logstruct 0.1.12 → 0.2.1

data/lib/log_struct/concerns/configuration.rb

@@ -1,18 +1,25 @@
 # typed: strict
 # frozen_string_literal: true
 
+require "active_support/parameter_filter"
+require "active_support/core_ext/object/duplicable"
 require_relative "../configuration"
 
 module LogStruct
   module Concerns
-    # Concern for handling errors according to configured modes
+    # LogStruct.configure, whether LogStruct is on in this process, and merging Rails' filter_parameters
     module Configuration
       module ClassMethods
         extend T::Sig
 
         CONSOLE_COMMAND_ARGS = T.let(["console", "c"].freeze, T::Array[String])
         EMPTY_ARGV = T.let([].freeze, T::Array[String])
-        CI_FALSE_VALUES = T.let(["false", "0", "no"].freeze, T::Array[String])
+        RAILS_PATTERNS_LABEL = "Rails filter_parameters"
+        RAILS_REGEXPS_LABEL = "Rails filter_parameters (Regexps)"
+        RAILS_PATHS_LABEL = "Rails filter_parameters (paths)"
+        RAILS_PATTERN_LABELS = T.let([RAILS_PATTERNS_LABEL, RAILS_REGEXPS_LABEL].freeze, T::Array[String])
+        RAILS_FILTER_MASK = "[FILTERED]"
+        RAILS_FILTER_PROBE = "value"
 
         sig { params(block: T.proc.params(config: LogStruct::Configuration).void).void }
         def configure(&block)
@@ -43,26 +50,34 @@ module LogStruct
 
         sig { void }
         def set_enabled_from_rails_env!
-          # Set enabled based on current Rails environment and the LOGSTRUCT_ENABLED env var.
-          # Precedence:
-          # 1. Check if LOGSTRUCT_ENABLED env var is defined (not an empty string)
-          #    - Sets enabled=true only when value is "true", "yes", "1", etc.
-          #    - Sets enabled=false when value is any other value
-          # 2. Otherwise, check if current Rails environment is in enabled_environments
-          #    AND one of: Rails::Server is defined, OR test environment with CI=true
-          #    BUT NOT Rails::Console (to exclude interactive console)
-          # 3. Otherwise, leave as config.enabled (defaults to true)
-
-          # Then check if LOGSTRUCT_ENABLED env var is set
-          config.enabled = if ENV["LOGSTRUCT_ENABLED"]
-            %w[true t yes y 1].include?(ENV["LOGSTRUCT_ENABLED"]&.strip&.downcase)
-          else
+          # 1. When LOGSTRUCT_ENABLED is set, it decides: on for true, t, yes, y or 1, off for anything else.
+          # 2. Otherwise LogStruct is on when the Rails environment is in enabled_environments, the process
+          #    isn't a console, and it's a server (server_process?) or runs in the test environment.
+          env_var_enabled = enabled_from_env_var
+          config.enabled = if env_var_enabled.nil?
             is_console = console_process?
             is_server = server_process?
-            ci_build?
             in_enabled_env = config.enabled_environments.include?(::Rails.env.to_sym)
 
             in_enabled_env && !is_console && (is_server || ::Rails.env.test?)
+          else
+            env_var_enabled
+          end
+
+          # apply_initializer_settings! compares the settings with these
+          @enabled_from_rails_env = T.let(config.enabled, T.nilable(T::Boolean))
+          @enabled_environments_from_rails_env = T.let(config.enabled_environments.dup, T.nilable(T::Array[Symbol]))
+        end
+
+        # After config/initializers run: LOGSTRUCT_ENABLED takes precedence, then `config.enabled`
+        # if an initializer changed it, then `config.enabled_environments` if an initializer changed that
+        sig { void }
+        def apply_initializer_settings!
+          env_var_enabled = enabled_from_env_var
+          if !env_var_enabled.nil?
+            config.enabled = env_var_enabled
+          elsif config.enabled == @enabled_from_rails_env && config.enabled_environments != @enabled_environments_from_rails_env
+            set_enabled_from_rails_env!
           end
         end
 
@@ -84,44 +99,50 @@ module LogStruct
           return unless rails_filter_params.is_a?(Array)
           return if rails_filter_params.empty?
 
