@apifuse/provider-sdk 2.2.0-beta.59 → 2.2.0-beta.60

package/dist/server/self-test-redaction.js

@@ -1,4 +1,4 @@
-import { PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_ENV, PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_PREVIOUS_ENV, } from "./self-test-token.js";
+import { collectDiagnosticSensitiveValues, SELF_TEST_SENSITIVE_SOURCE_KINDS, } from "./sensitive-values.js";
 export const SELF_TEST_REDACTED_PLACEHOLDER = "[REDACTED]";
 /** Maximum length of any string echoed in a self-test response. */
 export const SELF_TEST_MAX_TEXT_LENGTH = 300;
@@ -16,37 +16,12 @@ const HEADER_SHAPED_SECRETS = [
  * credential inputs.
  */
 export function collectSelfTestSensitiveValues(provider, options = {}) {
-    const env = options.env ?? process.env;
-    const envNames = new Set([
-        PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_ENV,
-        PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_PREVIOUS_ENV,
-    ]);
-    for (const secret of provider.secrets ?? []) {
-        envNames.add(secret.name);
-    }
-    const healthProbe = provider.healthProbe ?? provider.healthMonitor;
-    for (const name of healthProbe?.requiredSecrets ?? []) {
-        envNames.add(name);
-    }
-    for (const name of Object.values(healthProbe?.credentialInputs ?? {})) {
-        envNames.add(name);
-    }
-    const values = new Set();
-    for (const name of envNames) {
-        const value = env[name];
-        if (typeof value === "string" && value.length >= MIN_SENSITIVE_VALUE_LENGTH) {
-            values.add(value);
-        }
-    }
-    for (const value of Object.values(options.credentialInputs ?? {})) {
-        if (value.length >= MIN_SENSITIVE_VALUE_LENGTH) {
-            values.add(value);
-        }
-    }
-    return [...values];
-}
-function escapeRegExp(value) {
-    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    return collectDiagnosticSensitiveValues(provider, {
+        ...options,
+        sourceKinds: SELF_TEST_SENSITIVE_SOURCE_KINDS,
+        minimumLength: MIN_SENSITIVE_VALUE_LENGTH,
+        includeResolvedEnvVariants: false,
+    });
 }
 /**
  * Scrubs known secret values and header-shaped credentials from a string and
@@ -58,7 +33,7 @@ export function redactSelfTestText(text, sensitiveValues, maxLength = SELF_TEST_
     for (const value of sensitiveValues) {
         if (value.length < MIN_SENSITIVE_VALUE_LENGTH)
             continue;
-        redacted = redacted.replace(new RegExp(escapeRegExp(value), "g"), SELF_TEST_REDACTED_PLACEHOLDER);
+        redacted = redacted.replaceAll(value, SELF_TEST_REDACTED_PLACEHOLDER);
     }
     for (const pattern of HEADER_SHAPED_SECRETS) {
         redacted = redacted.replace(pattern, (_match, prefix) => `${prefix}${SELF_TEST_REDACTED_PLACEHOLDER}`);

package/dist/server/sensitive-values.d.ts

@@ -0,0 +1,26 @@
+import type { ProviderDefinition } from "../types.js";
+export declare const SELF_TEST_SENSITIVE_SOURCE_KINDS: readonly ["selfTestMasterSecrets", "providerSecrets", "healthProbeSecrets", "requestCredentials"];
+/** Explicit source allowlist: no environment-name or payload-shape secret sweep. */
+export declare const DIAGNOSTIC_SENSITIVE_SOURCE_KINDS: readonly ["selfTestMasterSecrets", "providerSecrets", "healthProbeSecrets", "requestCredentials", "engineProxyCredentials", "engineSolverKeys", "engineCeremonyLeaseCredentials", "choiceMasterSecret", "ocrCredentials", "sttCredentials", "cdpCredentials", "statefulForwardingSecret", "redisCredentials", "otlpHeaders", "cacheKeyPepper", "sensitiveParams"];
+export type DiagnosticSensitiveSourceKind = (typeof DIAGNOSTIC_SENSITIVE_SOURCE_KINDS)[number];
+/**
+ * Startup inventory; request-scoped readers additionally register live values on access.
+ */
+export declare function collectStaticDiagnosticSensitiveValues(provider: ProviderDefinition, options?: {
+    env?: Readonly<Record<string, string | undefined>>;
+    statefulForwardingSecret?: string;
+}): string[];
+/** Generalised self-test collector, also used to seed and enrich ordinary request scopes. */
+export declare function collectDiagnosticSensitiveValues(provider: ProviderDefinition, options?: {
+    env?: Readonly<Record<string, string | undefined>>;
+    credentialInputs?: Readonly<Record<string, unknown>>;
+    connectionSecrets?: Readonly<Record<string, string | undefined>>;
+    sensitiveParams?: readonly string[];
+    statefulForwardingSecret?: string;
+    sourceKinds?: readonly DiagnosticSensitiveSourceKind[];
+    minimumLength?: number;
+    /** Preserve the legacy self-test response collector when false. */
+    includeResolvedEnvVariants?: boolean;
+}): string[];
+/** Derive the live-read allowlist from the same collector as the startup inventory. */
+export declare function createDiagnosticEnvObserver(provider: ProviderDefinition, register: (values: readonly string[]) => void, has?: (value: string) => boolean): (name: string, value: string) => void;

