@application-kit/observability 0.10.0 → 0.12.0

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @application-kit/observability
 
+## 0.12.0
+
+### Patch Changes
+
+- Updated dependencies [df7cdd0]
+  - @application-kit/typeorm@0.12.0
+
+## 0.11.0
+
+### Minor Changes
+
+- 523d0e9: Строка лога о запросе больше не содержит секретов: `set-cookie` ответа заменяется маркером, значения параметров `token` и `code` вырезаются из `req.url`, `req.query` и заголовка `referer`, в том числе внутри другого параметра. Новые опции логгера `redactPaths` и `sensitiveQueryParameters` дополняют дефолт пакета.
+
+### Patch Changes
+
+- 8e10f98: Peer-зависимости принимают Nest 12, `@nestjs/graphql` и `@nestjs/mercurius` 14, `@nestjs/cqrs` 12 и `nestjs-pino` 5. `PinoLoggerConfig` задаёт `forRoutes` явно: с маршрутом nestjs-pino 5 по умолчанию запросы на Fastify не логировались.
+- Updated dependencies [8e10f98]
+  - @application-kit/typeorm@0.5.3
+
 ## 0.10.0
 
 ### Minor Changes

package/dist/cjs/logging/index.d.ts

@@ -5,5 +5,6 @@ export * from './logger.environment.js';
 export * from './observability-logger.interface.js';
 export * from './pino-logger-options.interface.js';
 export * from './pino-logger.config.js';
+export * from './redact-query-parameters.js';
 export * from './resolve-request-id.js';
 export * from './resolve-support-id.js';

package/dist/cjs/logging/index.js

@@ -21,5 +21,6 @@ __exportStar(require("./logger.environment.js"), exports);
 __exportStar(require("./observability-logger.interface.js"), exports);
 __exportStar(require("./pino-logger-options.interface.js"), exports);
 __exportStar(require("./pino-logger.config.js"), exports);
+__exportStar(require("./redact-query-parameters.js"), exports);
 __exportStar(require("./resolve-request-id.js"), exports);
 __exportStar(require("./resolve-support-id.js"), exports);

package/dist/cjs/logging/pino-logger-options.interface.d.ts

@@ -1,5 +1,7 @@
 import type { ClientIpSourceInterface } from '../http/resolve-client-ip.js';
 export type ClientIpResolver = (request: ClientIpSourceInterface) => string;
 export interface PinoLoggerOptionsInterface {
+    readonly redactPaths?: readonly string[];
     readonly resolveClientIp?: ClientIpResolver;
+    readonly sensitiveQueryParameters?: readonly string[];
 }

package/dist/cjs/logging/pino-logger.config.js

@@ -18,6 +18,7 @@ const resolve_client_ip_js_1 = require("../http/resolve-client-ip.js");
 const active_span_context_js_1 = require("../shared/active-span-context.js");
 const infrastructure_paths_js_1 = require("./infrastructure-paths.js");
 const logger_environment_js_1 = require("./logger.environment.js");
+const redact_query_parameters_js_1 = require("./redact-query-parameters.js");
 const HTTP_STATUS_CLIENT_ERROR = 400;
 const HTTP_STATUS_SERVER_ERROR = 500;
 const isInfrastructureRequest = (url) => {
@@ -55,10 +56,19 @@ const REDACTED_LOG_PATHS = [
     'password',
     'req.headers.authorization',
     'req.headers.cookie',
+    'res.headers["set-cookie"]',
 ];
 const rawSocketPort = (request) => request.raw?.socket?.remotePort;
 const remotePort = (request) => request.socket?.remotePort
     ?? rawSocketPort(request);
+const withRedactedReferer = (headers, sensitiveNames) => (headers.referer === undefined
+    ? headers
+    : { ...headers, referer: (0, redact_query_parameters_js_1.redactUrlParameters)(headers.referer, sensitiveNames) });
+const sensitiveNamesOf = ({ sensitiveQueryParameters = [] }) => new Set([...redact_query_parameters_js_1.DEFAULT_SENSITIVE_QUERY_PARAMETERS, ...sensitiveQueryParameters]);
+const redactPathsOf = ({ redactPaths = [] }) => [
+    ...REDACTED_LOG_PATHS,
+    ...redactPaths,
+];
 let PinoLoggerConfig = class PinoLoggerConfig {
     environment;
     constructor(environment) {
@@ -66,7 +76,9 @@ let PinoLoggerConfig = class PinoLoggerConfig {
     }
     createOptions(options = {}) {
         const clientIp = options.resolveClientIp ?? resolve_client_ip_js_1.resolveClientIp;
+        const sensitiveNames = sensitiveNamesOf(options);
         return {
+            forRoutes: [{ method: common_1.RequestMethod.ALL, path: '/{*splat}' }],
             pinoHttp: {
                 autoLogging: true,
                 customLogLevel: exports.responseLogLevel,
@@ -79,17 +91,17 @@ let PinoLoggerConfig = class PinoLoggerConfig {
                 level: this.environment.LOG_LEVEL,
                 mixin: exports.traceContextMixin,
                 quietReqLogger: true,
-                redact: [...REDACTED_LOG_PATHS],
+                redact: redactPathsOf(options),
                 serializers: {
                     req: (request) => ({
-                        headers: request.headers,
+                        headers: withRedactedReferer(request.headers, sensitiveNames),
                         id: request.id,
                         method: request.method,
                         params: request.raw?.params,
-                        query: request.query,
+                        query: (0, redact_query_parameters_js_1.redactQueryObject)(request.query, sensitiveNames),
                         remoteAddress: clientIp(request),
                         remotePort: remotePort(request),
-                        url: request.url,
+                        url: (0, redact_query_parameters_js_1.redactUrlParameters)(request.url, sensitiveNames),
                     }),
                 },
             },

