@bymax-one/nest-logger 1.0.7 → 1.0.8

package/CHANGELOG.md

@@ -11,6 +11,30 @@ heading here.
 
 ## [Unreleased]
 
+## [1.0.8] - 2026-08-10
+
+Remediation of a local audit's redaction, attribution and correlation-id findings. No API
+changed; the fixes are in the default redact set, the acting-user resolution and the docs.
+
+### Fixed
+
+- **Root-level metadata is redacted.** The default redact set now lists each sensitive field at
+  depth 0 as well as depths 1–4, so a value spread into a log record's own root — as
+  `emitStructured` does with caller metadata — is scrubbed. The depth-1-and-deeper wildcards never
+  reached the root, so a field named `password` passed as metadata was written in clear.
+- **Acting-user attribution reads the JWT subject first.** The HTTP logging interceptor and the
+  exception filter now resolve the acting user as `sub ?? id`, so a JWT principal (every
+  `@bymax-one/nest-auth` token) is attributed to its subject rather than an ORM `id` when a
+  principal carries both.
+
+### Documentation
+
+- The advertised default redact-path count is corrected from 113 to **140** (27 fields across
+  depths 0–4, plus 5 absolute header paths) across the README and the technical specification.
+- The correlation-id charset comment now describes what the middleware actually does — echo
+  `x-request-id` and store `requestId` in the log context — instead of a non-existent
+  error-envelope `correlationId` field.
+
 ## [1.0.7] - 2026-08-07
 
 **Documentation and tooling.** `dist/` differs from `1.0.6` only in the text of the comments
@@ -316,7 +340,8 @@ published `dist/` is identical — no runtime behaviour changes for consumers.
 - Professional CI suite: `ci.yml`, `bench.yml`, `codeql.yml`, `scorecard.yml`,
   `release.yml`, Dependabot, and issue templates
 
-[Unreleased]: https://github.com/bymaxone/nest-logger/compare/v1.0.7...HEAD
+[Unreleased]: https://github.com/bymaxone/nest-logger/compare/v1.0.8...HEAD
+[1.0.8]: https://github.com/bymaxone/nest-logger/compare/v1.0.7...v1.0.8
 [1.0.7]: https://github.com/bymaxone/nest-logger/compare/v1.0.6...v1.0.7
 [1.0.6]: https://github.com/bymaxone/nest-logger/compare/v1.0.5...v1.0.6
 [1.0.5]: https://github.com/bymaxone/nest-logger/compare/v1.0.4...v1.0.5

package/README.md

@@ -43,7 +43,7 @@ The library has **zero direct dependencies** — all packages arrive as peer dep
 
 - **🎯 One module, the whole pipeline** — Logger service, HTTP interceptor, exception filter, context propagation, redaction, and destinations arrive in a single `forRoot()`. No gluing together `pino-http`, a redaction layer, and a transport by hand.
 - **🔌 Your sinks, your rules** — The library defines `ILogDestination`. You implement it for Loki, Postgres, a rolling file, or anything else. No vendor lock-in, no hidden transport dependencies.
-- **🔒 Redacted by default** — 113 redact paths compile at bootstrap covering the standard set: passwords, tokens, PCI DSS card data, MFA secrets, and LGPD documents. Domain-specific field names are yours to add via `redactPaths`.
+- **🔒 Redacted by default** — 140 redact paths compile at bootstrap covering the standard set: passwords, tokens, PCI DSS card data, MFA secrets, and LGPD documents. Domain-specific field names are yours to add via `redactPaths`.
 - **⚡ On the hot path, so it stays cheap** — Singleton providers, one composed Pino mixin, and a pre-compiled redactor. No `Scope.REQUEST`, no per-log regex matching.
 - **🔭 Correlated when you need it** — When an OpenTelemetry span is active, `traceId`/`spanId`/`traceFlags` land in every entry. When the peer is absent, the mixin steps aside at zero cost.
 
