octri 1.0.1 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0bae18c311de3d67d561b38c42c0c32ec50dd6cdbdd69fbb33671658fb0bb1c4
-  data.tar.gz: fb7db736fa76a53ddbf395d2bcc94b539e7cb04b1fb3c4d67103d6b60651e3b3
+  metadata.gz: 15e020993bd573362db0191b73266111e568d1e12d0977b2ce1b82c85c0bd04d
+  data.tar.gz: a51dd16d8ff052a321cd2dbcd9701ca0a3f6ea5e73874385859c3a90720bf580
 SHA512:
-  metadata.gz: 76178a0d41df4536d8beb2b7a7a00c007414f618783795dbc9aa511977a037015f531275f5719d8ede4765a9174dc8b587faf5e398a3c379a0dc5ed66f4f066d
-  data.tar.gz: 35cdb51b77150bfe8f23b0e0827b3758d3e327137a85728208fabae9c2e775c5708d483451e67697d4b0919e6f8600c021988e9225eb9df93886349b1c617c29
+  metadata.gz: '0109372656982385c8ed24a765f5e0b6235f2a24636276e8a70bef540350f09f55869c16bc412b8d17f83f51695bbd6b34d995d8bb5e2abdbdfb417b6d0cdadc'
+  data.tar.gz: 75d97ab367c60d668d95446052ea5b6e85f17b870d76b6f0893ad69e089935e4935ad7ea7f6d104df626f4438efefd2329a4d0c8cf29dedc7974d2ba6c3bf936

data/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 1.1.0
+
+- Payloads are now scrubbed before they are sent. Values under keys that name a
+  credential (`password`, `secret`, `token`, `apiKey`, `authorization`,
+  `cookie`, `ssn` and the rest) are replaced with `[redacted]` at any depth, and
+  free text is swept for bearer tokens, JWTs, Luhn-valid card numbers and email
+  addresses.
+- `add_scrub_fields` adds your own key names to that list.
+- `set_before_send` hands you each payload before it goes out; return
+  `nil` to drop the event. Redaction runs after the hook.
+- The `user` field keeps the identity you set, since that is the point of it.
+  Credential-shaped keys inside it are still redacted.
+
 ## 1.0.1
 
 - Source context is now read only for frames in your own code, skips files

data/README.md

@@ -102,6 +102,39 @@ end
 
 ---
 
+## What gets redacted
+
+Payloads are scrubbed on the way out, so a credential that ended up in a log
+line or a context object never reaches the dashboard.
+
+Any key whose name looks like a credential (`password`, `secret`, `token`,
+`apiKey`, `authorization`, `cookie`, `ssn` and the rest of the usual list) has
+its value replaced with `[redacted]`, at any depth. Matching ignores case and
+separators, so `api_key`, `apiKey` and `X-API-KEY` are all the same key.
+
+Free text is swept too: the message, an error message and its stack, and
+anything else you send as a string. Bearer tokens, JWTs, card numbers and email
+addresses come out as `[redacted]`. A card number has to pass the Luhn check
+first, so an order number or a timestamp survives.
+
+`user` is the exception. It is the field you fill with an identity on purpose,
+so `user.email` is reported exactly as you set it. Credential-shaped keys inside
+it are still redacted.
+
+Add your own key names:
+
+```ruby
+Octri.add_scrub_fields("account_number", "otp")
+```
+
+Or take the payload yourself, and return `nil` to drop the event:
+
+```ruby
+Octri.set_before_send { |payload| payload[:path] == "/health" ? nil : payload }
+```
+
+Redaction runs after your hook, so a hook cannot leak a credential by accident.
+
 ## The rest of Octri
 
 | Product | What it does |

data/lib/octri.rb

@@ -14,6 +14,7 @@
 #   use Octri::Rack
 
 require "securerandom"
+require "set"
 require "net/http"
 require "uri"
 require "json"
@@ -30,6 +31,25 @@ module Octri
   MAX_IDEMPOTENCY_KEY_LENGTH = 256
   TRACEPARENT_RE = /\A00-([0-9a-f]{32})-([0-9a-f]{16})-[0-9a-f]{2}\z/i.freeze
 
+  # Keys whose value never leaves the process. Compared against the key with case
+  # and separators removed, so `api_key`, `apiKey` and `API-KEY` all match
+  # `apikey`, and the test is a substring one, so `stripe_secret_key` matches too.
+  SCRUB_KEYS = %w[
+    password passwd passphrase secret token apikey authorization credential
+    cookie session privatekey accesskey cardnumber creditcard cvv ssn
+  ].freeze
+
+  REDACTED = "[redacted]"
+  TRUNCATED = "[truncated]"
+  CIRCULAR = "[circular]"
+  # Deep enough for real context objects, shallow enough to stay cheap.
+  MAX_SCRUB_DEPTH = 8
+
+  BEARER_RE = %r{\bbearer\s+[\w.~+/-]+=*}i.freeze
+  JWT_RE = /\beyJ[\w-]+\.[\w-]+\.[\w-]+/.freeze
+  DIGIT_RUN_RE = /\b(?:\d[ -]?){12,18}\d\b/.freeze
+  EMAIL_RE = /[\w.%+-]+@[\w-]+(?:\.[\w-]+)+/.freeze
+
   class << self
     # Configure the reporter. Call once at startup before mounting the middleware.
     def init(url:, token: nil, environment:, release: nil)
@@ -134,6 +154,33 @@ module Octri
       patch_net_http if http
     end
 
