@apifuse/provider-sdk 2.2.0-beta.59 → 2.2.0-beta.60

package/src/server/trace-output.ts

@@ -1,4 +1,11 @@
 import { isSensitiveFixtureKey, REDACTED_FIXTURE_VALUE } from "../fixture-sanitization.js";
+import {
+	type DiagnosticRedactor,
+	redactedKeyAllocator,
+	isRedactedKey,
+	REDACTION_FAILED,
+	redactDiagnosticText,
+} from "../runtime/diagnostic-redactor.js";
 import {
 	OTEL_EXPORTER_OTLP_ENDPOINT,
 	OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,
@@ -22,6 +29,16 @@ import type { TraceConfig } from "../types.js";
 
 type EnvLike = Record<string, string | undefined>;
 
+const TRACE_RESOURCE_ATTRIBUTE_SANITIZER = Symbol.for(
+	"@apifuse/provider-sdk/runtime/trace-resource-attribute-sanitizer",
+);
+
+type ResourceAttributesWithSanitizer = Record<string, string> & {
+	[TRACE_RESOURCE_ATTRIBUTE_SANITIZER]?: (
+		attributes: Record<string, string>,
+	) => Record<string, string>;
+};
+
 // Warn once per environment object: process.env in production, each injected env in tests.
 const warnedEnvironments = new WeakSet<EnvLike>();
 const warnedResourceEnvironments = new WeakSet<EnvLike>();
@@ -73,22 +90,52 @@ function resolveServerOTLPExportOptions(
 function resolveExportResourceAttributes(
 	requestAttributes: Record<string, string>,
 	env: EnvLike,
-): Record<string, string> {
+	redact?: DiagnosticRedactor,
+): {
+	attributes: Record<string, string>;
+	sanitize: (attributes: Record<string, string>) => Record<string, string>;
+} {
 	const resolution = resolveOTLPResourceAttributes({}, env);
 	warnDiscardedResourceAttributes(env, resolution);
-	const operatorAttributes = Object.fromEntries(
-		Object.entries(resolution.attributes).map(([key, value]) => [
-			sanitizeSpanNameForOutput(key),
-			isSensitiveFixtureKey(key) ? REDACTED_FIXTURE_VALUE : sanitizeSpanNameForOutput(value),
-		]),
-	);
-	const sanitizedRequestAttributes = Object.fromEntries(
-		Object.entries(sanitizeTraceAttributes(requestAttributes)).map(([key, value]) => [
-			key,
-			String(value),
-		]),
-	);
-	return { ...operatorAttributes, ...sanitizedRequestAttributes };
+	const operatorAttributes = resolution.attributes;
+	const requestKeys = new Set(Object.keys(requestAttributes));
+	return {
+		// Keep the raw snapshot private until export. A credential registered after
+		// trace creation must be matched before any key or value is bounded.
+		attributes: { ...operatorAttributes, ...requestAttributes },
+		sanitize(attributes) {
+			const nextKey = redactedKeyAllocator(Object.keys(attributes));
+			const sanitizedOperatorAttributes: Record<string, string> = {};
+			const rawRequestAttributes: Record<string, string> = {};
+			for (const [key, value] of Object.entries(attributes)) {
+				const unchangedOperatorValue = !requestKeys.has(key) && operatorAttributes[key] === value;
+				if (unchangedOperatorValue) {
+					const redactedKey = isRedactedKey(key) ? key : redactDiagnosticText(key, redact);
+					const keyChanged = redactedKey !== key;
+					const sanitizedKey = keyChanged ? nextKey() : sanitizeSpanNameForOutput(key);
+					sanitizedOperatorAttributes[sanitizedKey] = keyChanged
+						? redactedKey === REDACTION_FAILED
+							? REDACTION_FAILED
+							: REDACTED_FIXTURE_VALUE
+						: isSensitiveFixtureKey(key)
+							? REDACTED_FIXTURE_VALUE
+							: sanitizeSpanNameForOutput(value, redact);
+				} else {
+					rawRequestAttributes[key] = value;
+				}
+			}
+			const sanitizedRequestAttributes = Object.fromEntries(
+				Object.entries(
+					sanitizeTraceAttributes(
+						rawRequestAttributes,
+						redact,
+						Object.keys(sanitizedOperatorAttributes),
+					),
+				).map(([key, value]) => [key, String(value)]),
+			);
+			return { ...sanitizedOperatorAttributes, ...sanitizedRequestAttributes };
+		},
+	};
 }
 