@@ -65,7 +65,7 @@ pnpm add @bymax-one/nest-logger
 
 ### 🛡️ Security & Privacy
 
-- ✅ **PII Redaction by Default** — 113 paths covering passwords, tokens, and generic secrets — powered by `fast-redact`
+- ✅ **PII Redaction by Default** — 140 paths covering passwords, tokens, and generic secrets — powered by `fast-redact`
 - ✅ **PCI DSS & MFA Coverage** — card data and MFA secrets redacted out of the box, with common HTTP auth headers
 - ✅ **LGPD-Aware Paths** — CPF, CNPJ, and RG redacted by default for Brazilian workloads
 - ✅ **Append-Only Redact List** — `DEFAULT_REDACT_PATHS` never shrinks without a major version; extend it via `redactPaths`
@@ -374,7 +374,7 @@ Full options reference for `BymaxLoggerModule.forRoot(options)`:
 | `level`                      | `LogLevel`          | `'info'`        | Minimum log level. One of `fatal \| error \| warn \| info \| debug \| trace`                                             |
 | `isPretty`                   | `boolean`           | `!isProduction` | ⚠️ Reserved — not auto-wired. For pretty output add `new PrettyDevDestination()` to `destinations` (needs `pino-pretty`) |
 | `redactPaths`                | `string[]`          | `[]`            | Additional `fast-redact` paths merged with the defaults                                                                  |
-| `shouldDisableDefaultRedact` | `boolean`           | `false`         | Skip the 113 default PII paths. ⚠️ Emits a bootstrap warning — document why                                              |
+| `shouldDisableDefaultRedact` | `boolean`           | `false`         | Skip the 140 default PII paths. ⚠️ Emits a bootstrap warning — document why                                              |
 | `redactCensor`               | `string`            | `'[REDACTED]'`  | Replacement value written in place of every redacted field                                                               |
 | `maxEntrySizeBytes`          | `number`            | `65536`         | UTF-8 byte ceiling per serialized field (`err` + any custom serializer); over it the value becomes a truncation envelope |
 | `destinations`               | `ILogDestination[]` | `[]`            | Additional sinks (Loki, Postgres, rolling file, …) alongside default stdout                                              |
@@ -605,7 +605,7 @@ Application Service
               └── OTel span      → { traceId, spanId, traceFlags }
               │
               ▼
-         fast-redact             ← compiled redact function (113 paths)
+         fast-redact             ← compiled redact function (140 paths)
               │
               ▼
     ┌─────────────────────────────┐
@@ -622,7 +622,7 @@ Application Service
 | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | **🪶 Singleton Scope**        | `AsyncLocalStorage` delivers per-request context at zero latency overhead — NestJS `Scope.REQUEST` adds ~5% on the injection graph, unacceptable on a logger that runs for every request         |
 | **🧬 One Composed Mixin**     | ALS context and OTel trace context merge into a single Pino mixin with a deterministic order: ALS first, then OTel — an active span is the authoritative trace identity, so it wins on conflicts |
-| **⚡ Compiled Redaction**     | 113 `fast-redact` paths compile once at module bootstrap into a specialized function; no per-log regex matching, under 3% throughput impact                                                      |
+| **⚡ Compiled Redaction**     | 140 `fast-redact` paths compile once at module bootstrap into a specialized function; no per-log regex matching, under 3% throughput impact                                                      |
 | **🔌 Interface-Driven Sinks** | `ILogDestination` is a contract — Loki, Postgres, rolling files, or anything else is a consumer implementation, never a dependency of this package                                               |
 | **🌳 Zero Runtime Deps**      | `"dependencies": {}` — every package arrives as a peer dependency, so consumers pin exact versions and the supply-chain surface stays theirs                                                     |
 
@@ -634,7 +634,7 @@ A logger sees every payload the application handles, so the security posture is
 
 ### Redaction by default
 
-The library ships **113 redact paths** compiled at initialization into a single `fast-redact` function (< 3% throughput impact). These cover:
+The library ships **140 redact paths** compiled at initialization into a single `fast-redact` function (< 3% throughput impact). These cover:
 
 | Category                  | Fields                                                                                                                                    |
 | ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
@@ -709,7 +709,7 @@ When integrating `@bymax-one/nest-logger` in production, verify each of the foll
 
 | Layer               | Implementation                                                                                                     |
 | ------------------- | ------------------------------------------------------------------------------------------------------------------ |
-| PII Redaction       | 113 `fast-redact` paths compiled once at bootstrap — no per-log regex matching                                     |
+| PII Redaction       | 140 `fast-redact` paths compiled once at bootstrap — no per-log regex matching                                     |
 | Credentials         | `password`, `passwordHash`, `token`, `accessToken`, `refreshToken`, `apiKey`, `apiSecret`, `privateKey`            |
 | MFA Secrets         | `mfaSecret`, `mfaRecoveryCodes`, `totpSecret` — redacted at wildcard depths 1–4                                    |
 | PCI DSS             | `cardNumber`, `cardCvv`, `cvv`, `cvc`, `cardExpiry`                                                                |