+    # ── Scrubbing ─────────────────────────────────────────────────────────────
+
+    # Redact more key names, on top of the built-in list. Matching ignores case
+    # and separators and is a substring test, so `account` also covers
+    # `account_number`.
+    #
+    #   Octri.add_scrub_fields("account_number", "otp")
+    def add_scrub_fields(*fields)
+      @extra_scrub_keys ||= []
+      fields.flatten.each do |field|
+        key = normalize_key(field)
+        @extra_scrub_keys << key unless key.empty? || @extra_scrub_keys.include?(key)
+      end
+      @extra_scrub_keys
+    end
+
+    # Run a block on every payload just before it is sent. Return the payload
+    # (editing it in place is fine) to send it, or nil to drop the event:
+    #
+    #   Octri.set_before_send { |payload| payload[:path] == "/health" ? nil : payload }
+    #
+    # Redaction still runs afterwards, so a hook cannot leak a credential by
+    # accident. Call it without a block to remove the hook.
+    def set_before_send(&hook)
+      @before_send = hook
+    end
+
     # ── Reporting ──────────────────────────────────────────────────────────────
     # Log an application event directly, without a generated Octri API SDK.
     # Delivery is fire-and-forget; event_id may be supplied for idempotency.
@@ -333,15 +380,103 @@ module Octri
       lines
     end
 
+    def normalize_key(key)
+      key.to_s.downcase.gsub(/[^a-z0-9]/, "")
+    end
+
+    def secret_key?(key)
+      normalized = normalize_key(key)
+      return false if normalized.empty?
+
+      SCRUB_KEYS.any? { |candidate| normalized.include?(candidate) } ||
+        (@extra_scrub_keys || []).any? { |candidate| normalized.include?(candidate) }
+    end
+
+    # Tells a card number from the order ids and timestamps that look like one.
+    def passes_luhn?(digits)
+      sum = 0
+      double = false
+      digits.reverse.each_char do |char|
+        digit = char.ord - 48
+        if double
+          digit *= 2
+          digit -= 9 if digit > 9
+        end
+        sum += digit
+        double = !double
+      end
+      (sum % 10).zero?
+    end
+
+    # Removes credentials and personal data that leaked into free text.
+    def scrub_text(value)
+      return value if value.empty?
+
+      value
+        .gsub(BEARER_RE, REDACTED)
+        .gsub(JWT_RE, REDACTED)
+        .gsub(DIGIT_RUN_RE) { |run| passes_luhn?(run.delete("^0-9")) ? REDACTED : run }
+        .gsub(EMAIL_RE, REDACTED)
+    end
+
+    # Redacts credential-shaped keys anywhere in the payload, and strips secrets
+    # out of the free text around them. `user` is the field you deliberately fill
+    # with an identity, so its strings are left alone; its keys are still checked.
+    def scrub_value(value, depth, text, seen)
+      case value
+      when String
+        text ? scrub_text(value) : value
+      when Hash, Array
+        return TRUNCATED if depth >= MAX_SCRUB_DEPTH
+        # Walking a copy means a cycle would recurse forever, and a context hash
+        # holding a reference back to itself is worth surviving.
+        return CIRCULAR if seen.include?(value.object_id)
+
+        seen.add(value.object_id)
+        begin
+          scrub_collection(value, depth, text, seen)
+        ensure
+          seen.delete(value.object_id)
+        end
+      else
+        value
+      end
+    end
+
+    def scrub_collection(value, depth, text, seen)
+      return value.map { |item| scrub_value(item, depth + 1, text, seen) } if value.is_a?(Array)
+
+      value.each_with_object({}) do |(key, nested), out|
+        out[key] = if secret_key?(key)
+                     REDACTED
+                   else
+                     scrub_value(nested, depth + 1, text && key.to_s != "user", seen)
+                   end
+      end
+    end
+
+    # The last thing every payload passes through. Both the hook and the
+    # redaction live here rather than in the capture methods, so nothing can be
+    # reported around them.
+    def scrub_payload(payload)
+      hooked = @before_send ? @before_send.call(payload) : payload
+      return nil unless hooked.is_a?(Hash)
+
+      scrub_value(hooked, 0, true, Set.new)
+    end
+
     def post_json(path, payload, idempotency_key:)
       cfg = @config
       return if cfg.nil?
       return unless safe_idempotency_key?(idempotency_key)
       return if cfg.token && cfg.token != "" && !safe_header_value?(cfg.token)
 
+      scrubbed = scrub_payload(payload)
+      return if scrubbed.nil?
+
       begin
         Thread.new do
-          body = JSON.generate(payload)
+          body = JSON.generate(scrubbed)
           uri = URI("#{cfg.url}#{path}")
           http = Net::HTTP.new(uri.host, uri.port)
           http.use_ssl = uri.scheme == "https"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: octri
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.1.0
 platform: ruby
 authors:
 - Octri