package/dist/cjs/logging/redact-query-parameters.d.ts

@@ -0,0 +1,3 @@
+export declare const DEFAULT_SENSITIVE_QUERY_PARAMETERS: readonly string[];
+export declare const redactUrlParameters: (value: unknown, sensitiveNames: ReadonlySet<string>) => unknown;
+export declare const redactQueryObject: (query: unknown, sensitiveNames: ReadonlySet<string>) => unknown;

package/dist/cjs/logging/redact-query-parameters.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactQueryObject = exports.redactUrlParameters = exports.DEFAULT_SENSITIVE_QUERY_PARAMETERS = void 0;
+exports.DEFAULT_SENSITIVE_QUERY_PARAMETERS = ['code', 'token'];
+const REDACTED_VALUE = '[Redacted]';
+const PARAMETER_DELIMITER = /(?<delimiter>[&?])/u;
+const redactParameter = (parameter, sensitiveNames) => {
+    const assignmentIndex = parameter.indexOf('=');
+    return parameter.includes('=') && sensitiveNames.has(parameter.slice(0, assignmentIndex))
+        ? `${parameter.slice(0, assignmentIndex + 1)}${REDACTED_VALUE}`
+        : parameter;
+};
+const redactUrl = (url, sensitiveNames) => {
+    const [path, ...rest] = url.split(PARAMETER_DELIMITER);
+    return [path, ...rest.map((part) => redactParameter(part, sensitiveNames))].join('');
+};
+const redactUrlParameters = (value, sensitiveNames) => {
+    if (Array.isArray(value)) {
+        return value.map((item) => (0, exports.redactUrlParameters)(item, sensitiveNames));
+    }
+    return typeof value === 'string' ? redactUrl(value, sensitiveNames) : value;
+};
+exports.redactUrlParameters = redactUrlParameters;
+const redactQueryObject = (query, sensitiveNames) => {
+    if (typeof query !== 'object' || query === null) {
+        return query;
+    }
+    return Object.fromEntries(Object.entries(query).map(([name, value]) => [
+        name,
+        sensitiveNames.has(name) ? REDACTED_VALUE : (0, exports.redactUrlParameters)(value, sensitiveNames),
+    ]));
+};
+exports.redactQueryObject = redactQueryObject;

package/dist/esm/logging/index.d.ts

@@ -5,5 +5,6 @@ export * from './logger.environment.js';
 export * from './observability-logger.interface.js';
 export * from './pino-logger-options.interface.js';
 export * from './pino-logger.config.js';
+export * from './redact-query-parameters.js';
 export * from './resolve-request-id.js';
 export * from './resolve-support-id.js';

package/dist/esm/logging/index.js

@@ -5,5 +5,6 @@ export * from './logger.environment.js';
 export * from './observability-logger.interface.js';
 export * from './pino-logger-options.interface.js';
 export * from './pino-logger.config.js';
+export * from './redact-query-parameters.js';
 export * from './resolve-request-id.js';
 export * from './resolve-support-id.js';

