@atproto/bsky 0.0.67 → 0.0.68
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +12 -0
- package/dist/logger.d.ts +3 -1
- package/dist/logger.d.ts.map +1 -1
- package/dist/logger.js +9 -76
- package/dist/logger.js.map +1 -1
- package/package.json +5 -5
- package/src/logger.ts +11 -81
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,17 @@
|
|
|
1
1
|
# @atproto/bsky
|
|
2
2
|
|
|
3
|
+
## 0.0.68
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- [#2633](https://github.com/bluesky-social/atproto/pull/2633) [`acc9093d2`](https://github.com/bluesky-social/atproto/commit/acc9093d2845eba02b68fb2f9db33e4f1b59bb10) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Obfuscate request headers in logs using utils from @atproto/common
|
|
8
|
+
|
|
9
|
+
- Updated dependencies [[`acc9093d2`](https://github.com/bluesky-social/atproto/commit/acc9093d2845eba02b68fb2f9db33e4f1b59bb10)]:
|
|
10
|
+
- @atproto/common@0.4.1
|
|
11
|
+
- @atproto/crypto@0.4.0
|
|
12
|
+
- @atproto/repo@0.4.1
|
|
13
|
+
- @atproto/xrpc-server@0.5.3
|
|
14
|
+
|
|
3
15
|
## 0.0.67
|
|
4
16
|
|
|
5
17
|
### Patch Changes
|
package/dist/logger.d.ts
CHANGED
|
@@ -1,4 +1,6 @@
|
|
|
1
|
+
/// <reference types="node" />
|
|
1
2
|
/// <reference types="node/http" />
|
|
3
|
+
import { IncomingMessage } from 'node:http';
|
|
2
4
|
import { subsystemLogger } from '@atproto/common';
|
|
3
5
|
export declare const dbLogger: ReturnType<typeof subsystemLogger>;
|
|
4
6
|
export declare const cacheLogger: ReturnType<typeof subsystemLogger>;
|
|
@@ -7,5 +9,5 @@ export declare const labelerLogger: ReturnType<typeof subsystemLogger>;
|
|
|
7
9
|
export declare const hydrationLogger: ReturnType<typeof subsystemLogger>;
|
|
8
10
|
export declare const featureGatesLogger: ReturnType<typeof subsystemLogger>;
|
|
9
11
|
export declare const httpLogger: ReturnType<typeof subsystemLogger>;
|
|
10
|
-
export declare const loggerMiddleware: import("pino-http").HttpLogger<
|
|
12
|
+
export declare const loggerMiddleware: import("pino-http").HttpLogger<IncomingMessage, import("http").ServerResponse<IncomingMessage>, never>;
|
|
11
13
|
//# sourceMappingURL=logger.d.ts.map
|
package/dist/logger.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":";;AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAG3C,OAAO,EAAoB,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEnE,eAAO,MAAM,QAAQ,EAAE,UAAU,CAAC,OAAO,eAAe,CAC5B,CAAA;AAC5B,eAAO,MAAM,WAAW,EAAE,UAAU,CAAC,OAAO,eAAe,CAC5B,CAAA;AAC/B,eAAO,MAAM,SAAS,EAAE,UAAU,CAAC,OAAO,eAAe,CAC5B,CAAA;AAC7B,eAAO,MAAM,aAAa,EAAE,UAAU,CAAC,OAAO,eAAe,CAC5B,CAAA;AACjC,eAAO,MAAM,eAAe,EAAE,UAAU,CAAC,OAAO,eAAe,CAC5B,CAAA;AACnC,eAAO,MAAM,kBAAkB,EAAE,UAAU,CAAC,OAAO,eAAe,CAC5B,CAAA;AACtC,eAAO,MAAM,UAAU,EAAE,UAAU,CAAC,OAAO,eAAe,CACjC,CAAA;AAEzB,eAAO,MAAM,gBAAgB,wGAa3B,CAAA"}
|
package/dist/logger.js
CHANGED
|
@@ -17,82 +17,15 @@ exports.httpLogger = (0, common_1.subsystemLogger)('bsky');
|
|
|
17
17
|
exports.loggerMiddleware = (0, pino_http_1.default)({
|
|
18
18
|
logger: exports.httpLogger,
|
|
19
19
|
serializers: {
|
|
20
|
-
err:
|
|
21
|
-
|
|
20
|
+
err: (err) => ({
|
|
21
|
+
code: err?.['code'],
|
|
22
|
+
message: err?.['message'],
|
|
23
|
+
}),
|
|
24
|
+