-          symbol_filters = T.let([], T::Array[Symbol])
-          matchers = T.let([], T::Array[ConfigStruct::FilterMatcher])
-          leftovers = T.let([], T::Array[T.untyped])
-
-          rails_filter_params.each do |entry|
-            matcher = build_filter_matcher(entry)
+          blocks, patterns = rails_filter_params.partition { |entry| callable_filter?(entry) }
+          # Rails matches entries with a dot against a key's path (user.password), and the rest against the key
+          path_patterns, key_patterns = patterns.partition { |entry| path_pattern?(entry) }
+          regexps, partial_names = key_patterns.partition { |entry| entry.is_a?(Regexp) }
+          # Rails gives blocks with any arity but 2 the parameters as a third argument
+          path_blocks, key_blocks = blocks.partition { |block| arity_for_filter(block) == 3 }
 
-            if matcher
-              matchers << matcher
-              next
-            end
-
-            normalized_symbol = normalize_filter_symbol(entry)
-            if normalized_symbol
-              symbol_filters << normalized_symbol
-            else
-              leftovers << entry
-            end
+          matchers = key_blocks.map { |block| build_callable_filter_matcher(block) }
+          if partial_names.any?
+            matchers << build_rails_pattern_matcher(partial_names, label: RAILS_PATTERNS_LABEL, matches_logstruct_fields: false)
           end
-
-          if symbol_filters.any?
-            config.filters.filter_keys |= symbol_filters
+          if regexps.any?
+            matchers << build_rails_pattern_matcher(regexps, label: RAILS_REGEXPS_LABEL, matches_logstruct_fields: true)
           end
-
-          if matchers.any?
-            matchers.each do |matcher|
-              existing = config.filters.filter_matchers.any? do |registered|
-                registered.label == matcher.label
-              end
-              config.filters.filter_matchers << matcher unless existing
-            end
+          path_matchers = path_blocks.map { |block| build_path_block_matcher(block) }
+          path_matchers << build_rails_path_matcher(path_patterns) if path_patterns.any?
+
+          # Exact names also filter LogStruct's own fields, which the partial matches skip
+          names = key_patterns.filter_map { |entry| entry.to_s.downcase.to_sym if entry.is_a?(Symbol) || entry.is_a?(String) }
+          config.filters.filter_keys |= names
+
+          # The latest list replaces the patterns merged before
+          registered = config.filters.filter_matchers
+          registered.reject! { |matcher| RAILS_PATTERN_LABELS.include?(matcher.label) }
+          matchers.each do |matcher|
+            registered << matcher unless registered.any? { |existing| existing.label == matcher.label }
+          end
+          registered_paths = config.filters.path_matchers
+          registered_paths.reject! { |matcher| matcher.label == RAILS_PATHS_LABEL }
+          path_matchers.each do |matcher|
+            registered_paths << matcher unless registered_paths.any? { |existing| existing.label == matcher.label }
           end
-
-          replace_filter_parameters(rails_filter_params, leftovers)
         end
 
         private
 
+        sig { returns(T.nilable(T::Boolean)) }
+        def enabled_from_env_var
+          value = ENV["LOGSTRUCT_ENABLED"]
+          return nil if value.nil?
+
+          %w[true t yes y 1].include?(value.strip.downcase)
+        end
+
         sig { returns(T::Boolean) }
         def console_process?
           return true if defined?(::Rails::Console)
@@ -138,6 +159,7 @@ module LogStruct
           return true if defined?(::Falcon::Server)
           return true if defined?(::Rails::Server)
           return true if sidekiq_server?
+          return true if good_job_cli?
 
           false
         end
@@ -158,6 +180,12 @@ module LogStruct
           !!(defined?(::Sidekiq) && ::Sidekiq.respond_to?(:server?) && ::Sidekiq.server?)
         end
 
+        # GoodJob's executable (`good_job start`) sets within_exe before it loads the app
+        sig { returns(T::Boolean) }
+        def good_job_cli?
+          !!(defined?(::GoodJob::CLI) && ::GoodJob::CLI.respond_to?(:within_exe?) && ::GoodJob::CLI.within_exe?)
+        end
+
         sig { returns(T::Boolean) }
         def logstruct_server_mode?
           ::LogStruct.server_mode?
@@ -172,55 +200,81 @@ module LogStruct
           EMPTY_ARGV
         end
 