package/dist/server/index.cjs

@@ -520,7 +520,7 @@ exports.HttpExceptionFilter = class HttpExceptionFilter {
     const ctx = host.switchToHttp();
     const res = ctx.getResponse();
     const req = ctx.getRequest();
-    const userId = req.user?.id;
+    const userId = req.user?.sub ?? req.user?.id;
     const url = stripQueryString(req.url);
     if (exception instanceof common.HttpException) {
       const status2 = exception.getStatus();
@@ -605,7 +605,7 @@ exports.HttpLoggingInterceptor = class HttpLoggingInterceptor {
     }
     const rawUserAgent = req.headers["user-agent"];
     const userAgent = typeof rawUserAgent === "string" ? rawUserAgent : UNKNOWN_USER_AGENT;
-    const userId = req.user?.id;
+    const userId = req.user?.sub ?? req.user?.id;
     const normalizedUrl = normalizeUrl(url);
     const start = Date.now();
     this.logger.info(RESERVED_LOG_KEYS.HTTP_REQUEST_START, `${method} ${normalizedUrl}`, userId, {
@@ -820,6 +820,7 @@ var REDACT_ABSOLUTE_PATHS = [
   'res.headers["set-cookie"]'
 ];
 var DEFAULT_REDACT_PATHS = [
+  ...REDACT_COMMON_FIELDS,
   ...REDACT_COMMON_FIELDS.flatMap((field) => depth(field)),
   ...REDACT_ABSOLUTE_PATHS
 ];
@@ -1344,8 +1345,9 @@ var PrettyDevDestination = class {
 };
 var REQUEST_ID_HEADER = "x-request-id";
 var MAX_CORRELATION_ID_LENGTH = 256;
+var CORRELATION_ID_CHARSET = /^[A-Za-z0-9._:/+=-]+$/;
 function isAcceptableHeaderValue(value) {
-  return typeof value === "string" && value.length <= MAX_CORRELATION_ID_LENGTH;
+  return typeof value === "string" && value.length <= MAX_CORRELATION_ID_LENGTH && CORRELATION_ID_CHARSET.test(value);
 }
 exports.RequestIdMiddleware = class RequestIdMiddleware {
   /**

package/dist/server/index.d.cts

@@ -778,7 +778,11 @@ type IncomingHeaders = Record<string, string | string[] | undefined>;
  * The inbound request members the logging layer reads.
  *
  * `user` is populated by upstream auth in the consumer app (a guard or
- * middleware); only `id` is ever read, for the acting-user log field.
+ * middleware). The acting-user id is read as `sub` first, then `id`: a JWT principal
+ * (every `@bymax-one/nest-auth` token) names it `sub`, while an ORM-style principal
+ * names it `id`. The JWT subject wins when both are present, since it is the
+ * authenticated identity. Reading only `id` — as this once did — silently dropped
+ * the user field for every JWT-authenticated request.
  */
 interface LoggableRequest {
     /** Inbound headers — read for correlation ids and the user agent. */
@@ -789,9 +793,14 @@ interface LoggableRequest {
     readonly url: string;
     /** Client address when the adapter resolves one. */
     readonly ip?: string | undefined;
-    /** Authenticated principal, when upstream auth attached one. */
+    /**
+     * Authenticated principal, when upstream auth attached one. `id` is the
+     * ORM-style identifier; `sub` is the JWT subject claim. The logging layer reads
+     * whichever is present.
+     */
     readonly user?: {
         readonly id?: string | undefined;
+        readonly sub?: string | undefined;
     } | undefined;
 }
 /**
@@ -920,7 +929,16 @@ declare const LOG_CONTEXT_TOKEN: unique symbol;
 
 /**
  * Canonical list of redact paths merged into Pino's `redact.paths` option by
- * default. Expected length: 27 common fields × 4 depths + 5 absolute = **113**.
+ * default. Expected length: 27 root fields + 27 common fields × 4 depths + 5
+ * absolute = **140**.
+ *
+ * The bare field names come first, at depth 0 — the log record's own root.
+ * `emitStructured` spreads caller metadata there (`{ ...metadata, logKey, ... }`),
+ * so a field named `password` passed as metadata lands at the root, which the
+ * depth-1-and-deeper wildcards below never reach (`fast-redact`'s `*` matches a
+ * level, not the root). Without the bare name the library's own documented call
+ * `logger.info(key, msg, userId, { password })` would write the password in clear.
+ * Listing it makes the default set cover a sensitive field wherever it appears.
  */
 declare const DEFAULT_REDACT_PATHS: readonly string[];
 

