@cumulus/es-client 20.1.3-alpha.2 → 20.2.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cumulus/es-client",
-  "version": "20.1.3-alpha.2",
+  "version": "20.2.1",
   "description": "Utilities for working with Elasticsearch",
   "keywords": [
     "CUMULUS",
@@ -34,10 +34,10 @@
   "license": "Apache-2.0",
   "dependencies": {
     "@aws-sdk/credential-providers": "^3.621.0",
-    "@cumulus/common": "20.1.3-alpha.2",
-    "@cumulus/errors": "20.1.3-alpha.2",
-    "@cumulus/logger": "20.1.3-alpha.2",
-    "@cumulus/message": "20.1.3-alpha.2",
+    "@cumulus/common": "20.2.1",
+    "@cumulus/errors": "20.2.1",
+    "@cumulus/logger": "20.2.1",
+    "@cumulus/message": "20.2.1",
     "@elastic/elasticsearch": "^5.6.20",
     "aws4": "^1.12.0",
     "lodash": "~4.17.21",
@@ -45,9 +45,9 @@
     "p-limit": "^1.2.0"
   },
   "devDependencies": {
-    "@cumulus/aws-client": "20.1.3-alpha.2",
-    "@cumulus/test-data": "20.1.3-alpha.2",
+    "@cumulus/aws-client": "20.2.1",
+    "@cumulus/test-data": "20.2.1",
     "p-each-series": "^2.1.0"
   },
-  "gitHead": "c859f53331e38f38652e5ef124d4c79ceda32757"
+  "gitHead": "8aeab83b5fd9f7e1818d4631e1e36535e443ae90"
 }

package/search.js

@@ -9,6 +9,8 @@
 
 const has = require('lodash/has');
 const omit = require('lodash/omit');
+const isString = require('lodash/isString');
+const isError = require('lodash/isError');
 const { fromNodeProviderChain } = require('@aws-sdk/credential-providers');
 const elasticsearch = require('@elastic/elasticsearch');
 
@@ -29,6 +31,68 @@ const multipleRecordFoundString = 'More than one record was found!';
 const recordNotFoundString = 'Record not found';
 const logger = new Logger({ sender: '@cumulus/es-client/search' });
 
+class HttpError extends Error {
+  constructor(statusCode, message) {
+    super(message);
+    this.statusCode = statusCode;
+    this.name = 'HttpError';
+  }
+}
+
+/**
+ * Sanitizes sensitive data in error messages or logs
+ *
+ * @param {Error|string} input - The error object or message to sanitize
+ * @returns {Error|string} - Sanitized error or message
+ */
+const sanitizeSensitive = (input) => {
+  const sensitiveFields = [
+    `${process.env.METRICS_ES_USER}:${process.env.METRICS_ES_PASS}`,
+  ].filter(Boolean);
+
+  let message = isString(input) ? input : input.message || input.toString();
+
+  const escapeRegExp = (string) => string.replace(/[$()*+.?[\\\]^{|}-]/g, '\\$&');
+
+  sensitiveFields.forEach((field) => {
+    if (field) {
+      const pattern = `(^|\\s|[^a-zA-Z0-9_])(${escapeRegExp(field)})($|\\s|[^a-zA-Z0-9_])`;
+      message = message.replace(new RegExp(pattern, 'g'), '$1*****$3');
+    }
+  });
+
+  if (isString(input)) {
+    return message;
+  }
+
+  const sanitizedError = new Error(message);
+  sanitizedError.stack = input.stack;
+  return sanitizedError;
+};
+
+/**
+ * Custom logger for elasticsearch client to sanitize sensitive data
+ */
+class EsCustomLogger {
+  constructor() {
+    this.levels = ['error', 'warning']; // Log only errors and warnings
+  }
+
+  error(message) {
+    logger.error(sanitizeSensitive(message));
+  }
+
+  warning(message) {
+    logger.warn(sanitizeSensitive(message));
+  }
+
+  info() {}
+
+  debug() {}
+
+  trace() {}
+}
+
 /**
  * Returns the local address of elasticsearch based on
  * environment variables
@@ -102,12 +166,14 @@ const esMetricsConfig = () => {
     throw new Error('ELK Metrics stack not configured');
   }
 
-  const node = `https://${process.env.METRICS_ES_USER}:${
-    process.env.METRICS_ES_PASS}@${process.env.METRICS_ES_HOST}`;
+  const encodedUser = encodeURIComponent(process.env.METRICS_ES_USER);
+  const encodedPass = encodeURIComponent(process.env.METRICS_ES_PASS);
+  const node = `https://${encodedUser}:${encodedPass}@${process.env.METRICS_ES_HOST}`;
 
   return {
     node,
     requestTimeout: 50000,
+    log: EsCustomLogger,
   };
 };
 
@@ -329,6 +395,7 @@ class BaseSearch {
   }
 
   async get(id, parentId) {
+    const esCustomLogger = new EsCustomLogger();
     const body = {
       query: {
         bool: {
@@ -358,23 +425,31 @@ class BaseSearch {
       await this.initializeEsClient();
     }
 
-    const result = await this.client.search({
-      index: this.index,
-      type: this.type,
-      body,
-    })
-      .then((response) => response.body);
+    try {
+      const result = await this.client.search({
+        index: this.index,
+        type: this.type,
+        body,
+      })
+        .then((response) => response.body);
+
+      if (result.hits.total > 1) {
+        return { detail: multipleRecordFoundString };
+      }
+      if (result.hits.total === 0) {
+        return { detail: recordNotFoundString };
+      }
 
-    if (result.hits.total > 1) {
-      return { detail: multipleRecordFoundString };
-    }
-    if (result.hits.total === 0) {
-      return { detail: recordNotFoundString };
+      const resp = result.hits.hits[0]._source;
+      resp._id = result.hits.hits[0]._id;
+      return resp;
+    } catch (error) {
+      esCustomLogger.error(sanitizeSensitive(error));
+      if (error.meta?.statusCode === 401) {
+        throw new HttpError(401, 'Invalid credentials');
+      }
+      throw sanitizeSensitive(error);
     }
-
-    const resp = result.hits.hits[0]._source;
-    resp._id = result.hits.hits[0]._id;
-    return resp;
   }
 
   async exists(id, parentId) {
@@ -408,7 +483,13 @@ class BaseSearch {
         results: hits.map((s) => s._source),
       };
     } catch (error) {
-      return error;
+      const esCustomLogger = new EsCustomLogger();
+      esCustomLogger.error(sanitizeSensitive(error));
+
+      if (error.meta?.statusCode === 401) {
+        throw new HttpError(401, 'Invalid credentials');
+      }
+      throw sanitizeSensitive(error);
     }
   }
 
@@ -431,7 +512,13 @@ class BaseSearch {
         counts: result.body.aggregations,
       };
     } catch (error) {
-      return error;
+      const esCustomLogger = new EsCustomLogger();
+      esCustomLogger.error(sanitizeSensitive(error));
+
+      if (error.meta?.statusCode === 401) {
+        throw new HttpError(401, 'Invalid credentials');
+      }
+      throw sanitizeSensitive(error);
     }
   }
 }
@@ -461,4 +548,6 @@ module.exports = {
   multipleRecordFoundString,
   recordNotFoundString,
   getLocalEsHost,
+  sanitizeSensitive,
+  isError,
 };