realuptime-errors 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cfb6b588d319a4a1ceb6dd9a50d0520b494b4e1066056ce4b87261c97237c130
-  data.tar.gz: a5026d3e87519f3f6ddd140da1e25433b410c970548499f89a5e439d8de96ea8
+  metadata.gz: 288a63586cd55e7e41a173f368ab8321080037f6d91e7e67075088121d4b59bd
+  data.tar.gz: 1e2e73b36ea00e394abe1b1111249e130da6f9ef6a17fbf1715a9426bfb1278c
 SHA512:
-  metadata.gz: 970d101abb8765cff0170a9a19fcf5a1b82697349334c6a463d26ed56f7520e0fb623e91e80b80c27090dee79b0076f55e2b13921103056e186ac5021e67cddc
-  data.tar.gz: c05b0bffcd6ca1079e4c278c132fc8a090b73caf4796b5c7a90bcca78fcedf6598cf72b65760bb281e4ee1b2030dbedd72e1c2946cdf213cc900bc52a17cee25
+  metadata.gz: 5efbe30a69ed3b6b0a895bfe281d24cd4bb62ae251d591b7d931eb54069f5e1057e2b49f92da398b0684dd4ba356ac3e8ae4b30bb2a198d9e2ed5dfcab456691
+  data.tar.gz: 3f9a1392ae7b296ff85149dcc1e175cb8689d1e2460e37e1206b33c330040b840b759897131cc7feae4890533f55b52f3242dea2a4c2f758a28003748d4672ef

data/README.md

@@ -11,10 +11,15 @@ they merge upstream.
 
 ## Install
 
-Installs straight from GitHub today. npm, PyPI, RubyGems, and Packagist packages are coming; this note disappears the day they ship.
+Installable from the package registry (primary) or straight from this mirror's git history (e.g. to pin an exact commit).
 
 ```ruby
 # Gemfile
+gem "realuptime-errors"
+```
+
+```ruby
+# or, straight from this mirror
 gem "realuptime-errors", git: "https://github.com/RealUptimeHQ/realuptime-errors-ruby"
 ```
 
@@ -32,7 +37,7 @@ Realuptime::Errors.init(
 Realuptime::Errors.capture_exception(some_error)
 ```
 
-Rails: `gem "realuptime-errors", git: "...", require: "realuptime/errors/rails"`,
+Rails: `gem "realuptime-errors", require: "realuptime/errors/rails"`,
 then set `Rails.application.config.realuptime_errors.dsn` (or
 `ENV["REALUPTIME_ERRORS_DSN"]`); the Railtie installs the Rack middleware
 and the ActiveJob hook.
@@ -86,7 +91,7 @@ ruby -Ilib -Itest -e 'Dir["test/*_test.rb"].each { |f| require "./#{f}" }'
 
 ## Version
 
-This mirror tracks SDK_VERSION `0.1.0` in `lib/realuptime/errors/version.rb`,
+This mirror tracks SDK_VERSION `0.1.1` in `lib/realuptime/errors/version.rb`,
 the string every event actually carries on the wire.
 
 ## License

data/lib/realuptime/errors/rails.rb

@@ -13,7 +13,7 @@ module Realuptime
     #   gem "realuptime-errors", require: "realuptime/errors/rails"
     #
     #   # config/initializers/realuptime_errors.rb (or ENV REALUPTIME_ERRORS_DSN)
-    #   Rails.application.config.realuptime_errors.dsn = "https://realuptime.io/api/errors/v1/ingest/rue_..."
+    #   Rails.application.config.realuptime_errors.dsn = "https://ingest.realuptime.io/api/errors/v1/ingest/rue_..."
