railwatch 0.1.0

data/lib/railwatch/record.rb

@@ -0,0 +1,119 @@
+# frozen_string_literal: true
+
+module Railwatch
+  # Builds the flat hash that goes over the wire. Every record carries the same
+  # envelope keys as Nightwatch (v, t, timestamp, deploy, server, _group,
+  # trace_id, execution_*, user) plus tenant.
+  module Record
+    VERSIONS = {
+      request: 1, job_attempt: 1, scheduled_task: 1, command: 1, channel_action: 1,
+      query: 1, n_plus_one: 1, transaction: 1, exception: 1, cache_event: 1, mail: 1,
+      broadcast: 1, notification: 1, outgoing_request: 1, storage_op: 1, view_render: 1,
+      log: 1, enqueued_job: 1, user: 1, deprecation: 1, visit: 1, process: 1, span: 1, health: 1,
+      profile: 1, attachment: 1, session: 1
+    }.freeze
+
+    # Used in place of an execution's envelope when there is no execution, so
+    # build can splat unconditionally instead of allocating then merge!-ing.
+    EMPTY_ENVELOPE = {}.freeze
+
+    module_function
+
+    # One hash literal: base keys, then the execution's (memoised) envelope,
+    # then the caller's fields, each splat overriding the previous on
+    # conflict -- same precedence as the old merge!/merge! chain, but built
+    # in a single allocation instead of three.
+    def build(type, execution, group: nil, timestamp: nil, **fields)
+      config = Railwatch.config
+      {
+        v: VERSIONS.fetch(type),
+        t: type.to_s,
+        timestamp: timestamp || Clock.now,
+        deploy: config.deploy,
+        server: config.server,
+        _group: group,
+        **(execution ? execution.envelope : EMPTY_ENVELOPE),
+        **fields
+      }
+    end
+
+    # Bounds the walk below. A record is a flat-ish tree (headers, files, a
+    # filtered payload); nothing legitimate is deeper, and the bound is also
+    # what makes a self-referential structure terminate.
+    MAX_SIZING_DEPTH = 8
+
+    # How much resident memory a record costs, for the in-memory byte budgets
+    # (Execution#buffer and Buffer#push). Deliberately an estimate built from
+    # O(1) String#bytesize rather than a JSON encode: this runs on the request
+    # thread for every record, and the exact NDJSON size is measured once,
+    # later, on the reporter thread, while the batch is being written. The
+    # constants are CRuby object overhead -- a String header, a Hash entry, an
+    # Array slot -- so the estimate errs high, which is the safe direction for
+    # a memory ceiling.
+    #
+    # Counting stops as soon as `limit` is exceeded: past that the only fact
+    # the caller uses is "too big", so there is no reason to keep walking.
+    def buffered_bytes(value, limit:, depth: 0)
+      return limit + 1 if depth > MAX_SIZING_DEPTH
+
+      bytes = case value
+      when String then 40 + value.bytesize
+      when Hash then hash_bytes(value, limit, depth)
+      when Array then array_bytes(value, limit, depth)
+      when Symbol then 16
+      else 16
+      end
+      bytes > limit ? limit + 1 : bytes
+    end
+
+    def hash_bytes(hash, limit, depth)
+      bytes = 80 + (hash.size * 40)
+      hash.each do |key, value|
+        bytes += buffered_bytes(key, limit: limit, depth: depth + 1)
+        bytes += buffered_bytes(value, limit: limit, depth: depth + 1)
+        break if bytes > limit
+      end
+      bytes
+    end
+
+    def array_bytes(array, limit, depth)
+      bytes = 40 + (array.size * 8)
+      array.each do |value|
+        bytes += buffered_bytes(value, limit: limit, depth: depth + 1)
+        break if bytes > limit
+      end
+      bytes
+    end
+
+    # 128-bit grouping hash. MD5 is the fastest 128-bit digest in stdlib and
+    # is only used for bucketing, never for security.
+    def group_hash(*parts)
+      Digest::MD5.hexdigest(parts.join(","))
+    end
+
+    # URLs are metadata, not request payloads. Keep the useful origin/path
+    # while dropping authority credentials, every query value, and fragments
+    # without relying on strict parsing of application-provided redirects.
+    def url_without_sensitive_components(value, limit:)
+      url = value.to_s
+      query = url.index("?")
+      fragment = url.index("#")
+      cutoff = query && fragment ? [ query, fragment ].min : query || fragment
+      url = url[0, cutoff] if cutoff
+
+      scheme_end = url.index("://")
+      authority_start = if url.start_with?("//")
+        2
+      elsif scheme_end && /\A[A-Za-z][A-Za-z0-9+.-]*\z/.match?(url[0, scheme_end])
+        scheme_end + 3
+      end
+      if authority_start
+        authority_end = url.index("/", authority_start) || url.length
+        userinfo_end = url.rindex("@", authority_end - 1)
+        url = url[0, authority_start] + url[(userinfo_end + 1)..] if userinfo_end && userinfo_end >= authority_start
+      end
+
+      url[0, limit]
+    end
+  end
+end