package/dist/esm/logging/pino-logger-options.interface.d.ts

@@ -1,5 +1,7 @@
 import type { ClientIpSourceInterface } from '../http/resolve-client-ip.js';
 export type ClientIpResolver = (request: ClientIpSourceInterface) => string;
 export interface PinoLoggerOptionsInterface {
+    readonly redactPaths?: readonly string[];
     readonly resolveClientIp?: ClientIpResolver;
+    readonly sensitiveQueryParameters?: readonly string[];
 }

package/dist/esm/logging/pino-logger.config.js

@@ -10,11 +10,12 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Inject, Injectable } from '@nestjs/common';
+import { Inject, Injectable, RequestMethod } from '@nestjs/common';
 import { resolveClientIp } from '../http/resolve-client-ip.js';
 import { activeSpanContext } from '../shared/active-span-context.js';
 import { isInfrastructurePath } from './infrastructure-paths.js';
 import { LoggerEnvironment } from './logger.environment.js';
+import { DEFAULT_SENSITIVE_QUERY_PARAMETERS, redactQueryObject, redactUrlParameters, } from './redact-query-parameters.js';
 const HTTP_STATUS_CLIENT_ERROR = 400;
 const HTTP_STATUS_SERVER_ERROR = 500;
 const isInfrastructureRequest = (url) => {
@@ -50,10 +51,19 @@ const REDACTED_LOG_PATHS = [
     'password',
     'req.headers.authorization',
     'req.headers.cookie',
+    'res.headers["set-cookie"]',
 ];
 const rawSocketPort = (request) => request.raw?.socket?.remotePort;
 const remotePort = (request) => request.socket?.remotePort
     ?? rawSocketPort(request);
+const withRedactedReferer = (headers, sensitiveNames) => (headers.referer === undefined
+    ? headers
+    : { ...headers, referer: redactUrlParameters(headers.referer, sensitiveNames) });
+const sensitiveNamesOf = ({ sensitiveQueryParameters = [] }) => new Set([...DEFAULT_SENSITIVE_QUERY_PARAMETERS, ...sensitiveQueryParameters]);
+const redactPathsOf = ({ redactPaths = [] }) => [
+    ...REDACTED_LOG_PATHS,
+    ...redactPaths,
+];
 let PinoLoggerConfig = class PinoLoggerConfig {
     environment;
     constructor(environment) {
@@ -61,7 +71,9 @@ let PinoLoggerConfig = class PinoLoggerConfig {
     }
     createOptions(options = {}) {
         const clientIp = options.resolveClientIp ?? resolveClientIp;
+        const sensitiveNames = sensitiveNamesOf(options);
         return {
+            forRoutes: [{ method: RequestMethod.ALL, path: '/{*splat}' }],
             pinoHttp: {
                 autoLogging: true,
                 customLogLevel: responseLogLevel,
@@ -74,17 +86,17 @@ let PinoLoggerConfig = class PinoLoggerConfig {
                 level: this.environment.LOG_LEVEL,
                 mixin: traceContextMixin,
                 quietReqLogger: true,
-                redact: [...REDACTED_LOG_PATHS],
+                redact: redactPathsOf(options),
                 serializers: {
                     req: (request) => ({
-                        headers: request.headers,
+                        headers: withRedactedReferer(request.headers, sensitiveNames),
                         id: request.id,
                         method: request.method,
                         params: request.raw?.params,
-                        query: request.query,
+                        query: redactQueryObject(request.query, sensitiveNames),
                         remoteAddress: clientIp(request),
                         remotePort: remotePort(request),
-                        url: request.url,
+                        url: redactUrlParameters(request.url, sensitiveNames),
                     }),
                 },
             },

package/dist/esm/logging/redact-query-parameters.d.ts

@@ -0,0 +1,3 @@
+export declare const DEFAULT_SENSITIVE_QUERY_PARAMETERS: readonly string[];
+export declare const redactUrlParameters: (value: unknown, sensitiveNames: ReadonlySet<string>) => unknown;
+export declare const redactQueryObject: (query: unknown, sensitiveNames: ReadonlySet<string>) => unknown;

