octri 1.0.0 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b7710dbc38e8c6678e6e5a38456e0dfdf26ce8098b580e5cad6a00ed7ef210e2
-  data.tar.gz: b3496fdae687f5e386361fa122bf61d80af342a2d22a6cc239cccbc2c74fcb9c
+  metadata.gz: 15e020993bd573362db0191b73266111e568d1e12d0977b2ce1b82c85c0bd04d
+  data.tar.gz: a51dd16d8ff052a321cd2dbcd9701ca0a3f6ea5e73874385859c3a90720bf580
 SHA512:
-  metadata.gz: cd2be05e16cd704c0e1118dbf477b632e764c3cc5f770f3ce6fbfb821b72d67a97ecf912b2d12ab1e15239fa247ed15947d61e830c1da0d5c7d32abd23f66893
-  data.tar.gz: 6d0783dd74030d6657e45b7c507add769195eeab6d07bf9024e4b2c79e3f4ab9dbc5b58d1228d2cfc38bc2a16790f3780a8b8579729ae46713704f44dcef3556
+  metadata.gz: '0109372656982385c8ed24a765f5e0b6235f2a24636276e8a70bef540350f09f55869c16bc412b8d17f83f51695bbd6b34d995d8bb5e2abdbdfb417b6d0cdadc'
+  data.tar.gz: 75d97ab367c60d668d95446052ea5b6e85f17b870d76b6f0893ad69e089935e4935ad7ea7f6d104df626f4438efefd2329a4d0c8cf29dedc7974d2ba6c3bf936

data/CHANGELOG.md

@@ -0,0 +1,31 @@
+# Changelog
+
+## 1.1.0
+
+- Payloads are now scrubbed before they are sent. Values under keys that name a
+  credential (`password`, `secret`, `token`, `apiKey`, `authorization`,
+  `cookie`, `ssn` and the rest) are replaced with `[redacted]` at any depth, and
+  free text is swept for bearer tokens, JWTs, Luhn-valid card numbers and email
+  addresses.
+- `add_scrub_fields` adds your own key names to that list.
+- `set_before_send` hands you each payload before it goes out; return
+  `nil` to drop the event. Redaction runs after the hook.
+- The `user` field keeps the identity you set, since that is the point of it.
+  Credential-shaped keys inside it are still redacted.
+
+## 1.0.1
+
+- Source context is now read only for frames in your own code, skips files
+  over 512 KB, and keeps a bounded cache, so a deep or unusual stack cannot
+  pull dependency source into a report or grow memory without limit.
+
+## 1.0.0
+
+First public release.
+
+- Error reporting with original source context for each in-app stack frame.
+- Request and sub-span timing, drawn as a waterfall in the dashboard.
+- W3C `traceparent` propagation, so a server error links to the client SDK
+  error for the same request.
+- Standalone events with idempotent, best-effort delivery.
+- Rack middleware for Rack and Rails, plus automatic instrumentation of outbound HTTP.

data/README.md

@@ -4,7 +4,7 @@
 or Rails with original-source context per stack frame, time every request and any
 sub-span you open into a waterfall, and join each server error to the client SDK
 error for the same request through the W3C `traceparent` header. In the
-dashboard you see the full client → server stack under one trace.
+dashboard you see the full client and server stack under one trace.
 
 Octri turns an OpenAPI spec into a documentation site, client SDKs for ten
 languages, an MCP server your AI assistant can call, and monitoring for the
@@ -70,7 +70,7 @@ Octri.instrument(cache, [:get, :set], op: "cache")
 ```
 
 Every instrumented call (and every outbound HTTP request) becomes a sub-span
-under the current request — no per-call code. Calls to your monitoring backend
+under the current request, with no per-call code. Calls to your monitoring backend
 are never traced (no feedback loop).
 
 ## Sub-spans (where time goes)
@@ -86,7 +86,7 @@ value = cache.read(key)
 s.finish
 ```
 
-`op` ("db", "cache", "http", …) color-codes the waterfall; nested `Octri.span`
+`op` ("db", "cache", "http", and so on) color-codes the waterfall; nested `Octri.span`
 calls nest correctly.
 