req: (req) => {
|
|
25
|
+
const serialized = pino_1.stdSerializers.req(req);
|
|
26
|
+
const headers = (0, common_1.obfuscateHeaders)(serialized.headers);
|
|
27
|
+
return { ...serialized, headers };
|
|
28
|
+
},
|
|
22
29
|
},
|
|
23
30
|
});
|
|
24
|
-
function errSerializer(err) {
|
|
25
|
-
return {
|
|
26
|
-
code: err?.code,
|
|
27
|
-
message: err?.message,
|
|
28
|
-
};
|
|
29
|
-
}
|
|
30
|
-
function reqSerializer(req) {
|
|
31
|
-
const serialized = pino_1.stdSerializers.req(req);
|
|
32
|
-
serialized.headers = obfuscateHeaders(serialized.headers);
|
|
33
|
-
return serialized;
|
|
34
|
-
}
|
|
35
|
-
function obfuscateHeaders(headers) {
|
|
36
|
-
const obfuscatedHeaders = {};
|
|
37
|
-
for (const key in headers) {
|
|
38
|
-
if (key.toLowerCase() === 'authorization') {
|
|
39
|
-
obfuscatedHeaders[key] = obfuscateAuthHeader(headers[key]);
|
|
40
|
-
}
|
|
41
|
-
else if (key.toLowerCase() === 'dpop') {
|
|
42
|
-
obfuscatedHeaders[key] = obfuscateJws(headers[key]) || 'Invalid';
|
|
43
|
-
}
|
|
44
|
-
else {
|
|
45
|
-
obfuscatedHeaders[key] = headers[key];
|
|
46
|
-
}
|
|
47
|
-
}
|
|
48
|
-
return obfuscatedHeaders;
|
|
49
|
-
}
|
|
50
|
-
function obfuscateAuthHeader(authHeader) {
|
|
51
|
-
// This is a hot path (runs on every request). Avoid using split() or regex.
|
|
52
|
-
const spaceIdx = authHeader.indexOf(' ');
|
|
53
|
-
if (spaceIdx === -1)
|
|
54
|
-
return 'Invalid';
|
|
55
|
-
const type = authHeader.slice(0, spaceIdx);
|
|
56
|
-
switch (type.toLowerCase()) {
|
|
57
|
-
case 'bearer':
|
|
58
|
-
return `${type} ${obfuscateBearer(authHeader.slice(spaceIdx + 1))}`;
|
|
59
|
-
case 'dpop':
|
|
60
|
-
return `${type} ${obfuscateJws(authHeader.slice(spaceIdx + 1)) || 'Invalid'}`;
|
|
61
|
-
case 'basic':
|
|
62
|
-
return `${type} ${obfuscateBasic(authHeader.slice(spaceIdx + 1)) || 'Invalid'}`;
|
|
63
|
-
default:
|
|
64
|
-
return `Invalid`;
|
|
65
|
-
}
|
|
66
|
-
}
|
|
67
|
-
function obfuscateBasic(token) {
|
|
68
|
-
if (!token)
|
|
69
|
-
return null;
|
|
70
|
-
const buffer = Buffer.from(token, 'base64');
|
|
71
|
-
if (!buffer.length)
|
|
72
|
-
return null; // Buffer.from will silently ignore invalid base64 chars
|
|
73
|
-
const authHeader = buffer.toString('utf8');
|
|
74
|
-
const colIdx = authHeader.indexOf(':');
|
|
75
|
-
if (colIdx === -1)
|
|
76
|
-
return null;
|
|
77
|
-
const username = authHeader.slice(0, colIdx);
|
|
78
|
-
return `${username}:***`;
|
|
79
|
-
}
|
|
80
|
-
function obfuscateBearer(token) {
|
|
81
|
-
return obfuscateJws(token) || obfuscateToken(token);
|
|
82
|
-
}
|
|
83
|
-
function obfuscateToken(token) {
|
|
84
|
-
return token ? '***' : '';
|
|
85
|
-
}
|
|
86
|
-
function obfuscateJws(token) {
|
|
87
|
-
const firstDot = token.indexOf('.');
|
|
88
|
-
if (firstDot === -1)
|
|
89
|
-
return null;
|
|
90
|
-
const secondDot = token.indexOf('.', firstDot + 1);
|
|
91
|
-
if (secondDot === -1)
|
|
92
|
-
return null;
|
|
93
|
-
if (token.indexOf('.', secondDot + 1) !== -1)
|
|
94
|
-
return null;
|
|
95
|
-
// Strip the signature
|
|
96
|
-
return token.slice(0, secondDot) + '.obfuscated';
|
|
97
|
-
}
|
|
98
31
|
//# sourceMappingURL=logger.js.map
|