-        sig { returns(T::Boolean) }
-        def ci_build?
-          value = ENV["CI"]
-          return false if value.nil?
-
-          normalized = value.strip.downcase
-          return false if normalized.empty?
-
-          !CI_FALSE_VALUES.include?(normalized)
+        # Rails matches Symbols and Strings as case-insensitive substrings (:passw filters
+        # "user_password") and Regexps as they are. Entries with a dot match a key by its path
+        # instead (build_rails_path_matcher).
+        #
+        # The substring matches skip LogStruct's own fields (Rails' :_key would hide GoodJob's
+        # cron_key); their exact names are added to filter_keys instead. A Regexp says exactly
+        # what it matches, so Regexps apply to every key, LogStruct's fields included.
+        sig { params(patterns: T::Array[T.untyped], label: String, matches_logstruct_fields: T::Boolean).returns(ConfigStruct::FilterMatcher) }
+        def build_rails_pattern_matcher(patterns, label:, matches_logstruct_fields:)
+          parameter_filter = ::ActiveSupport::ParameterFilter.new(patterns, mask: RAILS_FILTER_MASK)
+          callable = Kernel.lambda do |key, _value|
+            parameter_filter.filter_param(key, RAILS_FILTER_PROBE) == RAILS_FILTER_MASK
+          end
+          ConfigStruct::FilterMatcher.new(callable: callable, label: label, matches_logstruct_fields: matches_logstruct_fields)
         end
 
-        sig { params(filter: T.untyped).returns(T.nilable(Symbol)) }
-        def normalize_filter_symbol(filter)
-          return filter if filter.is_a?(Symbol)
-          return filter.downcase.to_sym if filter.is_a?(String)
-
-          return nil unless filter.respond_to?(:to_sym)
-
-          begin
-            sym = filter.to_sym
-            sym.is_a?(Symbol) ? sym : nil
-          rescue
-            nil
-          end
+        sig { params(filter: T.untyped).returns(T::Boolean) }
+        def callable_filter?(filter)
+          filter.respond_to?(:call)
         end
 
-        sig { params(filter: T.untyped).returns(T.nilable(ConfigStruct::FilterMatcher)) }
-        def build_filter_matcher(filter)
-          case filter
-          when ::Regexp
-            callable = Kernel.lambda do |key, _value|
-              filter.match?(key)
-            end
-            return ConfigStruct::FilterMatcher.new(callable: callable, label: filter.inspect)
+        # Rails treats Strings and Symbols with a dot, and Regexps with an escaped dot, as paths
+        sig { params(entry: T.untyped).returns(T::Boolean) }
+        def path_pattern?(entry)
+          if entry.is_a?(Regexp)
+            entry.source.include?("\\.")
           else
-            return build_callable_filter_matcher(filter) if callable_filter?(filter)
+            entry.to_s.include?(".")
           end
+        end
 
-          nil
+        # Rails joins a nested parameter's keys with dots ("user.password") and matches its dotted
+        # entries against that, as case-insensitive substrings or as Regexps. LogStruct's paths
+        # start at the line's field ("params.user.password"), so an entry matches the path from
+        # there or from the field's value down, as it would in Rails.
+        sig { params(patterns: T::Array[T.untyped]).returns(ConfigStruct::PathFilterMatcher) }
+        def build_rails_path_matcher(patterns)
+          regexps = patterns.select { |entry| entry.is_a?(Regexp) }
+          strings = patterns.reject { |entry| entry.is_a?(Regexp) }.map { |entry| Regexp.escape(entry.to_s) }
+          regexps << Regexp.new(strings.join("|"), true) if strings.any?
+          callable = Kernel.lambda do |path, _value, _root|
+            full_path = path.join(".")
+            field_path = path.drop(1).join(".")
+            regexps.any? { |regexp| regexp.match?(full_path) || (!field_path.empty? && regexp.match?(field_path)) }
+          end
+          ConfigStruct::PathFilterMatcher.new(callable: callable, label: RAILS_PATHS_LABEL, uses_root: false)
         end
 
-        sig { params(filter: T.untyped).returns(T::Boolean) }
-        def callable_filter?(filter)
-          filter.respond_to?(:call)
+        # A Rails filter block with three arguments, given the parameters around the key: the
+        # line's top-level field's value (a request line's params), or the line for a top-level key
+        sig { params(filter: T.untyped).returns(ConfigStruct::PathFilterMatcher) }
+        def build_path_block_matcher(filter)
+          callable = Kernel.lambda do |path, original_value, root|
+            original_key = path.last.to_s
+            key = original_key.dup
+            value = original_value.duplicable? ? original_value.dup : original_value
+            result = filter.call(key, value, root)
+            !!result || (value.is_a?(String) && value != original_value)
+          rescue => e
+            handle_filter_error(e, filter, original_key || "")
+            false
+          end
+          ConfigStruct::PathFilterMatcher.new(callable: callable, label: filter.inspect)
         end
 