package/dist/server/sensitive-values.js

@@ -0,0 +1,131 @@
+import { resolvedStringVariants, urlCredentialComponents, otlpHeaderCredentialValues, } from "../runtime/diagnostic-env-values.js";
+import { PROVIDER_CACHE_REDIS_URL_ENV, PROVIDER_STATE_REDIS_URL_ENV, REDIS_URL_ENV, } from "../config/loader.js";
+import { ENGINE_OWNED_PROXY_CREDENTIAL_ENV_NAMES, ENGINE_OWNED_RESOLVER_CREDENTIAL_ENV_NAMES, } from "../engine.js";
+import { APIFUSE__CACHE__KEY_PEPPER_ENV } from "../runtime/cache.js";
+import { PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV } from "../runtime/choice.js";
+import { APIFUSE__ENGINE__CEREMONY_LEASE_KEY } from "../runtime/egress-lease.js";
+import { APIFUSE__OCR__API_KEY_ENV, APIFUSE__OCR__CLOUDFLARE_API_TOKEN_ENV, } from "../runtime/ocr.js";
+import { OTEL_EXPORTER_OTLP_HEADERS, OTEL_EXPORTER_OTLP_TRACES_HEADERS, OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_TRACES_ENDPOINT, } from "../runtime/otlp.js";
+import { APIFUSE__CDP_POOL__URL } from "../runtime/resolver-config.js";
+import { APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV } from "../runtime/stt.js";
+import { PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_ENV, PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_PREVIOUS_ENV, } from "./self-test-token.js";
+export const SELF_TEST_SENSITIVE_SOURCE_KINDS = [
+    "selfTestMasterSecrets",
+    "providerSecrets",
+    "healthProbeSecrets",
+    "requestCredentials",
+];
+/** Explicit source allowlist: no environment-name or payload-shape secret sweep. */
+export const DIAGNOSTIC_SENSITIVE_SOURCE_KINDS = [
+    ...SELF_TEST_SENSITIVE_SOURCE_KINDS,
+    "engineProxyCredentials",
+    "engineSolverKeys",
+    "engineCeremonyLeaseCredentials",
+    "choiceMasterSecret",
+    "ocrCredentials",
+    "sttCredentials",
+    "cdpCredentials",
+    "statefulForwardingSecret",
+    "redisCredentials",
+    "otlpHeaders",
+    "cacheKeyPepper",
+    "sensitiveParams",
+];
+/**
+ * Startup inventory; request-scoped readers additionally register live values on access.
+ */
+export function collectStaticDiagnosticSensitiveValues(provider, options = {}) {
+    return collectDiagnosticSensitiveValues(provider, {
+        ...options,
+        sourceKinds: DIAGNOSTIC_SENSITIVE_SOURCE_KINDS.filter((kind) => kind !== "requestCredentials" && kind !== "sensitiveParams"),
+    });
+}
+/** Generalised self-test collector, also used to seed and enrich ordinary request scopes. */
+export function collectDiagnosticSensitiveValues(provider, options = {}) {
+    const env = options.env ?? process.env;
+    const envValues = (names) => names.map((name) => env[name]);
+    const resolvedEnvValues = (names) => envValues(names).flatMap((value) => value === undefined
+        ? []
+        : options.includeResolvedEnvVariants === false
+            ? [value]
+            : [value, value.trim()]);
+    const healthProbe = provider.healthProbe ?? provider.healthMonitor;
+    const sources = {
+        selfTestMasterSecrets: () => resolvedEnvValues([
+            PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_ENV,
+            PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_PREVIOUS_ENV,
+        ]),
+        providerSecrets: () => resolvedEnvValues((provider.secrets ?? []).map((secret) => secret.name)),
+        healthProbeSecrets: () => resolvedEnvValues([
+            ...(healthProbe?.requiredSecrets ?? []),
+            ...Object.values(healthProbe?.credentialInputs ?? {}),
+        ]),
+        requestCredentials: () => [
+            ...Object.values(options.credentialInputs ?? {}),
