ree_lib 1.3.14 → 1.3.16

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2ebed252b6557db13e60268884fd6b1a0f405f256d28aaf18953764886ab6cb0
-  data.tar.gz: e6328fda6013213c588f834b5a0782c271c76686b8303a0f458cfac5e926c80d
+  metadata.gz: 7b6bab291292300f6d1067e79262021b1a1ce40474fd4d3baf2ddec2398c521f
+  data.tar.gz: fe0536bc647d3bd48cbc04197a61fc5415aa8c58fb0aa1578eb90eafaa1c424c
 SHA512:
-  metadata.gz: 06ad16d1ca9361397b0e324d8ab0d9a3a064337831384f45616dd500efb88367c84be252537d203e07ec08cb109e8f976980ff39ac2de315f96938a21edc697e
-  data.tar.gz: fa3b6b910f9855585af6f0e985720db3773d7483779f65d3907badc16711e5bfdd159abcfcd8135466a5a2c57a75645da44c79ba532e0bcd9bf777d50aa7bdd5
+  metadata.gz: 40ec71033ebe98320f43b20cf2dd626272cc313ee3d28540fd333d8aabf403f38c87c502c174184331aa6ca7e44cc6b657e5854a740f75eff844c6e9ab2f64b7
+  data.tar.gz: 03433f0fd291d8709afd41856ed2141e1b418ee39d72ce19148390c86660a7a13411e99f20e0d2a98dac5d37d96fbf05fba845f0ba8b6ae7e1c395e074fc381a

data/CHANGELOG.md

@@ -1,5 +1,16 @@
 ## [Unreleased]
 
+## [1.3.16] - 2026-10-21
+
+- `ree_roda`: the `ree_logger` plugin applies `filter_params` to the query
+  string of the `Request:` line. It used to be logged verbatim, so a secret
+  sent in the URL reached the log even though `Params` showed it filtered.
+  A bracketed name (`user[password]`, also percent-encoded) is matched by
+  each of its segments.
+- `ree_roda`: `filter_params` in the `ree_logger` plugin now walks nested
+  hashes and arrays; it used to check top level keys only. Names are still
+  matched exactly.
+
 ## [1.3.12] - 2026-09-02
 
 - `ree_audit`: `annotate_audit` fn — the entry point product code uses to attach

data/Gemfile.lock

@@ -9,7 +9,7 @@ PATH
 PATH
   remote: .
   specs:
-    ree_lib (1.3.14)
+    ree_lib (1.3.16)
       bigdecimal
       binding_of_caller
       i18n

data/lib/ree_lib/packages/ree_audit/README.md

@@ -115,7 +115,7 @@ Annotating before the check, not after, keeps a refusal in the trail as well:
 | `request_method`, `path`, `request_path` | `path` is the DSL template (stable), `request_path` is the actual path (shows the object) |
 | `params` | what the action received, after filtering |
 | `accessor` | the authenticated object — the application decides how to read it |
-| `status` | `:ok`, `:denied`, `:error` |
+| `status` | `:ok`, `:denied`, `:not_found`, `:error` |
 | `error_type`, `error_message` | present when the call failed; message truncated to 512 chars |
 | `started_at`, `duration_ms` | timing (monotonic clock) |
 | `annotations` | whatever the application attached during the call |
@@ -124,6 +124,12 @@ Annotating before the check, not after, keeps a refusal in the trail as well:
 `:permission`. A refusal to show client data is as much an audit fact as
 showing it.
 
+`:denied` and `:not_found` are split out of `:error` on purpose. A refusal by
+permission and an ordinary "there was nothing to show" are both normal outcomes;
+filing them next to a crash makes a compliance report say something broke when
+nothing did. The split follows the domain error type, so an application gets it
+without classifying anything itself.
+
 There is **no HTTP status** on the event, and that is not an oversight: the
 wrapper sits around the action call, while Roda sets the status afterwards (and,
 on an exception, in the application's `error` block). Observing it here is

data/lib/ree_lib/packages/ree_audit/package/ree_audit/beans/audit.rb

@@ -47,7 +47,7 @@ class ReeAudit::Audit
       event.status = :ok
       result
     rescue StandardError => e
-      event.status = denied?(e) ? :denied : :error
+      event.status = status_for(e)
       event.error_type = e.class.name
       event.error_message = e.message.to_s[0, MAX_ERROR_MESSAGE_LENGTH]
       raise
@@ -62,11 +62,20 @@ class ReeAudit::Audit
 
   private
 
-  # A refusal to show client data is as much an audit fact as showing it.
-  def denied?(e)
-    e.is_a?(ReeErrors::Error) && e.type == :permission
+  # A refusal to show client data is as much an audit fact as showing it — and
+  # it must not be filed next to a crash. Neither must "there was nothing to
+  # show": a domain 404 is an ordinary outcome, and reading it as a failure in a
+  # compliance report tells the reader something broke when nothing did.
+  def status_for(e)
+    return :error if !e.is_a?(ReeErrors::Error)
+
+    case e.type
+    when :permission then :denied
+    when :not_found then :not_found
+    else :error
+    end
   rescue StandardError
-    false
+    :error
   end
 