package/dist/server/index.d.ts

@@ -778,7 +778,11 @@ type IncomingHeaders = Record<string, string | string[] | undefined>;
  * The inbound request members the logging layer reads.
  *
  * `user` is populated by upstream auth in the consumer app (a guard or
- * middleware); only `id` is ever read, for the acting-user log field.
+ * middleware). The acting-user id is read as `sub` first, then `id`: a JWT principal
+ * (every `@bymax-one/nest-auth` token) names it `sub`, while an ORM-style principal
+ * names it `id`. The JWT subject wins when both are present, since it is the
+ * authenticated identity. Reading only `id` — as this once did — silently dropped
+ * the user field for every JWT-authenticated request.
  */
 interface LoggableRequest {
     /** Inbound headers — read for correlation ids and the user agent. */
@@ -789,9 +793,14 @@ interface LoggableRequest {
     readonly url: string;
     /** Client address when the adapter resolves one. */
     readonly ip?: string | undefined;
-    /** Authenticated principal, when upstream auth attached one. */
+    /**
+     * Authenticated principal, when upstream auth attached one. `id` is the
+     * ORM-style identifier; `sub` is the JWT subject claim. The logging layer reads
+     * whichever is present.
+     */
     readonly user?: {
         readonly id?: string | undefined;
+        readonly sub?: string | undefined;
     } | undefined;
 }
 /**
@@ -920,7 +929,16 @@ declare const LOG_CONTEXT_TOKEN: unique symbol;
 
 /**
  * Canonical list of redact paths merged into Pino's `redact.paths` option by
- * default. Expected length: 27 common fields × 4 depths + 5 absolute = **113**.
+ * default. Expected length: 27 root fields + 27 common fields × 4 depths + 5
+ * absolute = **140**.
+ *
+ * The bare field names come first, at depth 0 — the log record's own root.
+ * `emitStructured` spreads caller metadata there (`{ ...metadata, logKey, ... }`),
+ * so a field named `password` passed as metadata lands at the root, which the
+ * depth-1-and-deeper wildcards below never reach (`fast-redact`'s `*` matches a
+ * level, not the root). Without the bare name the library's own documented call
+ * `logger.info(key, msg, userId, { password })` would write the password in clear.
+ * Listing it makes the default set cover a sensitive field wherever it appears.
  */
 declare const DEFAULT_REDACT_PATHS: readonly string[];
 

package/dist/server/index.mjs

@@ -514,7 +514,7 @@ var HttpExceptionFilter = class {
     const ctx = host.switchToHttp();
     const res = ctx.getResponse();
     const req = ctx.getRequest();
-    const userId = req.user?.id;
+    const userId = req.user?.sub ?? req.user?.id;
     const url = stripQueryString(req.url);
     if (exception instanceof HttpException) {
       const status2 = exception.getStatus();
@@ -599,7 +599,7 @@ var HttpLoggingInterceptor = class {
     }
     const rawUserAgent = req.headers["user-agent"];
     const userAgent = typeof rawUserAgent === "string" ? rawUserAgent : UNKNOWN_USER_AGENT;
-    const userId = req.user?.id;
+    const userId = req.user?.sub ?? req.user?.id;
     const normalizedUrl = normalizeUrl(url);
     const start = Date.now();
     this.logger.info(RESERVED_LOG_KEYS.HTTP_REQUEST_START, `${method} ${normalizedUrl}`, userId, {
@@ -814,6 +814,7 @@ var REDACT_ABSOLUTE_PATHS = [
   'res.headers["set-cookie"]'
 ];
 var DEFAULT_REDACT_PATHS = [
+  ...REDACT_COMMON_FIELDS,
   ...REDACT_COMMON_FIELDS.flatMap((field) => depth(field)),
   ...REDACT_ABSOLUTE_PATHS
 ];
@@ -1338,8 +1339,9 @@ var PrettyDevDestination = class {
 };
 var REQUEST_ID_HEADER = "x-request-id";
 var MAX_CORRELATION_ID_LENGTH = 256;
+var CORRELATION_ID_CHARSET = /^[A-Za-z0-9._:/+=-]+$/;
 function isAcceptableHeaderValue(value) {
-  return typeof value === "string" && value.length <= MAX_CORRELATION_ID_LENGTH;
+  return typeof value === "string" && value.length <= MAX_CORRELATION_ID_LENGTH && CORRELATION_ID_CHARSET.test(value);
 }
 var RequestIdMiddleware = class {
   /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-logger",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "description": "Structured JSON logging for NestJS based on Pino 10, with optional OpenTelemetry correlation.",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",
@@ -63,8 +63,8 @@
     "lint": "eslint src",
     "lint:fix": "eslint src --fix",
     "mutation": "stryker run",
+    "mutation:full": "node -e \"require('node:fs').rmSync('reports/stryker-incremental.json',{force:true,recursive:true})\" && stryker run",
     "mutation:dry-run": "stryker run --dryRunOnly",
-    "mutation:incremental": "stryker run --incremental",
     "prepare": "husky",
     "prepublishOnly": "pnpm clean && pnpm typecheck && pnpm lint && pnpm check:mutants && pnpm test:cov:all && pnpm build && pnpm check:published",
     "release": "npm publish --provenance --access public",