data/lib/railwatch/redactor.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+module Railwatch
+  # Header and parameter redaction. Parameter redaction reuses the app's own
+  # Rails.application.config.filter_parameters plus Railwatch's list, so
+  # anything the app already hides from logs is hidden here too.
+  class Redactor
+    FILTERED = "[FILTERED]"
+    # Credentials are often carried in vendor-specific headers that an app
+    # cannot enumerate ahead of time (X-Api-Key, Stripe-Signature,
+    # X-Auth-Token, and similar). Match credential-shaped name segments in
+    # addition to the exact configurable denylist.
+    SENSITIVE_HEADER_NAME = %r{
+      (?:\A|-)
+      (?:
+        api-?(?:key|token|secret)|access-?(?:key|token|secret)|
+        private-?(?:key|token)|secret-?key|signing-?key|encryption-?key|
+        auth(?:entication|orization)?(?:-?token)?|bearer(?:-?token)?|
+        client-?(?:secret|token)|session-?token|refresh-?token|
+        security-?token|service-?token|identity-?token|id-?token|
+        csrf-?token|xsrf-?token|credential|
+        hmac(?:-?signature)?|jwt(?:-?(?:assertion|token))?|
+        webhook-?(?:hmac|secret|signature)|token|secret|signature
+      )
+      (?:-|\z)
+    }ix
+
+    def initialize(config)
+      @config = config
+      @header_keys = config.redact_headers.map { |h| h.downcase }.to_set
+      @param_filter = nil
+    end
+
+    def headers(hash)
+      hash.each_with_object({}) do |(k, v), out|
+        out[k] = redact_header?(k) ? FILTERED : v.to_s[0, 512]
+      end
+    end
+
+    # Header names arrive already capitalised ("Authorization"); the lookup
+    # set is lower-case, so cache the downcased form per distinct name.
+    def redact_header?(name)
+      @header_case ||= {}
+      hit = @header_case[name]
+      return hit unless hit.nil?
+      @header_case.clear if @header_case.size > 512
+      normalized = name.to_s.downcase
+      @header_case[name] = @header_keys.include?(normalized) || SENSITIVE_HEADER_NAME.match?(normalized)
+    end
+
+    def params(hash)
+      param_filter.filter(hash)
+    rescue StandardError
+      {}
+    end
+
+    private
+
+    def param_filter
+      @param_filter ||= begin
+        filters = @config.redact_params.dup
+        filters.concat(Rails.application.config.filter_parameters) if defined?(Rails) && Rails.application
+        ActiveSupport::ParameterFilter.new(filters.uniq, mask: FILTERED)
+      end
+    end
+  end
+end

data/lib/railwatch/release_detector.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+module Railwatch
+  # Finds the release already exposed by a deploy platform or checkout without
+  # spawning git during application boot. SHA releases are shortened so every
+  # source produces the same compact deploy value.
+  module ReleaseDetector
+    ENV_KEYS = %w[
+      RAILWATCH_DEPLOY KAMAL_VERSION GIT_REV GIT_SHA SOURCE_VERSION
+      HEROKU_SLUG_COMMIT RENDER_GIT_COMMIT FLY_IMAGE_REF
+      VERCEL_GIT_COMMIT_SHA CI_COMMIT_SHA GITHUB_SHA
+    ].freeze
+    SHA = /\A[0-9a-f]{40}\z/i
+
+    module_function
+
+    def detect(project_root:, env: ENV)
+      ENV_KEYS.each do |key|
+        value = env[key].to_s.strip
+        next if value.empty?
+
+        value = value.rpartition(":").last if key == "FLY_IMAGE_REF"
+        next if value.empty?
+
+        yield key if block_given?
+        return normalize(value)
+      end
+
+      revision = read(File.join(project_root.to_s, "REVISION"))
+      if revision && !revision.strip.empty?
+        yield "REVISION" if block_given?
+        return normalize(revision.strip)
+      end
+
+      sha = git_sha(File.join(project_root.to_s, ".git"))
+      if sha
+        yield "git" if block_given?
+        normalize(sha)
+      end
+    end
+
+    def git_sha(git_dir)
+      git_dir = resolve_gitdir(git_dir)
+      head = read(File.join(git_dir, "HEAD"))&.strip
+      return head if SHA.match?(head.to_s)
+      return unless head&.start_with?("ref: refs/")
+
+      ref = head.delete_prefix("ref: ")
+      return if ref.include?("..") || ref.include?("\\") || ref.end_with?("/")
+
+      # A worktree's gitdir holds HEAD but its refs and packed-refs live in
+      # the repository it was created from, named by its commondir file.
+      refs_dir = read(File.join(git_dir, "commondir"))&.strip
+      refs_dir = refs_dir ? File.expand_path(refs_dir, git_dir) : git_dir
+      loose = read(File.join(refs_dir, ref))&.strip
+      return loose if SHA.match?(loose.to_s)
+
+      packed_ref(refs_dir, ref)
+    end
+    private_class_method :git_sha
+
+    # A worktree's .git is a file naming its gitdir ("gitdir: ...").
+    def resolve_gitdir(git_dir)
+      return git_dir unless File.file?(git_dir)
+
+      pointer = read(git_dir).to_s.strip
+      return git_dir unless pointer.start_with?("gitdir: ")
+
+      File.expand_path(pointer.delete_prefix("gitdir: "), File.dirname(git_dir))
+    end
+    private_class_method :resolve_gitdir
+
+    def packed_ref(git_dir, ref)
+      packed = read(File.join(git_dir, "packed-refs"))
+      return unless packed
+
+      packed.each_line do |line|
+        sha, name = line.strip.split(" ", 2)
+        return sha if name == ref && SHA.match?(sha.to_s)
+      end
+      nil
+    end
+    private_class_method :packed_ref
+
+    def read(path)
+      File.read(path)
+    rescue SystemCallError, IOError
+      nil
+    end
+    private_class_method :read
+
+    def normalize(value)
+      SHA.match?(value) ? value[0, 12] : value
+    end
+    private_class_method :normalize
+  end
+end