@datocms/rest-client-utils 5.8.0 → 6.1.1

package/src/__tests__/request.test.ts

@@ -0,0 +1,105 @@
+import { ApiError, TimeoutError } from '../errors';
+import { request } from '../request';
+
+const API_TOKEN = 'aaaabbbbccccdddd';
+
+function jsonResponse(status: number, body: unknown) {
+  return new Response(JSON.stringify(body), {
+    status,
+    statusText: 'Unprocessable Entity',
+    headers: { 'Content-Type': 'application/json' },
+  });
+}
+
+function buildOptions(fetchFn: typeof fetch) {
+  return {
+    baseUrl: 'https://site-api.datocms.com',
+    fetchJobResult: async () => {
+      throw new Error('not needed');
+    },
+    fetchFn,
+    apiToken: API_TOKEN,
+    method: 'GET' as const,
+    url: '/items/bad-id',
+    autoRetry: false,
+  };
+}
+
+describe('request()', () => {
+  it('sends the real API token, but keeps it out of the error', async () => {
+    let sentAuthorization: string | undefined;
+
+    const fetchFn = jest.fn(async (_url: unknown, init?: RequestInit) => {
+      sentAuthorization = (init?.headers as Record<string, string>)
+        ?.authorization;
+      return jsonResponse(422, { data: [] });
+    }) as unknown as typeof fetch;
+
+    const error: ApiError = await request(buildOptions(fetchFn)).then(
+      () => {
+        throw new Error('expected the request to fail');
+      },
+      (error) => error,
+    );
+
+    expect(error).toBeInstanceOf(ApiError);
+    expect(sentAuthorization).toBe(`Bearer ${API_TOKEN}`);
+    expect(error.request.headers.authorization).toBe(
+      '[REDACTED, ending in dddd]',
+    );
+    expect(JSON.stringify(error)).not.toContain(API_TOKEN);
+  });
+
+  it('keeps the token out of a timeout error too', async () => {
+    const fetchFn = (async () => {
+      const error: NodeJS.ErrnoException = new Error('timeout');
+      error.code = 'ETIMEDOUT';
+      throw error;
+    }) as unknown as typeof fetch;
+
+    const error: TimeoutError = await request({
+      ...buildOptions(fetchFn),
+      autoRetry: false,
+    }).then(
+      () => {
+        throw new Error('expected the request to fail');
+      },
+      (error) => error,
+    );
+
+    expect(error).toBeInstanceOf(TimeoutError);
+    expect(error.request.headers.authorization).toBe(
+      '[REDACTED, ending in dddd]',
+    );
+  });
+
+  it('does not spill the failed call through incidental serialization', async () => {
+    const fetchFn = (async () =>
+      jsonResponse(422, {
+        data: [],
+      })) as unknown as typeof fetch;
+
+    const error: ApiError = await request({
+      ...buildOptions(fetchFn),
+      body: {
+        data: { attributes: { url: 'https://example.com/?token=s3cr3t' } },
+      },
+    }).then(
+      () => {
+        throw new Error('expected the request to fail');
+      },
+      (error) => error,
+    );
+
+    // `request` and `response` stay readable...
+    expect(error.request.url).toContain('/items/bad-id');
+    expect(error.response.status).toBe(422);
+
+    // ...but no longer travel by accident: this is what `console.error()`,
+    // `serialize-error` and most error trackers walk.
+    expect(Object.keys(error)).not.toContain('request');
+    expect(Object.keys(error)).not.toContain('response');
+    expect(JSON.stringify(error)).not.toContain('s3cr3t');
+    expect(JSON.stringify({ ...error })).not.toContain('s3cr3t');
+  });
+});

package/src/errors.ts

@@ -72,6 +72,19 @@ export type ApiErrorResponse = {
 const TIMEOUT_ERROR = Symbol.for('@datocms/rest-client-utils:TimeoutError');
 const API_ERROR = Symbol.for('@datocms/rest-client-utils:ApiError');
 