 ## Manual error capture
@@ -102,6 +102,39 @@ end
 
 ---
 
+## What gets redacted
+
+Payloads are scrubbed on the way out, so a credential that ended up in a log
+line or a context object never reaches the dashboard.
+
+Any key whose name looks like a credential (`password`, `secret`, `token`,
+`apiKey`, `authorization`, `cookie`, `ssn` and the rest of the usual list) has
+its value replaced with `[redacted]`, at any depth. Matching ignores case and
+separators, so `api_key`, `apiKey` and `X-API-KEY` are all the same key.
+
+Free text is swept too: the message, an error message and its stack, and
+anything else you send as a string. Bearer tokens, JWTs, card numbers and email
+addresses come out as `[redacted]`. A card number has to pass the Luhn check
+first, so an order number or a timestamp survives.
+
+`user` is the exception. It is the field you fill with an identity on purpose,
+so `user.email` is reported exactly as you set it. Credential-shaped keys inside
+it are still redacted.
+
+Add your own key names:
+
+```ruby
+Octri.add_scrub_fields("account_number", "otp")
+```
+
+Or take the payload yourself, and return `nil` to drop the event:
+
+```ruby
+Octri.set_before_send { |payload| payload[:path] == "/health" ? nil : payload }
+```
+
+Redaction runs after your hook, so a hook cannot leak a credential by accident.
+
 ## The rest of Octri
 
 | Product | What it does |
@@ -113,19 +146,21 @@ end
 
 ### Monitoring runtimes
 
-[Node](https://github.com/octridev/octri-node) ·
-[Python](https://github.com/octridev/octri-python) ·
-[Go](https://github.com/octridev/octri-go) ·
-[Ruby](https://github.com/octridev/octri-ruby) ·
-[Rust](https://github.com/octridev/octri-rust) ·
-[PHP](https://github.com/octridev/octri-php) ·
-[Java](https://github.com/octridev/octri-java) ·
-[Kotlin](https://github.com/octridev/octri-kotlin) ·
-[Swift](https://github.com/octridev/octri-swift) ·
-[Dart](https://github.com/octridev/octri-dart)
-
-[Documentation](https://docs.octri.dev/docs) ·
-[Pricing](https://octri.dev/pricing) ·
-[Changelog](https://docs.octri.dev/changelog)
+- [Node](https://github.com/octridev/octri-node)
+- [Python](https://github.com/octridev/octri-python)
+- [Go](https://github.com/octridev/octri-go)
+- [Ruby](https://github.com/octridev/octri-ruby)
+- [Rust](https://github.com/octridev/octri-rust)
+- [PHP](https://github.com/octridev/octri-php)
+- [Java](https://github.com/octridev/octri-java)
+- [Kotlin](https://github.com/octridev/octri-kotlin)
+- [Swift](https://github.com/octridev/octri-swift)
+- [Dart](https://github.com/octridev/octri-dart)
+
+### More
+
+- [Documentation](https://docs.octri.dev/docs)
+- [Pricing](https://octri.dev/pricing)
+- [Changelog](https://docs.octri.dev/changelog)
 
 MIT licensed.

data/lib/octri.rb

@@ -1,10 +1,10 @@
 # frozen_string_literal: true
 
-# Octri — server-side error monitoring for Ruby backends.
+# Octri: server-side error monitoring for Ruby backends.
 #
 # Add it to your live API; it reports backend errors to your Octri monitoring
 # project (with original-source context per stack frame) and links each one to
-# the client SDK error for the same request via the W3C `traceparent` header —
+# the client SDK error for the same request via the W3C `traceparent` header,
 # so the dashboard shows the full client -> server stack under one trace. It also
 # times requests (and any sub-spans you open) into the request waterfall.
 #
@@ -14,6 +14,7 @@
 #   use Octri::Rack
 
 require "securerandom"
+require "set"
 require "net/http"
 require "uri"
 require "json"
@@ -24,10 +25,31 @@ module Octri
   Trace = Struct.new(:trace_id, :parent_span_id)
 
