@bymax-one/nest-logger 1.4.6 → 1.4.7

package/CHANGELOG.md

@@ -11,6 +11,41 @@ heading here.
 
 ## [Unreleased]
 
+## [1.4.7] - 2026-11-01
+
+### Fixed
+
+- **`errorStructured` keeps its `logKey` when the `Error` cannot be read.** A hostile `Error` (a Proxy whose
+  `ownKeys` throws, an own getter that throws, a `stack` or `message` getter that throws) made the whole
+  record fail the name redaction, so the entry arrived as `LOGGER_REDACTION_FAILED` and lost the caller's
+  `logKey`, `userId` and metadata. The `Error` node is now isolated: when it cannot be walked it is replaced
+  by its sanitized form and walked again, so the name redaction still applies to whatever can be read. An
+  unreadable `stack` or `cause` no longer degrades the node to `SanitizeFailed`; it keeps `name` and
+  `message` and carries `_errorFieldsIncomplete: true`. A hostile value that is not an `Error` still fails
+  the whole record, as before.
+- **A stale comment in `HttpExceptionFilter` is corrected.** It said the cause chain was dropped at
+  `errorStructured`; the entry keeps the cause chain and `AggregateError.errors`, and the response body
+  that rides along as an own field is name-redacted. A new spec pins both.
+
+#### Apply to a derived backend
+
+Nothing to change in code. What can differ at run time:
+
+- An alert on `LOGGER_REDACTION_FAILED` that fired for an unreadable `Error` stops firing for it. The event
+  now arrives under its own `logKey`, with the `err` node carrying `_errorFieldsIncomplete: true`. To find
+  these entries going forward, filter on `err._errorFieldsIncomplete: true` or `err.type: 'SanitizeFailed'`. `LOGGER_REDACTION_FAILED` is
+  left for a record that really cannot be read, such as hostile metadata.
+- An error whose `stack` or `cause` getter throws used to reach the log as `{ type: 'SanitizeFailed' }`; it
+  now keeps its `type` and `message` and carries the marker. Code that matched `SanitizeFailed` for that
+  case should match the marker instead.
+
+### Tests
+
+- An `Error` that cannot be read has a failing-first spec at the redactor and through the real Pino
+  pipeline, including a readable `password` next to a throwing getter and a hostile `message` getter, with
+  no clear secret in the line. Two existing cases that pinned the old degradation (`SanitizeFailed` for a
+  throwing `stack` getter, the record-level envelope for a hostile `Error`) now pin the new behavior.
+
 ## [1.4.6] - 2026-11-01
 
 ### Fixed
@@ -2276,7 +2311,8 @@ published `dist/` is identical — no runtime behaviour changes for consumers.
 - Professional CI suite: `ci.yml`, `bench.yml`, `codeql.yml`, `scorecard.yml`,
   `release.yml`, Dependabot, and issue templates
 
-[Unreleased]: https://github.com/bymaxone/nest-logger/compare/v1.4.6...HEAD
+[Unreleased]: https://github.com/bymaxone/nest-logger/compare/v1.4.7...HEAD
+[1.4.7]: https://github.com/bymaxone/nest-logger/compare/v1.4.6...v1.4.7
 [1.4.6]: https://github.com/bymaxone/nest-logger/compare/v1.4.5...v1.4.6
 [1.4.5]: https://github.com/bymaxone/nest-logger/compare/v1.4.4...v1.4.5
 [1.4.4]: https://github.com/bymaxone/nest-logger/compare/v1.4.3...v1.4.4

package/README.md

@@ -729,6 +729,8 @@ Pino's standard serializer did.
 
 When those properties cannot be read (a Proxy whose `ownKeys` throws, or a getter that throws), none of them is copied and the error node carries `_errorFieldsIncomplete: true`, so an entry without its `code` is never mistaken for a complete one.
 