     #   Rails.application.config.realuptime_errors.release = ENV["GIT_SHA"]
     #
     # What the Railtie installs, all through the ONE capture/scrub/transport

data/lib/realuptime/errors/scrub.rb

@@ -2,7 +2,7 @@
 
 module Realuptime
   module Errors
-    # PII scrub-by-default, client-side (docs/errors-plan.md, "PII
+    # PII scrub-by-default, client-side (the internal-docs repo's errors-plan.md, "PII
     # scrub-by-default, specified"). A byte-for-byte port of
     # packages/errors-js/scrub.ts and packages/errors-py/realuptime_errors.py's
     # scrub half; the shared vectors (scrub-vectors.json, vendored into this
@@ -30,13 +30,41 @@ module Realuptime
       REMOVED_USER_FIELDS = %w[user.email user.username].freeze
 
       JWT_RE = /\beyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\b/.freeze
-      PREFIXED_KEY_RE = /\b(?:sk|pk|rk|ghp|gho|ghs|xox[a-z]|rua|rue|ru_live)_[A-Za-z0-9_-]{8,}/.freeze
+      PREFIXED_KEY_RE = /\b(?:sk|pk|rk|ghp|gho|ghs|xox[a-z]|rua|rue|ru_live|whsec)_[A-Za-z0-9_-]{8,}/.freeze
+      AWS_KEY_RE = /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/.freeze
       CARD_RE = /(?<!\d)(?:\d[ -]?){12,18}\d(?!\d)/.freeze
       HEX_RE = /\b[0-9a-fA-F]{32,}\b/.freeze
       BASE64_RE = /(?<![A-Za-z0-9+_=-])[A-Za-z0-9+_-]{40,}={0,2}/.freeze
+      URL_CREDS_RE = %r{\b([a-zA-Z][a-zA-Z0-9+.-]*)://[^\s/@]+:[^\s/@]+@}.freeze
+
+      # Key-name denylist (REA-474): see packages/errors-js/scrub.ts's module
+      # doc for the full rationale. Matched against whole camelCase/
+      # snake_case segments (and contiguous joins of them) so "tokenizer"
+      # and "authentic" never match "token" / "auth".
+      KEY_DENYLIST = %w[
+        password passwd secret token apikey auth authorization
+        credential credentials privatekey accesskey session
+      ].freeze
 
       module_function
 
+      def key_segments(key)
+        spaced = key.to_s.gsub(/([a-z0-9])([A-Z])/, '\1_\2')
+        spaced.split(/[^a-zA-Z0-9]+/).reject(&:empty?).map(&:downcase)
+      end
+
+      def key_denylisted?(key)
+        segments = key_segments(key)
+        segments.each_index do |i|
+          joined = +""
+          (i...segments.length).each do |j|
+            joined << segments[j]
+            return true if KEY_DENYLIST.include?(joined)
+          end
+        end
+        false
+      end
+
       def luhn_valid?(digits)
         total = 0
         double = false
@@ -52,10 +80,12 @@ module Realuptime
         (total % 10).zero?
       end
 
-      # The five pattern rules over one string. Pure.
+      # The pattern rules over one string, in the shared order. Pure.
       def scrub_string(value)
-        out = value.gsub(JWT_RE, SCRUBBED)
+        out = value.gsub(URL_CREDS_RE) { "#{Regexp.last_match(1)}://#{SCRUBBED}@" }
+        out = out.gsub(JWT_RE, SCRUBBED)
         out = out.gsub(PREFIXED_KEY_RE, SCRUBBED)
+        out = out.gsub(AWS_KEY_RE, SCRUBBED)
         out = out.gsub(CARD_RE) do |run|
           digits = run.delete(" -")
           digits.length >= 13 && digits.length <= 19 && luhn_valid?(digits) ? SCRUBBED : run
@@ -64,14 +94,21 @@ module Realuptime
         out.gsub(BASE64_RE, SCRUBBED)
       end
 
-      # A flat string map (tags, custom context, device, frame locals):
-      # VALUES pass the pattern rules, KEYS are left alone (a key is a label
-      # the integrator chose).
+      # A flat string map (tags, custom context, device, frame locals): a
+      # key denylisted by name (REA-474) replaces the value whole,
+      # regardless of shape; otherwise the value passes the pattern rules.