-        sig { params(filter: T.untyped).returns(T.nilable(ConfigStruct::FilterMatcher)) }
+        # Rails gives filter blocks copies of the key and value, ignores what they return, and
+        # logs the value as the block left it: the Rails guides' example reverses it in place,
+        # and a block can replace it with "[FILTERED]". LogStruct filters a key when its block
+        # returns a truthy value or changes a String it's given, and never changes the logged
+        # value itself. Blocks with three arguments are path matchers (build_path_block_matcher).
+        sig { params(filter: T.untyped).returns(ConfigStruct::FilterMatcher) }
         def build_callable_filter_matcher(filter)
-          callable = Kernel.lambda do |key, value|
+          callable = Kernel.lambda do |original_key, original_value|
+            key = original_key.dup
+            value = original_value.duplicable? ? original_value.dup : original_value
             call_args = case arity_for_filter(filter)
             when 0
               []
@@ -231,7 +285,7 @@ module LogStruct
             end
 
             result = filter.call(*call_args)
-            !!result
+            !!result || (value.is_a?(String) && value != original_value)
           rescue ArgumentError
             begin
               !!filter.call(key)
@@ -251,12 +305,6 @@ module LogStruct
           filter.respond_to?(:arity) ? filter.arity : 2
         end
 
-        sig { params(filter_params: T::Array[T.untyped], leftovers: T::Array[T.untyped]).void }
-        def replace_filter_parameters(filter_params, leftovers)
-          filter_params.clear
-          filter_params.concat(leftovers)
-        end
-
         sig { params(error: StandardError, filter: T.untyped, key: String).void }
         def handle_filter_error(error, filter, key)
           context = {

data/lib/log_struct/concerns/error_handling.rb

@@ -42,10 +42,19 @@ module LogStruct
           LogStruct.error(error_log)
         end
 
-        # Report an error using the configured handler or MultiErrorReporter
+        # Log an error and report it using the configured handler or MultiErrorReporter
         sig { params(error: StandardError, source: Source, context: T.nilable(T::Hash[Symbol, T.untyped])).void }
         def log_and_report_error(error, source:, context: nil)
           log_error(error, source: source, context: context)
+          report_error(error, source: source, context: context)
+        end
+
+        # Report an error using the configured handler or MultiErrorReporter, without logging it. A reporter that
+        # raises (a timeout calling its service) doesn't change what happens to the error: its own error is logged,
+        # and not reported through the same reporter.
+        sig { params(error: StandardError, source: Source, context: T.nilable(T::Hash[Symbol, T.untyped])).void }
+        def report_error(error, source:, context: nil)
+          context = filtered_context(context)
           error_handler = LogStruct.config.error_reporting_handler
           if error_handler
             # Use the configured handler
@@ -54,11 +63,31 @@ module LogStruct
             # Fall back to MultiErrorReporter (detects Sentry, Bugsnag, etc.)
             LogStruct::MultiErrorReporter.report_error(error, context || {})
           end
+        rescue => e
+          LogStruct.error(Log::Error.new(
+            source: Source::Internal,
+            error_class: e.class,
+            message: "The error reporter raised while reporting #{error.class}",
+            error_message: e.message,
+            backtrace: e.backtrace,
+            level: Level::Error
+          ))
         end
 
-        # Handle an error according to the configured error handling mode (log, report, raise, etc)
-        sig { params(error: StandardError, source: Source, context: T.nilable(T::Hash[Symbol, T.untyped])).void }
-        def handle_exception(error, source:, context: nil)
+        # The context filtered and scrubbed like a log line, for error reporters: it can hold a
+        # request's parameters or a mail's recipients
+        sig { params(context: T.nilable(T::Hash[Symbol, T.untyped])).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        def filtered_context(context)
+          return context if context.nil? || context.empty?
+
+          filtered = Formatter.new.process_values(context)
+          filtered.is_a?(Hash) ? filtered : {}
+        end
+
+        # Handle an error according to the configured error handling mode (log, report, raise, etc).
+        # Pass `log: false` when the caller has already logged the error in its own structured line.
+        sig { params(error: StandardError, source: Source, context: T.nilable(T::Hash[Symbol, T.untyped]), log: T::Boolean).void }
+        def handle_exception(error, source:, context: nil, log: true)
           mode = error_handling_mode_for(source)
 
