forge_ops_tracker 0.18.0 → 0.19.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e9434056bed332dad65c4a8dc051bace54e7acae535043138833f60ba2586cb0
-  data.tar.gz: 270cec5a96267fc7d1a41be7c02ab1bfdb9271fb2d7a5e8ae91581a0181848d0
+  metadata.gz: 3d585c1acbde6c8bb06ec05505e21bf4d784974ed8e655c9398fef0c7e595d03
+  data.tar.gz: af67478c90a33dd594bbccf712e48dc817d5e99ae6b61edf0a0fca62e816e4ec
 SHA512:
-  metadata.gz: 34730c4a7e8af87adb9bdaf490d72d923a0bb96b958a9131c28671d3198a43638dc5f13a2331c92b3d1dd506d24b08b6118d6d0559e4c64d5b12b231a0a8c97c
-  data.tar.gz: 0a9704a43c0c74397e082ab191deab1895de0d17210469b5906c123c33cfd7fe9130992ee10932106a093c4d6c329dadca6ca59da16f46173a063395e0eb7b9c
+  metadata.gz: ae806f1ba9cb14102494df6f6efca7685ce4900c281fda85c72fe9ad595f5ce3b03b7daf74762ef69de002e0c229d3155027eee4bd3c8d876646b824f4ee1ab4
+  data.tar.gz: b774e7abc22663d23f728c71ee7d358180994ccc31b23eb334d393c39da7d403561456b4b484bbe34f3f1678c7f619a40ac94c977a4086ccac66f852790cdb85

data/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.19.0 (2026-10-20)
+
+- Strict privacy: a raw request path now keeps only its first segment, and the rest is sent as
+  `:path` (`/patients/jane-doe/12` becomes `/patients/:path`; a first segment with a digit or over
+  40 characters becomes `:id`). Before, only segments holding a digit were replaced, so a path like
+  `/patients/janedoe` went out whole. A route template (`/patients/:id/notes`, `{id}`, `<int:id>`,
+  `[slug]`, `*path`) is kept as it is. This applies everywhere strict privacy names a request or a
+  call by its path: span names and transaction names.
+
 ## 0.18.0 (2026-10-20)
 
 - New `config.strict_privacy` (off by default, or `FORGE_OPS_STRICT_PRIVACY=true`) for apps that

data/README.md

@@ -243,8 +243,10 @@ name, an email or a diagnosis:
 - Context and tags only keep the top-level keys you list in `privacy_allowed_fields`, and only
   when the value is a string, number or boolean. Nothing else from them is sent.
 - Failed jobs and outbound calls keep their error class, never their error message.
-- A `transaction_name` that is a raw path rather than a route or `Controller#action` has its ids
-  taken out (`GET /patients/:id`), in error events, performance samples and failure events alike.
+- A `transaction_name` that is a raw path rather than a route or `Controller#action` keeps only
+  its first segment (`GET /patients/jane-doe/12` is sent as `GET /patients/:path`; a first
+  segment with a digit becomes `:id`), in error events, performance samples, failure events and
+  spans alike. A route template such as `/patients/:id/notes` is kept as it is.
 - Outbound HTTP spans are named by method and host only (`GET api.example.com`), and span data
   keeps only the masked `db.statement` and `db.system`.
 

data/lib/forge_ops_tracker/performance_flusher.rb

@@ -31,7 +31,8 @@ module ForgeOpsTracker
     # without colliding into the same bucket.
     def record(transaction_name:, duration_ms:, kind: "controller")
       ensure_worker_started
-      # Under strict privacy a raw-path name loses its ids; a route or Controller#action is kept.
+      # Under strict privacy a raw-path name keeps only its first segment; a route or
+      # Controller#action is kept.
       transaction_name = StrictPrivacy.transaction_name(transaction_name) if configuration.strict_privacy
 
       @mutex.synchronize do

data/lib/forge_ops_tracker/strict_privacy.rb

@@ -26,6 +26,7 @@ module ForgeOpsTracker
     SPAN_DATA_KEYS = %w[db.statement db.system].freeze
     HTTP_METHOD = /\A(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\s+(\S+)/i
     SCHEME = %r{\A[a-z][a-z0-9+.-]*://}i
+    ROUTE_PARAMETER = /\A(?::.+|\{.+\}|<.+>|\[.+\]|\*.*)\z/
 