+            ...Object.values(options.connectionSecrets ?? {}),
+        ],
+        engineProxyCredentials: () => resolvedEnvValues(ENGINE_OWNED_PROXY_CREDENTIAL_ENV_NAMES),
+        // These are the resolver-config API keys after #251's engine credential projection.
+        engineSolverKeys: () => resolvedEnvValues(ENGINE_OWNED_RESOLVER_CREDENTIAL_ENV_NAMES),
+        engineCeremonyLeaseCredentials: () => resolvedEnvValues([APIFUSE__ENGINE__CEREMONY_LEASE_KEY]),
+        choiceMasterSecret: () => resolvedEnvValues([PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV]),
+        ocrCredentials: () => resolvedEnvValues([APIFUSE__OCR__CLOUDFLARE_API_TOKEN_ENV, APIFUSE__OCR__API_KEY_ENV]),
+        sttCredentials: () => resolvedEnvValues([APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV]),
+        cdpCredentials: () => resolvedStringVariants(env[APIFUSE__CDP_POOL__URL]).flatMap((url) => [
+            url,
+            ...urlCredentialComponents(url, { includePathAndQuery: true }),
+        ]),
+        statefulForwardingSecret: () => resolvedStringVariants(options.statefulForwardingSecret),
+        redisCredentials: () => [PROVIDER_CACHE_REDIS_URL_ENV, PROVIDER_STATE_REDIS_URL_ENV, REDIS_URL_ENV]
+            .flatMap((name) => resolvedStringVariants(env[name]))
+            .flatMap((url) => urlCredentialComponents(url, { includePathAndQuery: false })),
+        otlpHeaders: () => [
+            ...[OTEL_EXPORTER_OTLP_TRACES_HEADERS, OTEL_EXPORTER_OTLP_HEADERS].flatMap((name) => env[name] === undefined ? [] : otlpHeaderCredentialValues(env[name])),
+            ...[OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_TRACES_ENDPOINT].flatMap((name) => resolvedStringVariants(env[name]).flatMap((url) => urlCredentialComponents(url, { includePathAndQuery: false }))),
+        ],
+        cacheKeyPepper: () => resolvedEnvValues([APIFUSE__CACHE__KEY_PEPPER_ENV]),
+        sensitiveParams: () => options.sensitiveParams ?? [],
+    };
+    const values = new Set();
+    for (const kind of options.sourceKinds ?? DIAGNOSTIC_SENSITIVE_SOURCE_KINDS) {
+        for (const value of sources[kind]()) {
+            if (typeof value === "string" && value.length >= (options.minimumLength ?? 1))
+                values.add(value);
+        }
+    }
+    return [...values];
+}
+const diagnosticEnvNames = new WeakMap();
+/** Derive the live-read allowlist from the same collector as the startup inventory. */
+export function createDiagnosticEnvObserver(provider, register, has) {
+    let names = diagnosticEnvNames.get(provider);
+    if (!names) {
+        names = new Set();
+        const captured = names;
+        collectStaticDiagnosticSensitiveValues(provider, {
+            env: new Proxy({}, {
+                get: (_target, key) => {
+                    if (typeof key === "string")
+                        captured.add(key);
+                    return undefined;
+                },
+            }),
+        });
+        diagnosticEnvNames.set(provider, names);
+    }
+    const seen = new Map();
+    return (name, value) => {
+        if (!names.has(name) || seen.get(name) === value)
+            return;
+        if (has?.(value) && has(value.trim()))
+            return;
+        // Includes URL userinfo/CDP components and OTLP auth values, using the same rules.
+        register([
+            ...resolvedStringVariants(value),
+            ...collectStaticDiagnosticSensitiveValues(provider, {
+                env: { [name]: value },
+            }),
+        ]);
+        seen.set(name, value);
+    };
+}