   CONTEXT_LINES = 5
+  MAX_SOURCE_BYTES = 512 * 1024
+  MAX_CACHED_SOURCES = 256
   REQUEST_TIMEOUT_SECONDS = 5
   MAX_IDEMPOTENCY_KEY_LENGTH = 256
   TRACEPARENT_RE = /\A00-([0-9a-f]{32})-([0-9a-f]{16})-[0-9a-f]{2}\z/i.freeze
 
+  # Keys whose value never leaves the process. Compared against the key with case
+  # and separators removed, so `api_key`, `apiKey` and `API-KEY` all match
+  # `apikey`, and the test is a substring one, so `stripe_secret_key` matches too.
+  SCRUB_KEYS = %w[
+    password passwd passphrase secret token apikey authorization credential
+    cookie session privatekey accesskey cardnumber creditcard cvv ssn
+  ].freeze
+
+  REDACTED = "[redacted]"
+  TRUNCATED = "[truncated]"
+  CIRCULAR = "[circular]"
+  # Deep enough for real context objects, shallow enough to stay cheap.
+  MAX_SCRUB_DEPTH = 8
+
+  BEARER_RE = %r{\bbearer\s+[\w.~+/-]+=*}i.freeze
+  JWT_RE = /\beyJ[\w-]+\.[\w-]+\.[\w-]+/.freeze
+  DIGIT_RUN_RE = /\b(?:\d[ -]?){12,18}\d\b/.freeze
+  EMAIL_RE = /[\w.%+-]+@[\w-]+(?:\.[\w-]+)+/.freeze
+
   class << self
     # Configure the reporter. Call once at startup before mounting the middleware.
     def init(url:, token: nil, environment:, release: nil)
@@ -132,6 +154,33 @@ module Octri
       patch_net_http if http
     end
 
+    # ── Scrubbing ─────────────────────────────────────────────────────────────
+
+    # Redact more key names, on top of the built-in list. Matching ignores case
+    # and separators and is a substring test, so `account` also covers
+    # `account_number`.
+    #
+    #   Octri.add_scrub_fields("account_number", "otp")
+    def add_scrub_fields(*fields)
+      @extra_scrub_keys ||= []
+      fields.flatten.each do |field|
+        key = normalize_key(field)
+        @extra_scrub_keys << key unless key.empty? || @extra_scrub_keys.include?(key)
+      end
+      @extra_scrub_keys
+    end
+
+    # Run a block on every payload just before it is sent. Return the payload
+    # (editing it in place is fine) to send it, or nil to drop the event:
+    #
+    #   Octri.set_before_send { |payload| payload[:path] == "/health" ? nil : payload }
+    #
+    # Redaction still runs afterwards, so a hook cannot leak a credential by
+    # accident. Call it without a block to remove the hook.
+    def set_before_send(&hook)
+      @before_send = hook
+    end
+
     # ── Reporting ──────────────────────────────────────────────────────────────
     # Log an application event directly, without a generated Octri API SDK.
     # Delivery is fire-and-forget; event_id may be supplied for idempotency.
@@ -224,7 +273,7 @@ module Octri
       Time.now.utc.iso8601(3)
     end
 
-    # True when host:port is the monitoring backend — used to avoid tracing our
+    # True when host:port is the monitoring backend, used to avoid tracing our
     # own reporting requests (which would recurse).
     def monitoring_endpoint?(host, port)
       return false if @config.nil? || @config.url.nil?
@@ -292,7 +341,8 @@ module Octri
         path = loc.absolute_path || loc.path
         lineno = loc.lineno
         frame = { function: loc.label, filename: path, lineno: lineno, colno: 0, inApp: in_app?(path) }
-        lines = read_source(path)
+        # Only your own files: the dashboard shows them, gem source is noise.
+        lines = frame[:inApp] ? read_source(path) : nil
         if lines && lineno >= 1 && lineno <= lines.length
           idx = lineno - 1
           frame[:contextLine] = lines[idx]
@@ -319,23 +369,114 @@ module Octri
       return @source_cache[path] if @source_cache.key?(path)
 
       lines = begin
-        File.readlines(path, chomp: true)
+        # Big files are skipped, not truncated, so line numbers keep lining up.
+        File.size(path) <= MAX_SOURCE_BYTES ? File.readlines(path, chomp: true) : nil
       rescue StandardError
         nil
       end
+      # A stack can name any number of files, so the cache is bounded too.
+      @source_cache.shift if @source_cache.size >= MAX_CACHED_SOURCES
       @source_cache[path] = lines
       lines
     end
 
