb

@@ -1,65 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-RSpec.describe 'repository metadata' do
-  let(:repo_root) { File.expand_path('..', __dir__) }
-
-  def read_repository_file(path)
-    File.read(File.join(repo_root, path))
-  end
-
-  it 'ships the smoke harness and wires it into workflows' do
-    %w[
-      Makefile
-      smoke/run_app_driven_smoke.rb
-      smoke/app_driven_smoke_runner.rb
-      .github/workflows/ci.yml
-      .github/workflows/release.yml
-    ].each do |relative_path|
-      expect(File).to exist(File.join(repo_root, relative_path))
-    end
-
-    makefile = read_repository_file('Makefile')
-    ci_workflow = read_repository_file('.github/workflows/ci.yml')
-    release_workflow = read_repository_file('.github/workflows/release.yml')
-
-    [
-      '.PHONY: smoke',
-      '.PHONY: smoke-published',
-      'smoke/run_app_driven_smoke.rb --source local',
-      'smoke/run_app_driven_smoke.rb --source published --version $(VERSION)'
-    ].each do |fragment|
-      expect(makefile).to include(fragment)
-    end
-
-    expect(ci_workflow).to include('make smoke')
-    expect(release_workflow).to include('make smoke')
-    expect(release_workflow).to include('make smoke-published VERSION=${RELEASE_VERSION}')
-  end
-
-  it 'documents the Ruby release documentation gates in the README' do
-    readme = read_repository_file('README.md')
-
-    [
-      '## Configuration Reference',
-      'Configuration sources and precedence:',
-      'Capture-policy fields are server-owned',
-      '## Install Examples by Mode',
-      '## Runtime and Framework Support',
-      '## Dependency Alignment',
-      '## Browser Relay',
-      '## Service Naming',
-      '## Safe Startup and Status',
-      '## First-Event Verification',
-      'make smoke',
-      'same-origin',
-      'allowed origins',
-      'rate limiting',
-      'credential isolation',
-      'missing token'
-    ].each do |fragment|
-      expect(readme).to include(fragment)
-    end
-  end
-end

data/spec/sidekiq_integration_spec.rb

@@ -1,66 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-begin
-  require 'sidekiq'
-rescue LoadError
-  nil
-end
-
-if defined?(Sidekiq)
-  RSpec.describe 'Sidekiq integration' do
-    let(:transport_events) { [] }
-    let(:transport) do
-      Class.new do
-        define_method(:initialize) do |transport_events|
-          @transport_events = transport_events
-        end
-
-        define_method(:call) do |request|
-          @transport_events << request
-          DebugBundle::Transport::Result.new(status_code: 202)
-        end
-      end.new(transport_events)
-    end
-
-    it 'registers and executes through the Sidekiq middleware chain' do
-      client = DebugBundle::Client.new(project_token: 'dbundle_proj_test', transport: transport)
-      chain = Sidekiq::Middleware::Chain.new
-      job = {
-        'class' => 'CheckoutWorker',
-        'queue' => 'critical',
-        'jid' => 'jid-chain-1',
-        'retry_count' => 1,
-        'args' => [{ 'charge_id' => 'ch_123' }],
-        'trace_id' => 'trace-chain-1'
-      }
-
-      chain.add(DebugBundle::Sidekiq::ServerMiddleware, client: client)
-
-      expect(chain.entries.map(&:klass)).to include(DebugBundle::Sidekiq::ServerMiddleware)
-      expect do
-        chain.invoke(Object.new, job, 'critical') do
-          raise 'chain failure'
-        end
-      end.to raise_error(RuntimeError, 'chain failure')
-
-      client.flush
-      event = transport_events.fetch(0).fetch(:events).fetch(0)
-
-      expect(event.fetch('event_type')).to eq('backend_exception')
-      expect(event.fetch('correlation')).to include('trace_id' => 'trace-chain-1')
-      expect(event.fetch('context').fetch('job')).to include(
-        'class' => 'CheckoutWorker',
-        'queue' => 'critical',
-        'jid' => 'jid-chain-1'
-      )
-    end
-  end
-else
-  RSpec.describe 'Sidekiq integration' do
-    it 'requires the sidekiq gem for integration validation' do
-      skip 'sidekiq gem not installed'
-    end
-  end
-end