package/dist/logger.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":";;;;;;
|
|
1
|
+
{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":";;;;;;AACA,+BAAqC;AACrC,0DAAgC;AAChC,4CAAmE;AAEtD,QAAA,QAAQ,GACnB,IAAA,wBAAe,EAAC,SAAS,CAAC,CAAA;AACf,QAAA,WAAW,GACtB,IAAA,wBAAe,EAAC,YAAY,CAAC,CAAA;AAClB,QAAA,SAAS,GACpB,IAAA,wBAAe,EAAC,UAAU,CAAC,CAAA;AAChB,QAAA,aAAa,GACxB,IAAA,wBAAe,EAAC,cAAc,CAAC,CAAA;AACpB,QAAA,eAAe,GAC1B,IAAA,wBAAe,EAAC,gBAAgB,CAAC,CAAA;AACtB,QAAA,kBAAkB,GAC7B,IAAA,wBAAe,EAAC,mBAAmB,CAAC,CAAA;AACzB,QAAA,UAAU,GACrB,IAAA,wBAAe,EAAC,MAAM,CAAC,CAAA;AAEZ,QAAA,gBAAgB,GAAG,IAAA,mBAAQ,EAAC;IACvC,MAAM,EAAE,kBAAU;IAClB,WAAW,EAAE;QACX,GAAG,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,CAAC;YACtB,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC;YACnB,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC;SAC1B,CAAC;QACF,GAAG,EAAE,CAAC,GAAoB,EAAE,EAAE;YAC5B,MAAM,UAAU,GAAG,qBAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC1C,MAAM,OAAO,GAAG,IAAA,yBAAgB,EAAC,UAAU,CAAC,OAAO,CAAC,CAAA;YACpD,OAAO,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,CAAA;QACnC,CAAC;KACF;CACF,CAAC,CAAA"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@atproto/bsky",
|
|
3
|
-
"version": "0.0.
|
|
3
|
+
"version": "0.0.68",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"description": "Reference implementation of app.bsky App View (Bluesky API)",
|
|
6
6
|
"keywords": [
|
|
@@ -41,13 +41,13 @@
|
|
|
41
41
|
"typed-emitter": "^2.1.0",
|
|
42
42
|
"uint8arrays": "3.0.0",
|
|
43
43
|
"@atproto/api": "^0.12.24",
|
|
44
|
-
"@atproto/common": "^0.4.
|
|
44
|
+
"@atproto/common": "^0.4.1",
|
|
45
45
|
"@atproto/crypto": "^0.4.0",
|
|
46
46
|
"@atproto/identity": "^0.4.0",
|
|
47
47
|
"@atproto/lexicon": "^0.4.0",
|
|
48
|
-
"@atproto/repo": "^0.4.
|
|
48
|
+
"@atproto/repo": "^0.4.1",
|
|
49
49
|
"@atproto/syntax": "^0.3.0",
|
|
50
|
-
"@atproto/xrpc-server": "^0.5.
|
|
50
|
+
"@atproto/xrpc-server": "^0.5.3"
|
|
51
51
|
},
|
|
52
52
|
"devDependencies": {
|
|
53
53
|
"@bufbuild/buf": "^1.28.1",
|
|
@@ -64,7 +64,7 @@
|
|
|
64
64
|
"ts-node": "^10.8.2",
|
|
65
65
|
"@atproto/api": "^0.12.24",
|
|
66
66
|
"@atproto/lex-cli": "^0.4.0",
|
|
67
|
-
"@atproto/pds": "^0.4.
|
|
67
|
+
"@atproto/pds": "^0.4.41",
|
|
68
68
|
"@atproto/xrpc": "^0.5.0"
|
|
69
69
|
},
|
|
70
70
|
"scripts": {
|
package/src/logger.ts
CHANGED
|
@@ -1,6 +1,7 @@
|
|
|
1
|
+
import { IncomingMessage } from 'node:http'
|
|
1
2
|
import { stdSerializers } from 'pino'
|
|
2
3
|
import pinoHttp from 'pino-http'
|
|
3
|
-
import { subsystemLogger } from '@atproto/common'
|
|
4
|
+
import { obfuscateHeaders, subsystemLogger } from '@atproto/common'
|
|
4
5
|
|
|
5
6
|
export const dbLogger: ReturnType<typeof subsystemLogger> =
|
|
6
7
|
subsystemLogger('bsky:db')
|
|
@@ -20,85 +21,14 @@ export const httpLogger: ReturnType<typeof subsystemLogger> =
|
|
|
20
21
|
export const loggerMiddleware = pinoHttp({
|
|
21
22
|
logger: httpLogger,
|
|
22
23
|
serializers: {
|
|
23
|
-
err:
|
|
24
|
-
|
|
24
|
+
err: (err: unknown) => ({
|
|
25
|
+
code: err?.['code'],
|
|
26
|
+
message: err?.['message'],
|
|
27
|
+
}),
|
|
28
|
+
req: (req: IncomingMessage) => {
|
|
29
|
+
const serialized = stdSerializers.req(req)