+    def normalize_key(key)
+      key.to_s.downcase.gsub(/[^a-z0-9]/, "")
+    end
+
+    def secret_key?(key)
+      normalized = normalize_key(key)
+      return false if normalized.empty?
+
+      SCRUB_KEYS.any? { |candidate| normalized.include?(candidate) } ||
+        (@extra_scrub_keys || []).any? { |candidate| normalized.include?(candidate) }
+    end
+
+    # Tells a card number from the order ids and timestamps that look like one.
+    def passes_luhn?(digits)
+      sum = 0
+      double = false
+      digits.reverse.each_char do |char|
+        digit = char.ord - 48
+        if double
+          digit *= 2
+          digit -= 9 if digit > 9
+        end
+        sum += digit
+        double = !double
+      end
+      (sum % 10).zero?
+    end
+
+    # Removes credentials and personal data that leaked into free text.
+    def scrub_text(value)
+      return value if value.empty?
+
+      value
+        .gsub(BEARER_RE, REDACTED)
+        .gsub(JWT_RE, REDACTED)
+        .gsub(DIGIT_RUN_RE) { |run| passes_luhn?(run.delete("^0-9")) ? REDACTED : run }
+        .gsub(EMAIL_RE, REDACTED)
+    end
+
+    # Redacts credential-shaped keys anywhere in the payload, and strips secrets
+    # out of the free text around them. `user` is the field you deliberately fill
+    # with an identity, so its strings are left alone; its keys are still checked.
+    def scrub_value(value, depth, text, seen)
+      case value
+      when String
+        text ? scrub_text(value) : value
+      when Hash, Array
+        return TRUNCATED if depth >= MAX_SCRUB_DEPTH
+        # Walking a copy means a cycle would recurse forever, and a context hash
+        # holding a reference back to itself is worth surviving.
+        return CIRCULAR if seen.include?(value.object_id)
+
+        seen.add(value.object_id)
+        begin
+          scrub_collection(value, depth, text, seen)
+        ensure
+          seen.delete(value.object_id)
+        end
+      else
+        value
+      end
+    end
+
+    def scrub_collection(value, depth, text, seen)
+      return value.map { |item| scrub_value(item, depth + 1, text, seen) } if value.is_a?(Array)
+
+      value.each_with_object({}) do |(key, nested), out|
+        out[key] = if secret_key?(key)
+                     REDACTED
+                   else
+                     scrub_value(nested, depth + 1, text && key.to_s != "user", seen)
+                   end
+      end
+    end
+
+    # The last thing every payload passes through. Both the hook and the
+    # redaction live here rather than in the capture methods, so nothing can be
+    # reported around them.
+    def scrub_payload(payload)
+      hooked = @before_send ? @before_send.call(payload) : payload
+      return nil unless hooked.is_a?(Hash)
+
+      scrub_value(hooked, 0, true, Set.new)
+    end
+
     def post_json(path, payload, idempotency_key:)
       cfg = @config
       return if cfg.nil?
       return unless safe_idempotency_key?(idempotency_key)
       return if cfg.token && cfg.token != "" && !safe_header_value?(cfg.token)
 
+      scrubbed = scrub_payload(payload)
+      return if scrubbed.nil?
+
       begin
         Thread.new do
-          body = JSON.generate(payload)
+          body = JSON.generate(scrubbed)
           uri = URI("#{cfg.url}#{path}")
           http = Net::HTTP.new(uri.host, uri.port)
           http.use_ssl = uri.scheme == "https"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: octri
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.1.0
 platform: ruby
 authors:
 - Octri
@@ -16,6 +16,7 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- CHANGELOG.md
 - LICENSE
 - README.md
 - lib/octri.rb