package/dist/esm/logging/redact-query-parameters.js

@@ -0,0 +1,28 @@
+export const DEFAULT_SENSITIVE_QUERY_PARAMETERS = ['code', 'token'];
+const REDACTED_VALUE = '[Redacted]';
+const PARAMETER_DELIMITER = /(?<delimiter>[&?])/u;
+const redactParameter = (parameter, sensitiveNames) => {
+    const assignmentIndex = parameter.indexOf('=');
+    return parameter.includes('=') && sensitiveNames.has(parameter.slice(0, assignmentIndex))
+        ? `${parameter.slice(0, assignmentIndex + 1)}${REDACTED_VALUE}`
+        : parameter;
+};
+const redactUrl = (url, sensitiveNames) => {
+    const [path, ...rest] = url.split(PARAMETER_DELIMITER);
+    return [path, ...rest.map((part) => redactParameter(part, sensitiveNames))].join('');
+};
+export const redactUrlParameters = (value, sensitiveNames) => {
+    if (Array.isArray(value)) {
+        return value.map((item) => redactUrlParameters(item, sensitiveNames));
+    }
+    return typeof value === 'string' ? redactUrl(value, sensitiveNames) : value;
+};
+export const redactQueryObject = (query, sensitiveNames) => {
+    if (typeof query !== 'object' || query === null) {
+        return query;
+    }
+    return Object.fromEntries(Object.entries(query).map(([name, value]) => [
+        name,
+        sensitiveNames.has(name) ? REDACTED_VALUE : redactUrlParameters(value, sensitiveNames),
+    ]));
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@application-kit/observability",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "Наблюдаемость NestJS-процесса: метрики Prometheus и RED-гистограммы, health-чеки и пробы, опции pino с request-id и trace-контекстом, логирование CQRS-шин, реальный IP клиента за прокси, трейсинг OpenTelemetry",
   "keywords": [
     "cqrs",
@@ -142,16 +142,16 @@
     "test:unit": "vitest run"
   },
   "dependencies": {
-    "@application-kit/typeorm": "^0.5.1"
+    "@application-kit/typeorm": "^0.12.0"
   },
   "devDependencies": {
-    "@nestjs/common": "^11.2.7",
-    "@nestjs/core": "^11.2.7",
-    "@nestjs/cqrs": "^11.0.3",
-    "@nestjs/graphql": "^13.4.5",
-    "@nestjs/platform-fastify": "^11.2.7",
+    "@nestjs/common": "^12.0.0",
+    "@nestjs/core": "^12.0.0",
+    "@nestjs/cqrs": "^12.0.0",
+    "@nestjs/graphql": "^14.0.0",
+    "@nestjs/platform-fastify": "^12.0.0",
     "@nestjs/terminus": "^12.1.0",
-    "@nestjs/testing": "^11.2.7",
+    "@nestjs/testing": "^12.0.0",
     "@nestjs/typeorm": "^12.0.2",
     "@opentelemetry/api": "^1.10.0",
     "@opentelemetry/exporter-trace-otlp-grpc": "^0.300.0",
@@ -169,19 +169,19 @@
     "graphql": "^17.0.2",
     "import-in-the-middle": "^3.5.2",
     "nestjs-console": "^10.0.0",
-    "nestjs-pino": "^4.6.1",
+    "nestjs-pino": "^5.0.0",
     "pino": "^10.3.1",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.2",
     "typeorm": "^1.1.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.11"
+    "vitest": "^5.0.0"
   },
   "peerDependencies": {
-    "@nestjs/common": "^11.0.0",
-    "@nestjs/cqrs": "^11.0.0",
-    "@nestjs/graphql": "^13.0.0",
-    "@nestjs/platform-fastify": "^11.0.0",
+    "@nestjs/common": "^11.0.0 || ^12.0.0",
+    "@nestjs/cqrs": "^11.0.0 || ^12.0.0",
+    "@nestjs/graphql": "^13.0.0 || ^14.0.0",
+    "@nestjs/platform-fastify": "^11.0.0 || ^12.0.0",
     "@nestjs/terminus": "^11.0.0 || ^12.0.0",
     "@nestjs/typeorm": "^11.0.0 || ^12.0.0",
     "@opentelemetry/api": "^1.10.0",
@@ -197,7 +197,7 @@
     "graphql": "^16.0.0 || ^17.0.0",
     "import-in-the-middle": "^3.3.3",
     "nestjs-console": "^10.0.0",
-    "nestjs-pino": "^4.6.1",
+    "nestjs-pino": "^4.6.1 || ^5.0.0",
     "pino": "^10.0.0",
     "typeorm": "^1.0.0"
   },