@apifuse/provider-sdk 2.2.0-beta.67 → 2.2.0-beta.69

package/dist/fixture-sanitization.js

@@ -1,3 +1,4 @@
+import { Buffer } from "node:buffer";
 export const REDACTED_FIXTURE_VALUE = "[REDACTED]";
 const OPAQUE_TOKEN = /^[A-Za-z0-9_+/=.:~-]+$/;
 const OPAQUE_TOKEN_RUN = /[A-Za-z0-9_+/=.:~-]{24,}/g;
@@ -6,12 +7,39 @@ const EMAIL_ADDRESS_RUN = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi;
 const DIAGNOSTIC_URL_SENTINEL_DELIMITER = String.fromCodePoint(0);
 const DIAGNOSTIC_URL_SENTINEL_RUN = new RegExp(`${DIAGNOSTIC_URL_SENTINEL_DELIMITER}APIFUSE_URL(\\d+)${DIAGNOSTIC_URL_SENTINEL_DELIMITER}`, "g");
 const PEM_PRIVATE_KEY = /-----BEGIN (?:[A-Z0-9 ]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z0-9 ]+ )?PRIVATE KEY-----/g;
+/** RFC 9110 §11.4 `token68`, the single credential token of Bearer, Basic, Negotiate and NTLM. */
+const TOKEN68 = "[A-Za-z0-9._~+/-]+=*";
+/**
+ * A credential header's value is the whole RFC 9110 `credentials` production
+ * (`auth-scheme SP token68`), so the scheme and its token are one value, not two words.
+ * The key starts at a word boundary so a long word run is scanned once, not from every offset.
+ */
+const CREDENTIALS_HEADER_ASSIGNMENT = new RegExp(String.raw `(?<![\w-])((["']?)[\w-]*authorization\2\s*[:=]\s*)[A-Za-z][\w.+-]*[ \t]+${TOKEN68}(?![^\s,;&])`, "gi");
+/**
+ * Keyless echoes of the token68 schemes whose token is always a credential. Only the scheme and
+ * its whitespace are matched, so matches never overlap a later scheme; the token is the whole
+ * opaque run that follows, so no partial redaction leaves a remainder too short for the
+ * opaque-token scan. Negotiate and NTLM match only their registered spelling so prose such as
+ * "failed to negotiate TLS" is retained.
+ */
+const TOKEN68_SCHEMES = [/\bBearer\s+/gi, /\b(?:Negotiate|NTLM)\s+/g];
+/** A keyless `Basic` token is a credential only when it decodes to `user-id:password`. */
+const BASIC_SCHEME = /\bBasic\s+/gi;
+const OPAQUE_TOKEN_CHARACTER = /[A-Za-z0-9_+/=.:~-]/;
+const BASE64_CHARACTER = /[A-Za-z0-9+/]/;
+const ASSIGNMENT_VALUE_DELIMITER = /[\s,;&]/;
+/**
+ * A key and its `:`/`=`, starting at a word boundary so a word run is scanned once. Values are
+ * never consumed, so an assignment inside another value is still found.
+ */
+const ASSIGNMENT_KEY = /(["']?)(?<![\w-])([\w-]+)\1\s*[:=]\s*/gi;
 /** Matches credential field names without treating benign prefixes such as `author` as `auth`. */
 export function isSensitiveFixtureKey(key) {
     const normalized = key.replace(/[-_\s]/g, "").toLowerCase();
     const candidates = [normalized, normalized.replace(/(?:value|payload|header)$/, "")];
     return candidates.some((candidate) => /^(?:authorization|authentication|auth|bearer|cookie|credential|password|passwd|privatekey|secret|session|sessionid|token)$/.test(candidate) ||
-        /^(?:api|client|service|access|consumer)(?:key|secret|token)$/.test(candidate) ||
+        // Unanchored at the start so vendor-prefixed headers (`x-api-key`) match too.