   # The trail must never be the reason a request fails.

data/lib/ree_lib/packages/ree_audit/package/ree_audit/event.rb

@@ -4,7 +4,7 @@
 # enriched by the application through ReeAudit.annotate, and handed to a sink
 # once the call is over.
 class ReeAudit::Event
-  STATUSES = [:ok, :denied, :error].freeze
+  STATUSES = [:ok, :denied, :not_found, :error].freeze
 
   attr_accessor :action_name, :package_name, :summary, :sections,
                 :request_method, :path, :request_path, :params, :accessor,

data/lib/ree_lib/packages/ree_audit/spec/ree_audit/beans/audit_spec.rb

@@ -3,11 +3,13 @@
 package_require('ree_audit/beans/audit')
 package_require('ree_audit/event')
 package_require('ree_errors/permission_error')
+package_require('ree_errors/not_found_error')
 
 RSpec.describe :audit do
   link :audit, from: :ree_audit
   link :config, from: :ree_audit
   link :permission_error, from: :ree_errors
+  link :not_found_error, from: :ree_errors
   link :logger, from: :ree_logger
 
   # Captures what the application would have persisted.
@@ -89,6 +91,18 @@ RSpec.describe :audit do
     expect(written.error_message).to eq("not allowed")
   end
 
+  # 404 предметной области — обычный исход, а не поломка: строка «нечего
+  # показать» в отчёте соответствия не должна читаться как сбой.
+  it "records a domain not-found as its own outcome, not as a failure" do
+    klass = not_found_error(:missing)
+
+    expect {
+      audit.around(event) { raise klass.new("nothing here") }
+    }.to raise_error(klass)
+
+    expect(test_sink.events.first.status).to eq(:not_found)
+  end
+
   it "records an arbitrary failure as an error and lets it through" do
     expect {
       audit.around(event) { raise ArgumentError.new("boom") }

data/lib/ree_lib/packages/ree_roda/package/ree_roda/plugins/ree_logger.rb

@@ -1,3 +1,4 @@
+require "uri"
 package_require "ree_logger/beans/logger"
 
 class Roda
@@ -50,7 +51,7 @@ class Roda
 
           message = <<~DOC
             Request/Response details:
-              Request: #{env["REQUEST_METHOD"]} #{env["QUERY_STRING"] && !env["QUERY_STRING"].empty? ? env["SCRIPT_NAME"].to_s + env["PATH_INFO"] + "?#{env["QUERY_STRING"]}": env["SCRIPT_NAME"].to_s + env["PATH_INFO"]} #{opts[:ree_logger_log_params] ? "\n  Params: " + _ree_logger_filtered_params.inspect : ""}
+              Request: #{env["REQUEST_METHOD"]} #{_ree_logger_request_path(env)} #{opts[:ree_logger_log_params] ? "\n  Params: " + _ree_logger_filtered_params.inspect : ""}
               Response status: #{response.status || "-"}#{(400..499).include?(response.status) ? "\n  Response body: " + response.body[0].to_s : ""}
               Time Taken: #{elapsed_time}
           DOC
@@ -64,11 +65,69 @@ class Roda
 
           return params if filter_keys.empty?
 
+          _ree_logger_filter_value(params, filter_keys, opts[:ree_logger_filter_params_placeholder])
+        end
+
+        # Keys are matched by exact name at any depth: a password nested in
+        # `{user: {password: ...}}` is still a password. Exact match, unlike the
+        # substring match of ree_audit, keeps `token_id` and the like readable.
+        def _ree_logger_filter_value(value, filter_keys, placeholder)
+          case value
+          when Hash
+            value.each_with_object({}) do |(k, v), h|
+              h[k] = if filter_keys.include?(k.to_s)
+                placeholder
+              else
+                _ree_logger_filter_value(v, filter_keys, placeholder)
+              end
+            end
+          when Array
+            value.map { _ree_logger_filter_value(_1, filter_keys, placeholder) }
+          else
+            value
+          end
+        end
+
+        def _ree_logger_request_path(env)
+          path = env["SCRIPT_NAME"].to_s + env["PATH_INFO"].to_s
+          query = env["QUERY_STRING"]
+
+          return path if query.nil? || query.empty?
+
+          "#{path}?#{_ree_logger_filtered_query(query)}"
+        end
+
+        # The query string is logged verbatim next to the path, so without this
+        # a secret sent in the URL (OAuth callback code, a token from an email
+        # link) reached the log even though Params showed it as filtered.
+        def _ree_logger_filtered_query(query)
+          filter_keys = opts[:ree_logger_filter_params]
+
+          return query if filter_keys.empty?
+
           placeholder = opts[:ree_logger_filter_params_placeholder]
 