     # Error event fields that are never sent, and the per-frame source context.
     EVENT_FIELDS_DROPPED = %i[message breadcrumbs endpoint sql_statement].freeze
@@ -83,23 +84,24 @@ module ForgeOpsTracker
 
     # "GET https://api.example.com/patients/42?x=1" or "GET api.example.com/patients/42" becomes
     # "GET api.example.com". A bare path ("/patients/42"), or a method and a path
-    # ("PUT /orders/17/items"), has its ids taken out, like a page path. A name that's neither
+    # ("PUT /orders/17/items"), goes through the path rule, like a page path. A name that's neither
     # ("OrdersController#create", "patients#show") is kept.
     def span_name(name)
-      return path_without_ids(name) if name.to_s.start_with?("/")
+      return strict_path(name) if name.to_s.start_with?("/")
 
       match = name.to_s.match(HTTP_METHOD)
       return name unless match
 
       method = match[1].upcase
       target = match[2]
-      return "#{method} #{path_without_ids(target)}" if target.start_with?("/")
+      return "#{method} #{strict_path(target)}" if target.start_with?("/")
 
-      "#{method} #{host(target) || path_without_ids(target)}"
+      "#{method} #{host(target) || strict_path(target)}"
     end
 
     # Which request something happened in: a route or a controller action is kept, but a raw path
-    # (what a request no route matched falls back to) has its ids stripped, by the span name rule.
+    # (what a request no route matched falls back to) keeps only its first segment, by the span name
+    # rule.
     def transaction_name(name)
       name.nil? || name.to_s.empty? ? name : span_name(name)
     end
@@ -119,14 +121,28 @@ module ForgeOpsTracker
       host if scheme || port || host.include?(".") || host.casecmp?("localhost")
     end
 
-    # A path with every segment that holds a digit, or is long enough to be a token or a name
-    # slug, replaced by ":id"; no query or fragment. "/patients/42/notes?q=x" is "/patients/:id/notes".
-    def path_without_ids(path)
-      segments = path.to_s.split(/[?#]/).first.to_s.split("/").map do |segment|
-        segment.match?(/\d/) || segment.length > 40 ? ":id" : segment
-      end
-      joined = segments.join("/")
-      joined.empty? ? "/" : joined
+    # A request or page path under strict privacy, with no query or fragment. A route template
+    # ("/patients/:id/notes", "/patients/{id}", "users/<int:id>/", "/files/*path", "/posts/[slug]")
+    # is kept as it is: its words are a developer's, and its parameters are already placeholders. A
+    # raw path keeps only its first segment, and the rest becomes ":path": "/patients/jane-doe/12"
+    # is "/patients/:path". Anything after the first segment of a raw path could name a person, and
+    # no rule can tell a name from a word ("/patients/janedoe"). A first segment that holds a digit
+    # or is over 40 characters is ":id" itself.
+    def strict_path(path)
+      path = path.to_s.split(/[?#]/, 2).first.to_s
+      return path if route_template?(path)
+
+      leading = path.start_with?("/") ? "/" : ""
+      segments = path.split("/").reject(&:empty?)
+      return "/" if segments.empty?
+
+      first = segments.first.match?(/[0-9]/) || segments.first.length > 40 ? ":id" : segments.first
+      "#{leading}#{first}#{"/:path" if segments.size > 1}"
+    end
+
+    # Whether any segment is a route parameter: ":id", "{id}", "<int:id>", "[slug]" or "*path".
+    def route_template?(path)
+      path.split("/").any? { |segment| segment.match?(ROUTE_PARAMETER) }
     end
 
     # Only top-level keys named in allowed_fields, and only plain values under them; nil (left out

data/lib/forge_ops_tracker/version.rb

@@ -1,3 +1,3 @@
 module ForgeOpsTracker
-  VERSION = "0.18.0"
+  VERSION = "0.19.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: forge_ops_tracker
 version: !ruby/object:Gem::Version
-  version: 0.18.0
+  version: 0.19.0
 platform: ruby
 authors:
 - ForgeOps