           # Log / report in production, raise locally (dev/test)
@@ -74,10 +103,11 @@ module LogStruct
             raise(error)
 
           when ErrorHandlingMode::Log, ErrorHandlingMode::LogProduction
-            log_error(error, source: source, context: context)
+            log_error(error, source: source, context: context) if log
 
           when ErrorHandlingMode::Report, ErrorHandlingMode::ReportProduction
-            log_and_report_error(error, source: source, context: context)
+            log_error(error, source: source, context: context) if log
+            report_error(error, source: source, context: context)
 
           else
             # Ensures the case statement is exhaustive

data/lib/log_struct/config_struct/error_handling_modes.rb

@@ -16,7 +16,9 @@ module LogStruct
       # - Raise - Always raise the error
 
       # Configurable error handling categories
-      prop :type_checking_errors, ErrorHandlingMode, default: ErrorHandlingMode::LogProduction
+      # Sorbet type errors in your app and its gems: logged and reported in production, so they don't pass unseen
+      prop :type_checking_errors, ErrorHandlingMode, default: ErrorHandlingMode::ReportProduction
+      # LogStruct's own errors
       prop :logstruct_errors, ErrorHandlingMode, default: ErrorHandlingMode::LogProduction
       prop :security_errors, ErrorHandlingMode, default: ErrorHandlingMode::Report
       prop :standard_errors, ErrorHandlingMode, default: ErrorHandlingMode::Raise

data/lib/log_struct/config_struct/filters.rb

@@ -1,13 +1,33 @@
 # typed: strict
 # frozen_string_literal: true
 
+require "active_support/hash_with_indifferent_access"
+
 module LogStruct
+  # A key's words, lowercase and joined by underscores, so that keys match however they're written:
+  # apiKey, api-key, X-Api-Key and HTTP_X_API_KEY all contain "api_key"
+  module KeyWords
+    extend T::Sig
+
+    sig { params(key: T.untyped).returns(String) }
+    def self.normalize(key)
+      key.to_s
+        .gsub(/([a-z\d])([A-Z])/, '\1_\2')
+        .gsub(/([A-Z]+)([A-Z][a-z])/, '\1_\2')
+        .tr("- .", "___")
+        .downcase
+    end
+  end
+
   module ConfigStruct
     class FilterMatcher < T::Struct
       extend T::Sig
 
       const :callable, T.proc.params(key: String, value: T.untyped).returns(T::Boolean)
       const :label, String
+      # Whether the matcher also applies to the names of LogStruct's own fields at the top of a line.
+      # LogStruct's matcher for Rails' partial matches doesn't: Rails' default :_key would filter cron_key.
+      const :matches_logstruct_fields, T::Boolean, default: true
 
       sig { params(key: String, value: T.untyped).returns(T::Boolean) }
       def matches?(key, value)
@@ -15,22 +35,67 @@ module LogStruct
       end
     end
 
+    # A filter that needs more than the key: Rails' entries with a dot (`card.number`) match a key by its
+    # path, and Rails gives filter blocks with three arguments the parameters around the key. The path
+    # starts at the line's top-level field (`["params", "card", "number"]`); `root` is that field's value,
+    # or the whole line for a top-level key, with indifferent access as Rails gives it. Building it copies
+    # every value inside it, so a matcher that doesn't read it sets uses_root to false and gets nil.
+    class PathFilterMatcher < T::Struct
+      extend T::Sig
+
+      const :callable, T.proc.params(path: T::Array[String], value: T.untyped, root: T.untyped).returns(T::Boolean)
+      const :label, String
+      const :uses_root, T::Boolean, default: true
+
+      sig { params(path: T::Array[String], value: T.untyped, root: T.untyped).returns(T::Boolean) }
+      def matches?(path, value, root)
+        root = nil unless uses_root
+        callable.call(path, value, root.is_a?(LazyRoot) ? root.value : root)
+      end
+    end
+
+    # The root a PathFilterMatcher gets, built the first time a matcher reads it
+    class LazyRoot
+      extend T::Sig
+
+      sig { params(value: T.untyped).void }
+      def initialize(value)
+        @source = value
+        @built = T.let(false, T::Boolean)
+        @value = T.let(nil, T.untyped)
+      end
+
+      # The value with indifferent access, as Rails gives filter blocks the request's parameters
+      sig { returns(T.untyped) }
+      def value
+        return @value if @built
+
+        @built = true
+        @value = begin
+          @source.is_a?(Hash) ? ActiveSupport::HashWithIndifferentAccess.new(@source) : @source
+        rescue SystemStackError, StandardError
+          @source
+        end
+      end
+    end
+
     class Filters < T::Struct
       include Sorbet::SerializeSymbolKeys
 