-          params.each_with_object({}) do |(k, v), h|
-            h[k] = filter_keys.include?(k.to_s) ? placeholder : v
+          query.split("&", -1).map do |pair|
+            key, value = pair.split("=", 2)
+
+            if value && _ree_logger_filtered_query_key?(key, filter_keys)
+              "#{key}=#{placeholder}"
+            else
+              pair
+            end
+          end.join("&")
+        end
+
+        # `user[password]=...` is the nested form of the same param, so every
+        # bracket segment of the name is checked.
+        def _ree_logger_filtered_query_key?(key, filter_keys)
+          name = begin
+            URI.decode_www_form_component(key)
+          rescue ArgumentError
+            key
           end
+
+          name.scan(/[^\[\]]+/).any? { filter_keys.include?(_1) }
         end
 
         # Create timer instance used for timing

data/lib/ree_lib/packages/ree_roda/spec/ree_roda/plugins/ree_logger_spec.rb

@@ -3,34 +3,107 @@
 package_require("ree_roda/plugins/ree_logger")
 
 RSpec.describe :ree_logger do
-  it "filters request params" do
-    class TestFilterApp < ReeRoda::App
+  class TestFilterLogger
+    def info(msg)
+      logs << msg
+    end
+
+    def logs
+      @logs ||= []
+    end
+  end
+
+  let(:logger) { TestFilterLogger.new }
+
+  let(:app) {
+    log = logger
+
+    Class.new(ReeRoda::App) do
+      plugin(:ree_logger, ree_logger: log, filter_params: ["password", "token"])
+
       route do |r|
-        r.get "health" do
+        r.is "health" do
           "success"
         end
-
-        r.ree_routes
       end
     end
+  }
 
+  def request_line
+    logger.logs.first.lines.find { _1.include?("Request:") }
+  end
+
+  def params_line
+    logger.logs.first.lines.find { _1.include?("Params:") }
+  end
+
+  it "filters request params" do
     env = { "REQUEST_METHOD" => "GET", "PATH_INFO" => "/health", "QUERY_STRING" => "email=test@example.com&password=password" }
 
-    class TestFilterLogger
-      def info(msg)
-        @logs ||= []
-        @logs << msg
-      end
+    app.app.call(env)
+
+    expect(logger.logs.first).to match('"password" => "\[FILTERED\]"')
+  end
+
+  it "filters secrets in the query string of the request line" do
+    env = { "REQUEST_METHOD" => "GET", "PATH_INFO" => "/health", "QUERY_STRING" => "email=test%40example.com&password=s3cret&token=tok-1" }
+
+    app.app.call(env)
 
-      def logs
-        @logs
+    expect(request_line).to include("/health?email=test%40example.com&password=[FILTERED]&token=[FILTERED]")
+    expect(logger.logs.first).not_to include("s3cret")
+    expect(logger.logs.first).not_to include("tok-1")
+  end
+
+  it "filters bracketed and encoded names in the query string" do
+    env = { "REQUEST_METHOD" => "GET", "PATH_INFO" => "/health", "QUERY_STRING" => "user%5Bpassword%5D=s3cret&user[name]=bob&token_id=7" }
+
+    app.app.call(env)
+
+    expect(request_line).to include("user%5Bpassword%5D=[FILTERED]&user[name]=bob&token_id=7")
+    expect(logger.logs.first).not_to include("s3cret")
+    expect(params_line).to include('"token_id" => "7"')
+  end
+
+  it "keeps an empty query string out of the request line" do
+    env = { "REQUEST_METHOD" => "GET", "PATH_INFO" => "/health", "QUERY_STRING" => "" }
+
+    app.app.call(env)
+
+    expect(request_line).to include("Request: GET /health \n")
+  end
+
+  it "filters nested params of a JSON body" do
+    body = '{"user":{"name":"bob","password":"s3cret"},"sessions":[{"token":"tok-1","id":1}]}'
+    env = {
+      "REQUEST_METHOD" => "POST", "PATH_INFO" => "/health",
+      "CONTENT_TYPE" => "application/json", "rack.input" => StringIO.new(body)
+    }
+
+    app.app.call(env)
+
+    expect(params_line).to include('"name" => "bob"')
+    expect(params_line).to include('"id" => 1')
+    expect(logger.logs.first).not_to include("s3cret")
+    expect(logger.logs.first).not_to include("tok-1")
+  end
+
+  it "logs the query string untouched without filter params" do
+    log = logger
+    plain_app = Class.new(ReeRoda::App) do
+      plugin(:ree_logger, ree_logger: log)
+
+      route do |r|
+        r.is "health" do
+          "success"
+        end
       end
     end
-    logger = TestFilterLogger.new
 
-    TestFilterApp.plugin(:ree_logger, ree_logger: logger, filter_params: ['password'])
-    TestFilterApp.app.call(env)
+    env = { "REQUEST_METHOD" => "GET", "PATH_INFO" => "/health", "QUERY_STRING" => "password=p" }
 
-    expect(logger.logs.first).to match('"password" => "\[FILTERED\]"')
+    plain_app.app.call(env)
+
+    expect(request_line).to include("/health?password=p")
   end
-end
+end

data/lib/ree_lib/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ReeLib
-  VERSION = "1.3.14"
+  VERSION = "1.3.16"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ree_lib
 version: !ruby/object:Gem::Version
-  version: 1.3.14
+  version: 1.3.16
 platform: ruby
 authors:
 - Ruslan Gatiyatov