+      # Keys themselves are always left alone.
       def scrub_string_map(value)
         return value unless value.is_a?(Hash)
 
         value.each_with_object({}) do |(name, entry), out|
-          out[name] = entry.is_a?(String) ? scrub_string(entry) : entry
+          out[name] = if !entry.is_a?(String)
+                        entry
+                      elsif key_denylisted?(name)
+                        SCRUBBED
+                      else
+                        scrub_string(entry)
+                      end
         end
       end
 
@@ -134,7 +171,7 @@ module Realuptime
           if headers.is_a?(Hash)
             request["headers"] = headers.each_with_object({}) do |(name, value), scrubbed|
               lower = name.to_s.downcase
-              scrubbed[name] = if REMOVED_HEADERS.include?(lower) && !allowed.include?(lower)
+              scrubbed[name] = if (REMOVED_HEADERS.include?(lower) || key_denylisted?(lower)) && !allowed.include?(lower)
                                  SCRUBBED
                                else
                                  value.is_a?(String) ? scrub_string(value) : value

data/lib/realuptime/errors/version.rb

@@ -5,6 +5,11 @@ module Realuptime
     SDK_NAME = "realuptime-errors-ruby"
     # The string every batch carries on the wire ("sdk" field); the gemspec
     # and the public mirror's version both read this constant.
-    SDK_VERSION = "0.1.0"
+    # REA-567: bumped from 0.1.0 (the version currently live on RubyGems)
+    # so a republish carries the key-name redaction pass (REA-474) and the
+    # ingest.realuptime.io host change (REA-473) that landed after 0.1.0
+    # shipped. No feature was added, so this is a patch bump, not a minor
+    # one.
+    SDK_VERSION = "0.1.1"
   end
 end

data/lib/realuptime/errors.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 # realuptime-errors: zero-dependency Ruby error tracking SDK for RealUptime
-# Errors (docs/errors-plan.md, Linear REA-255).
+# Errors (the internal-docs repo's errors-plan.md, Linear REA-255).
 #
 # One wire contract with the JS and Python SDKs (packages/errors-js/types.ts);
 # the shared scrub vectors (scrub-vectors.json, vendored into this gem and
@@ -18,7 +18,7 @@
 # Usage:
 #
 #   require "realuptime/errors"
-#   Realuptime::Errors.init(dsn: "https://realuptime.io/api/errors/v1/ingest/rue_...",
+#   Realuptime::Errors.init(dsn: "https://ingest.realuptime.io/api/errors/v1/ingest/rue_...",
 #                           release: "v2.4.1", environment: "production")
 #   ...
 #   Realuptime::Errors.capture_exception(error)

data/scrub-vectors.json

@@ -1,5 +1,5 @@
 {
-  "comment": "Shared PII-scrub test vectors for the Errors SDKs and the server-side second net (docs/errors-plan.md, 'The SDKs: two languages, one contract'). Consumed by packages/errors-js/scrub.test.ts, packages/errors-py/tests/test_scrub.py, and packages/db/error-scrub.test.ts. All three implementations must produce byte-identical output for every vector; a semantic change here is a wire-contract change and needs all three updated in one PR. The server's second net applies the PATTERN rules only: FIELD REMOVAL (removed headers, and v2's user.email / user.username) and allowFields are client-side duties -- a field that reaches the server was either never in the removal set or was deliberately opted back in, and the server cannot tell which. Vectors where the server's output therefore differs carry expectedServer; absent it, the server expects `expected`. Vectors named 'v2 ...' cover the REA-182 additions (identity, tags, custom context, device metadata, matched route, frame locals); every v1 vector above them is unchanged, which is itself part of the additive guarantee.",