       # Keys that should be filtered in nested structures such as request params and job arguments.
-      # Filtered data includes information about Hashes and Arrays.
+      # A filtered value is replaced by a summary of it, with no length (which would say how long a
+      # secret is):
       #
-      # { _filtered: {
-      #     _class: "Hash",                # Class of the filtered value
-      #     _bytes: 1234,                  # Length of JSON string in bytes
-      #     _keys_count: 3,                # Number of keys in the hash
-      #     _keys: [:key1, :key2, :key3],  # First 10 keys in the hash
-      #   }
-      # }
+      # { _filtered: { _class: "Hash", _keys_count: 3, _keys: [:key1, :key2, :key3] } }  # first 10 keys
+      # { _filtered: { _class: "Array", _count: 2 } }
+      # { _filtered: { _class: "String" } }  # plus its _hash for filter_keys_with_hashes
       #
-      # Default: [:password, :password_confirmation, :pass, :pw, :token, :secret,
-      #           :credentials, :creds, :auth, :authentication, :authorization]
+      # A key matches when its name, or its words joined by underscores (KeyWords.normalize), equal an
+      # entry: :api_key also filters apiKey and X-Api-Key, but doesn't by itself filter api_key_id (the
+      # default filter_matchers' sensitive words do).
+      #
+      # Default: [:password, :password_confirmation, :pass, :pw, :token, :secret, :credentials, :auth,
+      #           :authentication, :authorization, :credit_card, :ssn, :social_security]
       #
       prop :filter_keys,
         T::Array[Symbol],
@@ -42,22 +107,22 @@ module LogStruct
           ]
         }
 
-      # Keys where string values should include an SHA256 hash.
-      # Useful for tracing emails across requests (e.g. sign in, sign up) while protecting privacy.
+      # Keys that are filtered like filter_keys, and whose String values also get a _hash in their summary
+      # (see hash_salt), so lines about the same person can be followed without logging the address.
       # Default: [:email, :email_address]
       prop :filter_keys_with_hashes,
         T::Array[Symbol],
         factory: -> { %i[email email_address] }
 
-      # Hash salt for SHA256 hashing (typically used for email addresses)
-      # Used for both param filters and string scrubbing
-      # Default: "l0g5t0p"
-      prop :hash_salt, String, default: "l0g5t0p"
+      # The key for the HMAC-SHA256 hashes of emails and filter_keys_with_hashes values. Anyone who has
+      # the key and a list of candidate emails can match them to the hashes, so keep it secret.
+      # Default: nil, which uses a key derived from the Rails app's secret_key_base. Set it to keep the
+      # same hashes in every app that logs the same people.
+      prop :hash_salt, T.nilable(String), default: nil
 
-      # Hash length for SHA256 hashing (typically used for email addresses)
-      # Used for both param filters and string scrubbing
-      # Default: 12
-      prop :hash_length, Integer, default: 12
+      # How many hex characters of each hash to log
+      # Default: 16
+      prop :hash_length, Integer, default: 16
 
       # Filter email addresses. Also controls email filtering for the ActionMailer integration
       # (to, from, recipient fields, etc.)
@@ -68,6 +133,17 @@ module LogStruct
       # Default: true
       prop :url_passwords, T::Boolean, default: true
 
+      # Filter sensitive params in URLs' query strings: params that filter_keys or the filter matchers
+      # would filter as keys (?token=, ?api_key=, user[password]=), and OAuth's ?code=
+      # Default: true
+      prop :url_query_params, T::Boolean, default: true
+
+      # Scrub the credentials after Bearer and Basic in strings (an Authorization header's value,
+      # logged as text): Bearer tokens of 16 or more characters, and Basic credentials that decode to
+      # user:password
+      # Default: true
+      prop :authorization_credentials, T::Boolean, default: true
+
       # Filter credit card numbers
       # Default: true
       prop :credit_card_numbers, T::Boolean, default: true
@@ -88,32 +164,39 @@ module LogStruct
       # Default: false
       prop :mac_addresses, T::Boolean, default: false
 
