forge_ops_tracker 0.18.0 → 0.19.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e9434056bed332dad65c4a8dc051bace54e7acae535043138833f60ba2586cb0
-  data.tar.gz: 270cec5a96267fc7d1a41be7c02ab1bfdb9271fb2d7a5e8ae91581a0181848d0
+  metadata.gz: a07d319688ef560a28c82ff70a822a2a171d1fe9d4c47973d51093e528e548e2
+  data.tar.gz: 6272b6ee64197d04a056a7d34ac4fe5de069be87dea1992f32d30700164ab95a
 SHA512:
-  metadata.gz: 34730c4a7e8af87adb9bdaf490d72d923a0bb96b958a9131c28671d3198a43638dc5f13a2331c92b3d1dd506d24b08b6118d6d0559e4c64d5b12b231a0a8c97c
-  data.tar.gz: 0a9704a43c0c74397e082ab191deab1895de0d17210469b5906c123c33cfd7fe9130992ee10932106a093c4d6c329dadca6ca59da16f46173a063395e0eb7b9c
+  metadata.gz: dfe88a94c2008f6ee5af0f47581322647a90253d4d25a2a768e6bfb6bfd759766c15c81315ffb4b030dfd593f893a924ec8c6b7b4be71ad77ff825086c1fc998
+  data.tar.gz: 6f087c6828f7a8d45d895d9e26749337dd6683247021187b89281065c5d10e838eb9de985a3fc15aaac2b9a023eceefbc3e7a50878738f13e318bba55390e77e

data/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.19.1 (2026-10-22)
+
+- Strict privacy now also turns off slow query plans (`explain_slow_queries`): no EXPLAIN is run and no
+  plan is sent, since a plan carries the SQL. Before, a plan could still be sent, with its values masked.
+- The README says what strict privacy does in its opening lines.
+- The source is public at https://github.com/Luke-Popwell/forge-ops-tracker-ruby, and the package links to it.
+
+## 0.19.0 (2026-10-20)
+
+- Strict privacy: a raw request path now keeps only its first segment, and the rest is sent as
+  `:path` (`/patients/jane-doe/12` becomes `/patients/:path`; a first segment with a digit or over
+  40 characters becomes `:id`). Before, only segments holding a digit were replaced, so a path like
+  `/patients/janedoe` went out whole. A route template (`/patients/:id/notes`, `{id}`, `<int:id>`,
+  `[slug]`, `*path`) is kept as it is. This applies everywhere strict privacy names a request or a
+  call by its path: span names and transaction names.
+
 ## 0.18.0 (2026-10-20)
 
 - New `config.strict_privacy` (off by default, or `FORGE_OPS_STRICT_PRIVACY=true`) for apps that

data/README.md

@@ -3,6 +3,8 @@
 Exception reporting client for [ForgeOps](https://getforgeops.net), for Rails, plain Rack and
 Sinatra apps, and scripts.
 