+  "comment": "Shared PII-scrub test vectors for the Errors SDKs and the server-side second net (the internal-docs repo's errors-plan.md, 'The SDKs: two languages, one contract'). Consumed by packages/errors-js/scrub.test.ts, packages/errors-py/tests/test_scrub.py, and packages/db/error-scrub.test.ts. All three implementations must produce byte-identical output for every vector; a semantic change here is a wire-contract change and needs all three updated in one PR. The server's second net applies the PATTERN rules only: FIELD REMOVAL (removed headers, and v2's user.email / user.username) and allowFields are client-side duties -- a field that reaches the server was either never in the removal set or was deliberately opted back in, and the server cannot tell which. Vectors where the server's output therefore differs carry expectedServer; absent it, the server expects `expected`. Vectors named 'v2 ...' cover the REA-182 additions (identity, tags, custom context, device metadata, matched route, frame locals); every v1 vector above them is unchanged, which is itself part of the additive guarantee.",
   "version": 2,
   "vectors": [
     {
@@ -501,6 +501,190 @@
         "request": { "method": "GET", "path": "/orders/8842", "route": "/orders/:id", "status": 500 },
         "device": { "runtime": "node", "runtimeVersion": "22.4.0" }
       }
+    },
+
+    {
+      "name": "REA-474 key-name denylist: context password key redacted regardless of value shape",
+      "event": {
+        "message": "boom",
+        "context": { "db_password": "hunter2", "cartTotal": "49.99" }
+      },
+      "expected": {
+        "message": "boom",
+        "context": { "db_password": "[scrubbed]", "cartTotal": "49.99" }
+      }
+    },
+    {
+      "name": "REA-474 key-name denylist: tag named secret redacted regardless of value shape",
+      "event": {
+        "message": "boom",
+        "tags": { "client_secret": "not-shaped-like-anything", "plan": "growth" }
+      },
+      "expected": {
+        "message": "boom",
+        "tags": { "client_secret": "[scrubbed]", "plan": "growth" }
+      }
+    },
+    {
+      "name": "REA-474 key-name denylist: camelCase apiKey in frame vars redacted",
+      "event": {
+        "message": "boom",
+        "frames": [
+          {
+            "file": "app/billing.py",
+            "function": "charge",
+            "line": 12,
+            "inApp": true,
+            "vars": { "apiKey": "not-shaped-like-anything", "attempt": "3" }
+          }
+        ]
+      },
+      "expected": {
+        "message": "boom",
+        "frames": [
+          {
+            "file": "app/billing.py",
+            "function": "charge",
+            "line": 12,
+            "inApp": true,
+            "vars": { "apiKey": "[scrubbed]", "attempt": "3" }
+          }
+        ]
+      }
+    },
+    {
+      "name": "REA-474 key-name denylist: private_key and access_key in custom context redacted (device is a closed shape in some SDKs, so this uses context instead)",
+      "event": {
+        "message": "boom",
+        "context": { "private_key": "not-shaped", "access_key": "not-shaped", "cartTotal": "49.99" }
+      },
+      "expected": {
+        "message": "boom",
+        "context": { "private_key": "[scrubbed]", "access_key": "[scrubbed]", "cartTotal": "49.99" }
+      }
+    },
+    {
+      "name": "REA-474 key-name denylist: breadcrumb data session key redacted",
+      "event": {
+        "message": "boom",
+        "breadcrumbs": [
+          {
+            "timestamp": null,
+            "category": "auth",
+            "message": "login attempt",
+            "data": { "session": "not-shaped-like-anything", "outcome": "ok" }
+          }
+        ]
+      },
+      "expected": {
+        "message": "boom",
+        "breadcrumbs": [
+          {
+            "timestamp": null,
+            "category": "auth",
+            "message": "login attempt",
+            "data": { "session": "[scrubbed]", "outcome": "ok" }
+          }
+        ]
+      }
+    },
+    {
+      "name": "REA-474 key-name denylist: near-miss key names are NOT redacted (tokenizer, authentic)",
+      "event": {
+        "message": "boom",
+        "context": { "tokenizer": "gpt2", "authentic": "yes" }
+      },
+      "expected": {
+        "message": "boom",
+        "context": { "tokenizer": "gpt2", "authentic": "yes" }