 /** Server-only trace output policy. Shared programmatic trace callers stay in-memory. */
@@ -96,12 +143,14 @@ export function resolveServerTraceContextOptions(
 	config: TraceConfig,
 	resourceAttributes: Record<string, string>,
 	env: EnvLike = process.env,
+	redact?: DiagnosticRedactor,
 ): CreateTraceContextOptions {
 	const resolved = resolveTraceContextOptions(config);
 	const outputEnabled = config.enabled !== false && config.exporter !== "none";
 	const consoleHook =
 		outputEnabled && (config.exporter === "console" || config.exporter === "json")
-			? (span: Span) => console.log(JSON.stringify(sanitizeSpanForOutput(span, resourceAttributes)))
+			? (span: Span) =>
+					console.log(JSON.stringify(sanitizeSpanForOutput(span, resourceAttributes, redact)))
 			: undefined;
 	const onSpan =
 		consoleHook && resolved.onSpan
@@ -114,15 +163,26 @@ export function resolveServerTraceContextOptions(
 		outputEnabled && config.exporter === "otlp"
 			? resolveServerOTLPExportOptions(config, env)
 			: undefined;
+	const exportResources = exportOptions
+		? resolveExportResourceAttributes(resourceAttributes, env, redact)
+		: undefined;
+	if (exportResources) {
+		Object.defineProperty(
+			exportResources.attributes as ResourceAttributesWithSanitizer,
+			TRACE_RESOURCE_ATTRIBUTE_SANITIZER,
+			{ value: exportResources.sanitize },
+		);
+	}
 
 	return {
 		maxSpans: resolved.maxSpans,
 		onSpan,
+		...(redact ? { redact } : {}),
 		...(exportOptions
 			? {
 					exportOptions,
-					resourceAttributes: resolveExportResourceAttributes(resourceAttributes, env),
-					sanitizeSpanForExport: (span: Span) => sanitizeSpanForOutput(span),
+					resourceAttributes: exportResources?.attributes,
+					sanitizeSpanForExport: (span: Span) => sanitizeSpanForOutput(span, undefined, redact),
 				}
 			: {}),
 	};

package/src/trace-sanitization.ts

@@ -4,20 +4,33 @@ import {
 	REDACTED_FIXTURE_VALUE,
 	sanitizeDiagnosticText,
 } from "./fixture-sanitization.js";
+import {
+	type DiagnosticRedactor,
+	diagnosticStructuredRedactor,
+	redactDiagnosticAttributeKey,
+	copyDiagnosticAttributeTypes,
+	isDiagnosticBigintAttribute,
+	redactedKeyAllocator,
+	isRedactedKey,
+	redactCriticalDiagnosticText,
+	diagnosticAttributeRedactor,
+	REDACTION_FAILED,
+	redactDiagnosticText,
+} from "./runtime/diagnostic-redactor.js";
 import type { TraceSpan } from "./types.js";
 
 const MAX_TRACE_TEXT_LENGTH = 300;
 
-function sanitizeTraceText(value: string): string {
-	const encoded = sanitizeDiagnosticText(value);
+function sanitizeTraceText(value: string, redact?: DiagnosticRedactor): string {
+	const encoded = sanitizeDiagnosticText(redactDiagnosticText(value, redact));
 	return encoded.length > MAX_TRACE_TEXT_LENGTH
 		? `${encoded.slice(0, MAX_TRACE_TEXT_LENGTH)}… [truncated]`
 		: encoded;
 }
 