+An `Error` that cannot be read at all does not cost the record its `logKey`, `userId` or metadata: the node is replaced by its sanitized form, which keeps `name` and `message` and carries the same marker unless `name` or `message` itself is unreadable, in which case it is `{ type: 'SanitizeFailed' }`. Filter on `err._errorFieldsIncomplete: true` or `SanitizeFailed` to find these entries.
+
 ### 7. Context propagation with `LogContextService`
 
 ```typescript
@@ -1599,7 +1601,7 @@ The `PrettyDevDestination` errors are thrown inside `onInit`, which the registry
 | `LOGGER_OTEL_API_BROKEN`          | NDJSON line on `stderr`, once                            | `@opentelemetry/api` is installed but throws while loading, or exports no usable `trace` namespace   | Reinstall it, or turn `otel.shouldAutoInjectTraceContext` off; until then `traceId` and `spanId` are absent                 |
 | `LOGGER_BOOTSTRAP_WARNING`        | log entry with `reason: 'OTEL_API_UNAVAILABLE'`          | `otel.shouldAutoInjectTraceContext` is on and `@opentelemetry/api` cannot be resolved                | Install `@opentelemetry/api`, or turn the option off; until then `traceId` and `spanId` are absent                          |
 | `LOGGER_ENTRY_TRUNCATED`          | `_logKey` in the envelope                                | a serialized field exceeds `maxEntrySizeBytes`                                                       | Reduce the payload or raise the ceiling                                                                                     |
-| `LOGGER_REDACTION_FAILED`         | `_logKey` in the envelope, with `_redactionFailed: true` | a record cannot be walked by the redactor (a throwing getter, a hostile proxy)                       | The record is dropped whole, never partly emitted; the message and ambient context stay. Find the value that broke the walk |
+| `LOGGER_REDACTION_FAILED`         | `_logKey` in the envelope, with `_redactionFailed: true` | a record cannot be walked by the redactor (a throwing getter, a hostile proxy in the metadata)       | The record is dropped whole, never partly emitted; the message and ambient context stay. Find the value that broke the walk |
 
 ---
 

package/dist/server/index.cjs

@@ -399,12 +399,14 @@ function toSanitizedError(value, seen, depth2, maxDepth) {
     }
     seen.add(value);
     const result = { name: value.name, message: value.message };
-    if (value.stack !== void 0) {
-      result.stack = scrubStack(value.stack);
+    const stack = readOptional(() => value.stack, result);
+    if (stack !== void 0) {
+      result.stack = scrubStack(stack);
     }
     const isAtDepthLimit = depth2 >= maxDepth;
-    if (value.cause !== void 0) {
-      result.cause = isAtDepthLimit ? createDepthMarker() : toSanitizedChild(value.cause, seen, depth2 + 1, maxDepth);
+    const cause = readOptional(() => value.cause, result);
+    if (cause !== void 0) {
+      result.cause = isAtDepthLimit ? createDepthMarker() : toSanitizedChild(cause, seen, depth2 + 1, maxDepth);
     }
     const aggregated = readAggregatedErrors(value);
     if (aggregated !== void 0) {
@@ -431,7 +433,18 @@ function assignOwnErrorFields(target, source) {
       }
     }
   } catch {
-    Reflect.defineProperty(target, "_errorFieldsIncomplete", { value: true, enumerable: true });
+    markIncomplete(target);
+  }
+}
+function markIncomplete(target) {
+  Reflect.defineProperty(target, "_errorFieldsIncomplete", { value: true, enumerable: true });
+}
+function readOptional(read, node) {
+  try {
+    return read();
+  } catch {
+    markIncomplete(node);
+    return void 0;
   }
 }
 function toSanitizedChild(value, seen, depth2, maxDepth) {
@@ -1485,6 +1498,19 @@ function walk(value, sensitive, censor, depth2, ancestors, honorToJson = true) {
   if (ancestors.has(value)) {
     return REDACT_CIRCULAR;
   }
+  if (value instanceof Error) {
+    return walkError(value, sensitive, censor, depth2, ancestors, honorToJson);
+  }
+  return walkObject(value, sensitive, censor, depth2, ancestors, honorToJson);
+}
+function walkError(error, sensitive, censor, depth2, ancestors, honorToJson) {
+  try {
+    return walkObject(error, sensitive, censor, depth2, ancestors, honorToJson);
+  } catch {
+    return walk(sanitizeError(error), sensitive, censor, depth2, ancestors, honorToJson);
+  }
+}
+function walkObject(value, sensitive, censor, depth2, ancestors, honorToJson) {
   const resolvedToJson = resolveToJson(value);
   if (!resolvedToJson.fromAccessor && resolvedToJson.method === BUFFER_TO_JSON) {
     return value;

package/dist/server/index.d.cts

@@ -618,66 +618,6 @@ declare const RESERVED_LOG_KEYS_NOT_EMITTED: Readonly<{
  */
 type ReservedLogKey = (typeof RESERVED_LOG_KEYS)[keyof typeof RESERVED_LOG_KEYS];
 
-/**
- * Name-based recursive redaction.
- *
- * Layer: server/utils — the engine behind the library's DEFAULT PII protection.
- * It walks a log record once and censors every value whose KEY NAME is in the