|
|
30
|
+
const headers = obfuscateHeaders(serialized.headers)
|
|
31
|
+
return { ...serialized, headers }
|
|
32
|
+
},
|
|
25
33
|
},
|
|
26
34
|
})
|
|
27
|
-
|
|
28
|
-
function errSerializer(err: any) {
|
|
29
|
-
return {
|
|
30
|
-
code: err?.code,
|
|
31
|
-
message: err?.message,
|
|
32
|
-
}
|
|
33
|
-
}
|
|
34
|
-
|
|
35
|
-
function reqSerializer(req: any) {
|
|
36
|
-
const serialized = stdSerializers.req(req)
|
|
37
|
-
serialized.headers = obfuscateHeaders(serialized.headers)
|
|
38
|
-
return serialized
|
|
39
|
-
}
|
|
40
|
-
|
|
41
|
-
function obfuscateHeaders(headers: Record<string, string>) {
|
|
42
|
-
const obfuscatedHeaders: Record<string, string> = {}
|
|
43
|
-
for (const key in headers) {
|
|
44
|
-
if (key.toLowerCase() === 'authorization') {
|
|
45
|
-
obfuscatedHeaders[key] = obfuscateAuthHeader(headers[key])
|
|
46
|
-
} else if (key.toLowerCase() === 'dpop') {
|
|
47
|
-
obfuscatedHeaders[key] = obfuscateJws(headers[key]) || 'Invalid'
|
|
48
|
-
} else {
|
|
49
|
-
obfuscatedHeaders[key] = headers[key]
|
|
50
|
-
}
|
|
51
|
-
}
|
|
52
|
-
return obfuscatedHeaders
|
|
53
|
-
}
|
|
54
|
-
|
|
55
|
-
function obfuscateAuthHeader(authHeader: string): string {
|
|
56
|
-
// This is a hot path (runs on every request). Avoid using split() or regex.
|
|
57
|
-
|
|
58
|
-
const spaceIdx = authHeader.indexOf(' ')
|
|
59
|
-
if (spaceIdx === -1) return 'Invalid'
|
|
60
|
-
|
|
61
|
-
const type = authHeader.slice(0, spaceIdx)
|
|
62
|
-
switch (type.toLowerCase()) {
|
|
63
|
-
case 'bearer':
|
|
64
|
-
return `${type} ${obfuscateBearer(authHeader.slice(spaceIdx + 1))}`
|
|
65
|
-
case 'dpop':
|
|
66
|
-
return `${type} ${obfuscateJws(authHeader.slice(spaceIdx + 1)) || 'Invalid'}`
|
|
67
|
-
case 'basic':
|
|
68
|
-
return `${type} ${obfuscateBasic(authHeader.slice(spaceIdx + 1)) || 'Invalid'}`
|
|
69
|
-
default:
|
|
70
|
-
return `Invalid`
|
|
71
|
-
}
|
|
72
|
-
}
|
|
73
|
-
|
|
74
|
-
function obfuscateBasic(token: string): null | string {
|
|
75
|
-
if (!token) return null
|
|
76
|
-
const buffer = Buffer.from(token, 'base64')
|
|
77
|
-
if (!buffer.length) return null // Buffer.from will silently ignore invalid base64 chars
|
|
78
|
-
const authHeader = buffer.toString('utf8')
|
|
79
|
-
const colIdx = authHeader.indexOf(':')
|
|
80
|
-
if (colIdx === -1) return null
|
|
81
|
-
const username = authHeader.slice(0, colIdx)
|
|
82
|
-
return `${username}:***`
|
|
83
|
-
}
|
|
84
|
-
|
|
85
|
-
function obfuscateBearer(token: string): string {
|
|
86
|
-
return obfuscateJws(token) || obfuscateToken(token)
|
|
87
|
-
}
|
|
88
|
-
|
|
89
|
-
function obfuscateToken(token: string): string {
|
|
90
|
-
return token ? '***' : ''
|
|
91
|
-
}
|
|
92
|
-
|
|
93
|
-
function obfuscateJws(token: string): null | string {
|
|
94
|
-
const firstDot = token.indexOf('.')
|
|
95
|
-
if (firstDot === -1) return null
|
|
96
|
-
|
|
97
|
-
const secondDot = token.indexOf('.', firstDot + 1)
|
|
98
|
-
if (secondDot === -1) return null
|
|
99
|
-
|
|
100
|
-
if (token.indexOf('.', secondDot + 1) !== -1) return null
|
|
101
|
-
|
|
102
|
-
// Strip the signature
|
|
103
|
-
return token.slice(0, secondDot) + '.obfuscated'
|
|
104
|
-
}
|