 /** Span names are SDK-authored identifiers; retain them while preventing log injection. */
-export function sanitizeSpanNameForOutput(value: string): string {
-	const encoded = encodeDiagnosticControls(value);
+export function sanitizeSpanNameForOutput(value: string, redact?: DiagnosticRedactor): string {
+	const encoded = encodeDiagnosticControls(redactDiagnosticText(value, redact));
 	return encoded.length > MAX_TRACE_TEXT_LENGTH
 		? `${encoded.slice(0, MAX_TRACE_TEXT_LENGTH)}… [truncated]`
 		: encoded;
@@ -25,39 +38,73 @@ export function sanitizeSpanNameForOutput(value: string): string {
 
 export function sanitizeTraceAttributes(
 	attributes: Record<string, unknown>,
+	redact?: DiagnosticRedactor,
+	reservedKeys: Iterable<string> = [],
 ): Record<string, string | number | boolean> {
-	return Object.fromEntries(
-		Object.entries(attributes).map(([key, value]) => [
-			sanitizeTraceText(key),
-			isSensitiveFixtureKey(key)
-				? REDACTED_FIXTURE_VALUE
-				: typeof value === "string"
-					? sanitizeTraceText(value)
-					: typeof value === "number" || typeof value === "boolean"
-						? value
-						: sanitizeTraceText(String(value)),
-		]),
+	const nextKey = redactedKeyAllocator([...Object.keys(attributes), ...reservedKeys]);
+	return copyDiagnosticAttributeTypes(
+		attributes,
+		Object.fromEntries(
+			Object.entries(attributes).map(([key, value]) => {
+				const redactedKey = isRedactedKey(key) ? key : redactDiagnosticAttributeKey(key, redact);
+				const keyChanged = redactedKey !== key;
+				const sanitizedKey = keyChanged ? nextKey() : sanitizeTraceText(key);
+				const valueRedactor =
+					typeof value === "bigint" || isDiagnosticBigintAttribute(attributes, key)
+						? diagnosticStructuredRedactor(redact)
+						: diagnosticAttributeRedactor(key, redact);
+				const sanitizedValue = keyChanged
+					? redactedKey === REDACTION_FAILED
+						? REDACTION_FAILED
+						: REDACTED_FIXTURE_VALUE
+					: isSensitiveFixtureKey(key)
+						? REDACTED_FIXTURE_VALUE
+						: typeof value === "bigint" || isDiagnosticBigintAttribute(attributes, key)
+							? String(value).length < 8
+								? String(value)
+								: sanitizeTraceText(String(value), valueRedactor)
+							: typeof value === "string"
+								? sanitizeTraceText(value, valueRedactor)
+								: typeof value === "number" || typeof value === "boolean"
+									? (() => {
+											if (String(value).length < 8) return value;
+											const redacted = redactDiagnosticText(
+												String(value),
+												diagnosticStructuredRedactor(valueRedactor),
+											);
+											return redacted === String(value) ? value : sanitizeTraceText(redacted);
+										})()
+									: sanitizeTraceText(String(value), valueRedactor);
+				return [sanitizedKey, sanitizedValue];
+			}),
+		),
 	);
 }
 
 export function sanitizeSpanForOutput(
 	span: TraceSpan,
 	additionalAttributes?: Record<string, string>,
+	redact?: DiagnosticRedactor,
 ): TraceSpan {
 	// Keep this schema explicit so future fields are not silently added to a
 	// process output path before their trust boundary has been reviewed.
 	return {
-		id: span.id,
-		name: sanitizeSpanNameForOutput(span.name),
+		id: redactCriticalDiagnosticText(span.id, redact),
+		name: sanitizeSpanNameForOutput(redactCriticalDiagnosticText(span.name, redact)),
 		startedAt: span.startedAt,
 		endedAt: span.endedAt,
 		duration_ms: span.duration_ms,
 		status: span.status,
-		attributes: sanitizeTraceAttributes({
-			...span.attributes,
-			...(additionalAttributes ?? {}),
-		}),
-		...(span.error !== undefined ? { error: sanitizeTraceText(span.error) } : {}),
-		...(span.parentId !== undefined ? { parentId: span.parentId } : {}),
+		attributes: sanitizeTraceAttributes(
+			copyDiagnosticAttributeTypes(span.attributes, {
+				...span.attributes,
+				...(additionalAttributes ?? {}),
+			}),
+			redact,
+		),
+		...(span.error !== undefined ? { error: sanitizeTraceText(span.error, redact) } : {}),
+		...(span.parentId !== undefined
+			? { parentId: redactCriticalDiagnosticText(span.parentId, redact) }
+			: {}),
 	};
 }