+      }
+    },
+    {
+      "name": "REA-474 key-name denylist: a header named by key alone (x-auth-token) is removed client-side; the server has no name-based removal so it stays (value fails the pattern rules)",
+      "event": {
+        "message": "boom",
+        "request": {
+          "method": "GET",
+          "path": "/v1/charge",
+          "status": 500,
+          "headers": { "x-auth-token": "not-shaped-like-anything", "x-request-id": "req-1" }
+        }
+      },
+      "expected": {
+        "message": "boom",
+        "request": {
+          "method": "GET",
+          "path": "/v1/charge",
+          "status": 500,
+          "headers": { "x-auth-token": "[scrubbed]", "x-request-id": "req-1" }
+        }
+      },
+      "expectedServer": {
+        "message": "boom",
+        "request": {
+          "method": "GET",
+          "path": "/v1/charge",
+          "status": 500,
+          "headers": { "x-auth-token": "not-shaped-like-anything", "x-request-id": "req-1" }
+        }
+      }
+    },
+    {
+      "name": "REA-474 key-name denylist: allowFields opts a denylisted header name back in, same as an explicitly removed header",
+      "allowFields": ["x-auth-token"],
+      "event": {
+        "message": "boom",
+        "request": {
+          "method": "GET",
+          "path": "/v1/charge",
+          "status": 500,
+          "headers": { "x-auth-token": "not-shaped-like-anything" }
+        }
+      },
+      "expected": {
+        "message": "boom",
+        "request": {
+          "method": "GET",
+          "path": "/v1/charge",
+          "status": 500,
+          "headers": { "x-auth-token": "not-shaped-like-anything" }
+        }
+      }
+    },
+    {
+      "name": "REA-474 value shape: AWS access key id (AKIA) is scrubbed",
+      "event": { "message": "leaked creds AKIAIOSFODNN7EXAMPLE in log" },
+      "expected": { "message": "leaked creds [scrubbed] in log" }
+    },
+    {
+      "name": "REA-474 value shape: AWS temporary access key id (ASIA) is scrubbed",
+      "event": { "message": "leaked creds ASIAIOSFODNN7EXAMPLE in log" },
+      "expected": { "message": "leaked creds [scrubbed] in log" }
+    },
+    {
+      "name": "REA-474 value shape: a short AKIA-prefixed run stays (not the 16-char shape)",
+      "event": { "message": "AKIA123 is not a real key" },
+      "expected": { "message": "AKIA123 is not a real key" }
+    },
+    {
+      "name": "REA-474 value shape: Stripe webhook signing secret (whsec_) is scrubbed",
+      "event": { "message": "signature check failed for whsec_abcdefgh12345678" },
+      "expected": { "message": "signature check failed for [scrubbed]" }
+    },
+    {
+      "name": "REA-474 value shape: a postgres connection string's userinfo is scrubbed; host stays readable",
+      "event": { "message": "connect failed: postgres://dbuser:hunter2@db.internal:5432/app" },
+      "expected": { "message": "connect failed: postgres://[scrubbed]@db.internal:5432/app" }
+    },
+    {
+      "name": "REA-474 value shape: an https URL with userinfo credentials is scrubbed; host and path stay",
+      "event": { "message": "fetch failed for https://svc:s3cr3t-pass@api.example.com/v1/orders" },
+      "expected": { "message": "fetch failed for https://[scrubbed]@api.example.com/v1/orders" }
+    },
+    {
+      "name": "REA-474 value shape: a plain URL with no userinfo is left alone",
+      "event": { "message": "fetch failed for https://api.example.com/v1/orders" },
+      "expected": { "message": "fetch failed for https://api.example.com/v1/orders" }
     }
   ]
 }

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: realuptime-errors
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - RealUptime
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-08-24 00:00:00.000000000 Z
+date: 2026-09-25 00:00:00.000000000 Z
 dependencies: []
 description: Captures exceptions with scrub-by-default PII handling, bounded buffering
   with honest drop counters, and framework integrations for Rails, Rack and Sidekiq.