- * sensitive set, to a bounded depth (see {@link REDACT_MAX_TRAVERSAL_DEPTH}).
- *
- * Why this replaced path matching. The previous default compiled 140
- * `fast-redact` paths, 108 of them multi-level wildcards (`*.password`,
- * `*.*.password`, …). `fast-redact` walks every key at every listed level on
- * every log call, so the cost grew with the PATH COUNT, not with the payload:
- * measured at ~107 µs per entry (≈9.3 k logs/s) against ~0.9 µs with redaction
- * off. A single traversal is O(nodes) — the same order Pino's serializer already
- * pays. The shipped configuration measures 462 k logs/s against 9.3 k, for
- * byte-identical output on every payload the old paths covered.
- *
- * It is also STRICTLY SAFER than the paths it replaces:
- *   - depth 100 instead of four, and past it the value is DROPPED rather than
- *     passed through, so the ceiling cannot become a leak the way the old one
- *     was (anything below the wildcard list's fourth level was emitted in clear);
- *   - a sensitive key is caught wherever it appears, so a headers bag logged as
- *     `{ headers: { authorization } }` is covered, not only the exact
- *     `req.headers.authorization` shape the absolute paths pinned.
- *
- * Three value kinds need special handling, and getting any of them wrong is a
- * leak rather than a cosmetic issue:
- *   - `Error` — copied through its prototype and descriptors, so it stays an
- *     `Error` (Pino's `err` serializer keys off the instance, and `message` /
- *     `stack` are own but NON-enumerable). Skipping errors entirely left an
- *     error under any key WITHOUT a serializer serializing its own enumerable
- *     properties in clear.
- *   - anything carrying `toJSON` (`Date`, `Decimal`, Luxon, Prisma types) — the
- *     method decides the serialized form, so the walk inspects its OUTPUT.
- *     Skipping these let a `toJSON` SYNTHESIZE a secret straight past both hooks.
- *   - `ArrayBuffer` views (`Buffer`, typed arrays) — indexed byte containers,
- *     returned untouched.
- *
- * What this file cannot reach: bindings passed to `child()`. Pino pre-serializes
- * them into the instance's `chindings` fragment before any formatter runs, so
- * `PinoLoggerService.child()` applies this redactor itself.
- *
- * Contract: SNAPSHOT and NEVER-THROW. Nothing the caller passed is mutated; the
- * result is a fresh structure built from values read exactly ONCE. That is a
- * deliberate trade against an earlier copy-on-write design which returned a
- * clean subtree by reference: doing so left every accessor in it to be evaluated
- * a SECOND time by `JSON.stringify`, and a stateful getter (or `toJSON`) can
- * answer clean to the walk and `{ password }` to the serializer. Inspection
- * cannot close that window — only reading once and pinning the result can. It
- * costs ~26 % of the entry throughput, measured, and the walk is still ~36x
- * faster than the path expansion it replaced.
- *
- * Any internal failure — a throwing getter, a hostile proxy, a value the walk
- * cannot READ — degrades the whole record to a marked, secret-free envelope rather
- * than crashing the request that produced it. Writing the censor is not among those
- * failures: every copy is built so the write cannot fail, which is why a frozen
- * error keeps its fields instead of costing the record.
- *
- * @see {@link createNameRedactor}
- */
-
 /**
  * A configured redactor.
  *

package/dist/server/index.d.ts

@@ -618,66 +618,6 @@ declare const RESERVED_LOG_KEYS_NOT_EMITTED: Readonly<{
  */
 type ReservedLogKey = (typeof RESERVED_LOG_KEYS)[keyof typeof RESERVED_LOG_KEYS];
 
-/**
- * Name-based recursive redaction.
- *
- * Layer: server/utils — the engine behind the library's DEFAULT PII protection.
- * It walks a log record once and censors every value whose KEY NAME is in the
- * sensitive set, to a bounded depth (see {@link REDACT_MAX_TRAVERSAL_DEPTH}).
- *
- * Why this replaced path matching. The previous default compiled 140
- * `fast-redact` paths, 108 of them multi-level wildcards (`*.password`,
- * `*.*.password`, …). `fast-redact` walks every key at every listed level on
- * every log call, so the cost grew with the PATH COUNT, not with the payload:
- * measured at ~107 µs per entry (≈9.3 k logs/s) against ~0.9 µs with redaction
- * off. A single traversal is O(nodes) — the same order Pino's serializer already
- * pays. The shipped configuration measures 462 k logs/s against 9.3 k, for
- * byte-identical output on every payload the old paths covered.
- *
- * It is also STRICTLY SAFER than the paths it replaces:
- *   - depth 100 instead of four, and past it the value is DROPPED rather than
- *     passed through, so the ceiling cannot become a leak the way the old one
- *     was (anything below the wildcard list's fourth level was emitted in clear);
- *   - a sensitive key is caught wherever it appears, so a headers bag logged as