+        /(?:api|client|service|access|consumer)(?:key|secret|token)$/.test(candidate) ||
         /(?:authorization|credential|password|passwd|privatekey|secret|sessionid|token)$/.test(candidate));
 }
 /**
@@ -50,7 +78,7 @@ export function sanitizeFixtureString(value) {
         const index = retainedUrls.push(isCredentialBearingUrl(url) ? sanitizeUrlForLogs(url) : url) - 1;
         return `APIFUSEURL${index}X`;
     });
-    sanitized = redactSensitiveAssignments(sanitized);
+    sanitized = redactCredentialSpans(sanitized, [credentialHeaderSpans, sensitiveAssignmentSpans]);
     sanitized = sanitized.replace(OPAQUE_TOKEN_RUN, (candidate) => isSensitiveFixtureValue(candidate) ? REDACTED_FIXTURE_VALUE : candidate);
     sanitized = sanitized.replace(/APIFUSEURL(\d+)X/g, (_match, index) => retainedUrls[Number(index)] ?? REDACTED_FIXTURE_VALUE);
     return sanitized;
@@ -135,9 +163,12 @@ export function sanitizeDiagnosticText(value) {
         const index = retainedUrls.push(sanitizeUrlForLogs(url)) - 1;
         return `${DIAGNOSTIC_URL_SENTINEL_DELIMITER}APIFUSE_URL${index}${DIAGNOSTIC_URL_SENTINEL_DELIMITER}`;
     })
-        .replace(/\bBearer\s+[A-Za-z0-9._~+/=-]+/gi, `Bearer ${REDACTED_FIXTURE_VALUE}`)
         .replace(EMAIL_ADDRESS_RUN, REDACTED_FIXTURE_VALUE);
-    sanitized = redactSensitiveAssignments(sanitized);
+    sanitized = redactCredentialSpans(sanitized, [
+        credentialHeaderSpans,
+        keylessCredentialSpans,
+        sensitiveAssignmentSpans,
+    ]);
     sanitized = sanitized.replace(OPAQUE_TOKEN_RUN, (candidate, offset, source) => {
         if (/^(?:request|trace|correlation)[-_]?id[:=]/i.test(candidate))
             return candidate;
@@ -149,17 +180,130 @@ export function sanitizeDiagnosticText(value) {
     sanitized = sanitized.replace(DIAGNOSTIC_URL_SENTINEL_RUN, (_match, index) => retainedUrls[Number(index)] ?? REDACTED_FIXTURE_VALUE);
     return encodeDiagnosticControls(sanitized);
 }
-function redactSensitiveAssignments(value) {
-    return value.replace(/((["']?)([\w-]+)\2\s*[:=]\s*)("(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\s,;&]+)/gi, (match, prefix, _quote, key, assignmentValue) => {
-        if (!isSensitiveFixtureKey(key) && key.toLowerCase() !== "key")
-            return match;
-        const quote = assignmentValue.startsWith('"')
-            ? '"'
-            : assignmentValue.startsWith("'")
-                ? "'"
-                : "";
-        return `${prefix}${quote}${REDACTED_FIXTURE_VALUE}${quote}`;
-    });
+/**
+ * Every credential rule scans the same unmodified text and reports spans; the output redacts
+ * their union. No rule's rewrite can hide a key or a scheme word from another rule, so adding a
+ * rule can only redact more.
+ */
+function redactCredentialSpans(value, rules) {
+    const spans = rules
+        .flatMap((rule) => [...rule(value)])
+        .sort((a, b) => a[0] - b[0] || b[1] - a[1]);
+    let output = "";
+    let cursor = 0;
+    let open;
+    const close = (span) => {
+        output += value.slice(cursor, span[0]) + REDACTED_FIXTURE_VALUE;
+        cursor = span[1];
+    };
+    for (const [start, end] of spans) {
+        if (open && start <= open[1]) {
+            open[1] = Math.max(open[1], end);
+            continue;
+        }
+        if (open)
+            close(open);
+        open = [start, end];
+    }
+    if (open)
+        close(open);
+    return output + value.slice(cursor);
+}
+/** The scheme and token of a credential header value, as one span. */
+function* credentialHeaderSpans(value) {
+    for (const match of value.matchAll(CREDENTIALS_HEADER_ASSIGNMENT)) {
+        yield [match.index + match[1].length, match.index + match[0].length];
+    }
+}
+/** Tokens after keyless `Bearer`/`Negotiate`/`NTLM`, and `Basic` tokens that decode to `user-id:password`. */
+function* keylessCredentialSpans(value) {
+    const opaqueEnds = runEnds(value, OPAQUE_TOKEN_CHARACTER);
+    for (const scheme of TOKEN68_SCHEMES) {
+        for (const match of value.matchAll(scheme)) {
+            const start = match.index + match[0].length;
+            if (opaqueEnds[start] > start)
+                yield [start, opaqueEnds[start]];
+        }
+    }
+    const base64Ends = runEnds(value, BASE64_CHARACTER);
+    for (const match of value.matchAll(BASIC_SCHEME)) {
+        const start = match.index + match[0].length;
+        const payloadEnd = base64Ends[start];
+        let end = payloadEnd;
+        while (end < payloadEnd + 2 && value[end] === "=")
+            end++;
+        // The base64 token must be the whole opaque run, not the prefix of a longer token.