+> For health or personal data, turn on [strict privacy](#strict-privacy): the SDK then sends only structured facts about each error (its type, stack trace, release and route), never the message, a raw path, breadcrumbs, or context you haven't allowed.
+
 ## Installation
 
 ```ruby
@@ -243,8 +245,10 @@ name, an email or a diagnosis:
 - Context and tags only keep the top-level keys you list in `privacy_allowed_fields`, and only
   when the value is a string, number or boolean. Nothing else from them is sent.
 - Failed jobs and outbound calls keep their error class, never their error message.
-- A `transaction_name` that is a raw path rather than a route or `Controller#action` has its ids
-  taken out (`GET /patients/:id`), in error events, performance samples and failure events alike.
+- A `transaction_name` that is a raw path rather than a route or `Controller#action` keeps only
+  its first segment (`GET /patients/jane-doe/12` is sent as `GET /patients/:path`; a first
+  segment with a digit becomes `:id`), in error events, performance samples, failure events and
+  spans alike. A route template such as `/patients/:id/notes` is kept as it is.
 - Outbound HTTP spans are named by method and host only (`GET api.example.com`), and span data
   keeps only the masked `db.statement` and `db.system`.
 

data/lib/forge_ops_tracker/performance_flusher.rb

@@ -31,7 +31,8 @@ module ForgeOpsTracker
     # without colliding into the same bucket.
     def record(transaction_name:, duration_ms:, kind: "controller")
       ensure_worker_started
-      # Under strict privacy a raw-path name loses its ids; a route or Controller#action is kept.
+      # Under strict privacy a raw-path name keeps only its first segment; a route or
+      # Controller#action is kept.
       transaction_name = StrictPrivacy.transaction_name(transaction_name) if configuration.strict_privacy
 
       @mutex.synchronize do

data/lib/forge_ops_tracker/query_explainer.rb

@@ -98,7 +98,8 @@ module ForgeOpsTracker
     # checks first, so a fast query costs one comparison. Returns true only when an EXPLAIN was
     # queued; never raises.
     def consider(payload, duration_ms:)
-      return false unless configuration.explain_slow_queries
+      # Strict privacy sends no SQL at all, masked or not (sdks/STRICT_PRIVACY.md).
+      return false unless configuration.explain_slow_queries && !configuration.strict_privacy
       return false unless duration_ms && duration_ms >= configuration.explain_threshold_ms.to_f
 
       connection = payload[:connection]

data/lib/forge_ops_tracker/strict_privacy.rb

@@ -26,6 +26,7 @@ module ForgeOpsTracker
     SPAN_DATA_KEYS = %w[db.statement db.system].freeze
     HTTP_METHOD = /\A(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\s+(\S+)/i
     SCHEME = %r{\A[a-z][a-z0-9+.-]*://}i
+    ROUTE_PARAMETER = /\A(?::.+|\{.+\}|<.+>|\[.+\]|\*.*)\z/
 
     # Error event fields that are never sent, and the per-frame source context.
     EVENT_FIELDS_DROPPED = %i[message breadcrumbs endpoint sql_statement].freeze
@@ -83,23 +84,24 @@ module ForgeOpsTracker
 
     # "GET https://api.example.com/patients/42?x=1" or "GET api.example.com/patients/42" becomes
     # "GET api.example.com". A bare path ("/patients/42"), or a method and a path
-    # ("PUT /orders/17/items"), has its ids taken out, like a page path. A name that's neither
+    # ("PUT /orders/17/items"), goes through the path rule, like a page path. A name that's neither
     # ("OrdersController#create", "patients#show") is kept.
     def span_name(name)
-      return path_without_ids(name) if name.to_s.start_with?("/")
+      return strict_path(name) if name.to_s.start_with?("/")
 
       match = name.to_s.match(HTTP_METHOD)
       return name unless match
 
       method = match[1].upcase
       target = match[2]
-      return "#{method} #{path_without_ids(target)}" if target.start_with?("/")
+      return "#{method} #{strict_path(target)}" if target.start_with?("/")
 
-      "#{method} #{host(target) || path_without_ids(target)}"
+      "#{method} #{host(target) || strict_path(target)}"
     end
 
     # Which request something happened in: a route or a controller action is kept, but a raw path
-    # (what a request no route matched falls back to) has its ids stripped, by the span name rule.
+    # (what a request no route matched falls back to) keeps only its first segment, by the span name
+    # rule.
     def transaction_name(name)
       name.nil? || name.to_s.empty? ? name : span_name(name)
     end
@@ -119,14 +121,28 @@ module ForgeOpsTracker
       host if scheme || port || host.include?(".") || host.casecmp?("localhost")
     end
 
-    # A path with every segment that holds a digit, or is long enough to be a token or a name
-    # slug, replaced by ":id"; no query or fragment. "/patients/42/notes?q=x" is "/patients/:id/notes".
-    def path_without_ids(path)
-      segments = path.to_s.split(/[?#]/).first.to_s.split("/").map do |segment|
-        segment.match?(/\d/) || segment.length > 40 ? ":id" : segment
-      end
-      joined = segments.join("/")
-      joined.empty? ? "/" : joined
+    # A request or page path under strict privacy, with no query or fragment. A route template
+    # ("/patients/:id/notes", "/patients/{id}", "users/<int:id>/", "/files/*path", "/posts/[slug]")
+    # is kept as it is: its words are a developer's, and its parameters are already placeholders. A
+    # raw path keeps only its first segment, and the rest becomes ":path": "/patients/jane-doe/12"
+    # is "/patients/:path". Anything after the first segment of a raw path could name a person, and
+    # no rule can tell a name from a word ("/patients/janedoe"). A first segment that holds a digit
+    # or is over 40 characters is ":id" itself.
+    def strict_path(path)
+      path = path.to_s.split(/[?#]/, 2).first.to_s
+      return path if route_template?(path)
+
+      leading = path.start_with?("/") ? "/" : ""
+      segments = path.split("/").reject(&:empty?)
+      return "/" if segments.empty?
+
+      first = segments.first.match?(/[0-9]/) || segments.first.length > 40 ? ":id" : segments.first
+      "#{leading}#{first}#{"/:path" if segments.size > 1}"
+    end
+
+    # Whether any segment is a route parameter: ":id", "{id}", "<int:id>", "[slug]" or "*path".
+    def route_template?(path)
+      path.split("/").any? { |segment| segment.match?(ROUTE_PARAMETER) }
     end
 
     # Only top-level keys named in allowed_fields, and only plain values under them; nil (left out

data/lib/forge_ops_tracker/version.rb

@@ -1,3 +1,3 @@
 module ForgeOpsTracker
-  VERSION = "0.18.0"
+  VERSION = "0.19.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: forge_ops_tracker
 version: !ruby/object:Gem::Version
-  version: 0.18.0
+  version: 0.19.1
 platform: ruby
 authors:
 - ForgeOps
@@ -147,6 +147,8 @@ licenses:
 metadata:
   homepage_uri: https://getforgeops.net
   rubygems_mfa_required: 'true'
+  source_code_uri: https://github.com/Luke-Popwell/forge-ops-tracker-ruby
+  changelog_uri: https://github.com/Luke-Popwell/forge-ops-tracker-ruby/blob/main/CHANGELOG.md
 rdoc_options: []
 require_paths:
 - lib