- *     `{ headers: { authorization } }` is covered, not only the exact
- *     `req.headers.authorization` shape the absolute paths pinned.
- *
- * Three value kinds need special handling, and getting any of them wrong is a
- * leak rather than a cosmetic issue:
- *   - `Error` — copied through its prototype and descriptors, so it stays an
- *     `Error` (Pino's `err` serializer keys off the instance, and `message` /
- *     `stack` are own but NON-enumerable). Skipping errors entirely left an
- *     error under any key WITHOUT a serializer serializing its own enumerable
- *     properties in clear.
- *   - anything carrying `toJSON` (`Date`, `Decimal`, Luxon, Prisma types) — the
- *     method decides the serialized form, so the walk inspects its OUTPUT.
- *     Skipping these let a `toJSON` SYNTHESIZE a secret straight past both hooks.
- *   - `ArrayBuffer` views (`Buffer`, typed arrays) — indexed byte containers,
- *     returned untouched.
- *
- * What this file cannot reach: bindings passed to `child()`. Pino pre-serializes
- * them into the instance's `chindings` fragment before any formatter runs, so
- * `PinoLoggerService.child()` applies this redactor itself.
- *
- * Contract: SNAPSHOT and NEVER-THROW. Nothing the caller passed is mutated; the
- * result is a fresh structure built from values read exactly ONCE. That is a
- * deliberate trade against an earlier copy-on-write design which returned a
- * clean subtree by reference: doing so left every accessor in it to be evaluated
- * a SECOND time by `JSON.stringify`, and a stateful getter (or `toJSON`) can
- * answer clean to the walk and `{ password }` to the serializer. Inspection
- * cannot close that window — only reading once and pinning the result can. It
- * costs ~26 % of the entry throughput, measured, and the walk is still ~36x
- * faster than the path expansion it replaced.
- *
- * Any internal failure — a throwing getter, a hostile proxy, a value the walk
- * cannot READ — degrades the whole record to a marked, secret-free envelope rather
- * than crashing the request that produced it. Writing the censor is not among those
- * failures: every copy is built so the write cannot fail, which is why a frozen
- * error keeps its fields instead of costing the record.
- *
- * @see {@link createNameRedactor}
- */
-
 /**
  * A configured redactor.
  *

package/dist/server/index.mjs

@@ -396,12 +396,14 @@ function toSanitizedError(value, seen, depth2, maxDepth) {
     }
     seen.add(value);
     const result = { name: value.name, message: value.message };
-    if (value.stack !== void 0) {
-      result.stack = scrubStack(value.stack);
+    const stack = readOptional(() => value.stack, result);
+    if (stack !== void 0) {
+      result.stack = scrubStack(stack);
     }
     const isAtDepthLimit = depth2 >= maxDepth;
-    if (value.cause !== void 0) {
-      result.cause = isAtDepthLimit ? createDepthMarker() : toSanitizedChild(value.cause, seen, depth2 + 1, maxDepth);
+    const cause = readOptional(() => value.cause, result);
+    if (cause !== void 0) {
+      result.cause = isAtDepthLimit ? createDepthMarker() : toSanitizedChild(cause, seen, depth2 + 1, maxDepth);
     }
     const aggregated = readAggregatedErrors(value);
     if (aggregated !== void 0) {
@@ -428,7 +430,18 @@ function assignOwnErrorFields(target, source) {
       }
     }
   } catch {
-    Reflect.defineProperty(target, "_errorFieldsIncomplete", { value: true, enumerable: true });
+    markIncomplete(target);
+  }
+}
+function markIncomplete(target) {
+  Reflect.defineProperty(target, "_errorFieldsIncomplete", { value: true, enumerable: true });
+}
+function readOptional(read, node) {
+  try {
+    return read();
+  } catch {
+    markIncomplete(node);
+    return void 0;
   }
 }
 function toSanitizedChild(value, seen, depth2, maxDepth) {
@@ -1482,6 +1495,19 @@ function walk(value, sensitive, censor, depth2, ancestors, honorToJson = true) {
   if (ancestors.has(value)) {
     return REDACT_CIRCULAR;
   }
+  if (value instanceof Error) {
+    return walkError(value, sensitive, censor, depth2, ancestors, honorToJson);
+  }
+  return walkObject(value, sensitive, censor, depth2, ancestors, honorToJson);
+}
+function walkError(error, sensitive, censor, depth2, ancestors, honorToJson) {
+  try {
+    return walkObject(error, sensitive, censor, depth2, ancestors, honorToJson);
+  } catch {
+    return walk(sanitizeError(error), sensitive, censor, depth2, ancestors, honorToJson);
+  }
+}
+function walkObject(value, sensitive, censor, depth2, ancestors, honorToJson) {
   const resolvedToJson = resolveToJson(value);
   if (!resolvedToJson.fromAccessor && resolvedToJson.method === BUFFER_TO_JSON) {
     return value;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-logger",
-  "version": "1.4.6",
+  "version": "1.4.7",
   "description": "Structured JSON logging for NestJS based on Pino 10, with optional OpenTelemetry correlation.",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",