+        if (payloadEnd === start || end !== opaqueEnds[start])
+            continue;
+        if (Buffer.from(value.slice(start, end), "base64").includes(0x3a))
+            yield [start, end];
+    }
+}
+/**
+ * Values of credential-named keys; quotes around a quoted value are kept. Every key is visited,
+ * including keys inside another key's value (`auth: {"password": "x"}`), and each value's extent
+ * is read from precomputed tables, so the scan stays linear in the text length.
+ */
+function* sensitiveAssignmentSpans(value) {
+    let extents;
+    for (const key of value.matchAll(ASSIGNMENT_KEY)) {
+        const name = key[2];
+        if (!isSensitiveFixtureKey(name) && name.toLowerCase() !== "key")
+            continue;
+        extents ??= assignmentValueExtents(value);
+        const start = key.index + key[0].length;
+        const quote = value[start];
+        const closing = quote === '"'
+            ? extents.doubleQuoteClose[start + 1]
+            : quote === "'"
+                ? extents.singleQuoteClose[start + 1]
+                : -1;
+        if (closing !== -1) {
+            yield [start + 1, closing];
+        }
+        else if (extents.unquotedEnds[start] > start) {
+            yield [start, extents.unquotedEnds[start]];
+        }
+    }
+}
+function assignmentValueExtents(value) {
+    const unquotedEnds = new Int32Array(value.length + 1);
+    unquotedEnds[value.length] = value.length;
+    for (let index = value.length - 1; index >= 0; index--) {
+        unquotedEnds[index] = ASSIGNMENT_VALUE_DELIMITER.test(value[index])
+            ? index
+            : unquotedEnds[index + 1];
+    }
+    return {
+        unquotedEnds,
+        doubleQuoteClose: closingQuotes(value, '"'),
+        singleQuoteClose: closingQuotes(value, "'"),
+    };
+}
+/** Right-to-left: reading a quoted body from index i either closes at a quote or skips an escape pair. */
+function closingQuotes(value, quote) {
+    const closing = new Int32Array(value.length + 2).fill(-1);
+    for (let index = value.length - 1; index >= 0; index--) {
+        const character = value[index];
+        closing[index] =
+            character === quote
+                ? index
+                : character === "\\"
+                    ? /[^\n\r\u2028\u2029]/.test(value[index + 1] ?? "\n")
+                        ? closing[index + 2]
+                        : -1
+                    : closing[index + 1];
+    }
+    return closing;
+}
+/** For each index, the end of the run of `character` starting there, in one right-to-left pass. */
+function runEnds(value, character) {
+    const ends = new Int32Array(value.length + 1);
+    ends[value.length] = value.length;
+    for (let index = value.length - 1; index >= 0; index--) {
+        ends[index] = character.test(value[index]) ? ends[index + 1] : index;
+    }
+    return ends;
 }
 function isCredentialBearingUrl(value) {
     try {

package/dist/lint.d.ts

@@ -83,6 +83,8 @@ export declare function lintProvider(provider: {
         fixtures?: unknown;
         handler?: unknown;
         source?: string;
+        /** Read structurally by the health-check monitorability rules. */
+        healthCheck?: unknown;
         errorCodes?: ReadonlyArray<{
             code: string;
             status?: number;