-      # Default regex pattern for matching sensitive keys.
-      # Matches keys containing: password, token, secret, auth, cred
-      # Also matches specific key patterns: api_key, secret_key, private_key, access_key, encryption_key
-      # Examples: access_token, api_key, auth_header, credentials
-      # Uses start/end of string or underscore/hyphen boundaries to prevent
-      # false positives like "keyboard" or "turkey" (which contain "key" mid-word)
-      # Note: "key" alone is too broad (matches cron_key, primary_key), so we only match
-      # specific sensitive key patterns
+      # Default pattern for sensitive keys, matched against a key's words joined by underscores
+      # (KeyWords.normalize: apiKey, api-key and API_KEY are all "api_key"):
+      # - these words anywhere in the key: password, passwd, passphrase, passcode, pwd, token, secret, auth,
+      #   authorization, authentication, cred, credential, cookie, session, jwt, bearer, otp, apikey, cvv,
+      #   cvc, ssn, social_security, social_security_number, credit_card, card_number, crypt, crypted (and
+      #   their plurals): access_token, newPassword, Set-Cookie, HTTP_AUTHORIZATION, credit_card_number
+      # - api_key, secret_key, private_key, access_key, encryption_key, signing_key, master_key: X-Api-Key
+      # - signature, sig, salt and certificate as the last word: X-Amz-Signature (but not signature_field_id)
+      # Matching whole words avoids false positives like "keyboard", "author" or "cron_key".
       DEFAULT_SENSITIVE_KEY_PATTERN = T.let(
-        /(^|[_-])(password|token|secret|auth|cred)([_-]|$)|(^|[_-])(api|secret|private|access|encryption)_key([_-]|$)/i,
+        /(?:\A|_)(?:passwords?|passwd|passphrases?|passcodes?|pwd|tokens?|secrets?|auth|authorization|authentication|creds?|credentials?|cookies?|sessions?|jwts?|bearer|otps?|apikeys?|cvv|cvc|ssn|social_security(?:_numbers?)?|credit_cards?|card_numbers?|crypt|crypted)(?:_|\z)|(?:\A|_)(?:api|secret|private|access|encryption|signing|master)_keys?(?:_|\z)|(?:\A|_)(?:signature|sig|salt|certificate)s?\z/,
         Regexp
       )
 
-      # Additional filter matchers built from Rails filter_parameters entries that aren't simple symbols.
-      # Each matcher receives the key (String) and optional value, returning true when the pair should be filtered.
-      # By default, includes a regex matcher for common sensitive key patterns.
+      # Matchers for keys that aren't listed by name in filter_keys. Each matcher receives the key (String)
+      # and optional value, returning true when the pair should be filtered. Includes a regex matcher for
+      # common sensitive key patterns, and LogStruct adds matchers for Rails' filter_parameters at boot.
       prop :filter_matchers,
         T::Array[FilterMatcher],
         factory: -> {
           [
             FilterMatcher.new(
-              callable: ->(key, _value) { DEFAULT_SENSITIVE_KEY_PATTERN.match?(key) },
+              callable: ->(key, _value) { DEFAULT_SENSITIVE_KEY_PATTERN.match?(KeyWords.normalize(key)) },
               label: "default_sensitive_pattern"
             )
           ]
         }
+
+      # Matchers that need a key's path or the parameters around it (see PathFilterMatcher). LogStruct
+      # adds them for Rails' filter_parameters at boot.
+      prop :path_matchers,
+        T::Array[PathFilterMatcher],
+        factory: -> { [] }
     end
   end
 end

data/lib/log_struct/config_struct/integrations.rb

@@ -61,10 +61,6 @@ module LogStruct
       # Default: true
       prop :enable_goodjob, T::Boolean, default: true
 
-      # Enable SemanticLogger integration for high-performance logging
-      # Default: true
-      prop :enable_semantic_logger, T::Boolean, default: true
-
       # Enable SQL query logging through ActiveRecord instrumentation
       # Default: false (can be resource intensive)
       prop :enable_sql_logging, T::Boolean, default: false