+/**
+ * Hides properties from anything that walks own enumerable keys —
+ * `console.error()`, `JSON.stringify()`, object spread, `serialize-error`,
+ * error trackers. Reading `error.request` explicitly keeps working exactly as
+ * before; the data just stops travelling by accident, since the request and
+ * response of a failed call can carry credentials and other secrets.
+ */
+function hideProperties(target: object, keys: string[]) {
+  for (const key of keys) {
+    Object.defineProperty(target, key, { enumerable: false });
+  }
+}
+
 export type TimeoutErrorInitObject = {
   request: ApiErrorRequest;
   preCallStack?: string;
@@ -126,6 +139,8 @@ export class TimeoutError extends Error {
     this.request = initObject.request;
     this.preCallStack = initObject.preCallStack;
 
+    hideProperties(this, ['request', 'preCallStack']);
+
     this.message = `${initObject.request.method} ${initObject.request.url}: Timeout error`;
 
     if (this.preCallStack) {
@@ -187,6 +202,8 @@ export class ApiError extends Error {
     this.response = initObject.response;
     this.preCallStack = initObject.preCallStack;
 
+    hideProperties(this, ['request', 'response', 'preCallStack']);
+
     let message = `${initObject.request.method} ${initObject.request.url}: ${this.response.status} ${this.response.statusText}`;
 
     if (this.errors.length > 0) {

package/src/request.ts

@@ -68,6 +68,36 @@ function headersToObject(headers: Headers): Record<string, string> {
   return result;
 }
 
+/**
+ * Headers whose value must never end up inside an error object.
+ *
+ * Right now this client only ever sets one of them, but the list is the point:
+ * a header added here is redacted everywhere an error can reach.
+ */
+const SENSITIVE_HEADERS = ['authorization'];
+
+/**
+ * Returns a copy of the request headers with every sensitive value blanked out.
+ *
+ * Errors travel: they get logged, serialized, sent to error trackers, and — as
+ * we learned the hard way — occasionally echoed back to an HTTP client. The
+ * real headers are only ever handed to `fetch()`; what we keep on the error is
+ * this redacted copy.
+ */
+function redactHeaders(
+  headers: Record<string, string>,
+): Record<string, string> {
+  return Object.fromEntries(
+    Object.entries(headers).map(([key, value]) =>
+      SENSITIVE_HEADERS.includes(key.toLowerCase())
+        ? // The last 4 characters are enough to tell two tokens apart while
+          // debugging, and useless to whoever gets hold of the log.
+          [key, `[REDACTED, ending in ${value.slice(-4)}]`]
+        : [key, value],
+    ),
+  );
+}
+
 function buildApiErrorInitObject(
   method: string,
   url: string,
@@ -191,6 +221,8 @@ export async function request<T>(options: RequestOptions): Promise<T> {
     delete headers['user-agent'];
   }
 
+  const redactedHeaders = redactHeaders(headers);
+
   const baseUrl = options.baseUrl.replace(/\/$/, '');
   const body = options.body ? JSON.stringify(options.body, null, 2) : undefined;
 
@@ -206,7 +238,7 @@ export async function request<T>(options: RequestOptions): Promise<T> {
   if (logLevel >= LogLevel.BASIC) {
     log(`[${requestId}] ${options.method} ${url}`);
     if (logLevel >= LogLevel.BODY_AND_HEADERS) {
-      for (const [key, value] of Object.entries(headers || {})) {
+      for (const [key, value] of Object.entries(redactedHeaders)) {
         log(`[${requestId}] ${key}: ${value}`);
       }
     }
@@ -215,6 +247,10 @@ export async function request<T>(options: RequestOptions): Promise<T> {
     }
   }
 
+  // Declared out here so that the `finally` below can always clear it: a timer
+  // left pending keeps Node's event loop alive for as long as it runs.
+  let timeoutId: ReturnType<typeof setTimeout> | undefined;
+
   try {
     const requestPromise = makeCancelablePromise(
       fetchFn(url, {
@@ -224,14 +260,12 @@ export async function request<T>(options: RequestOptions): Promise<T> {
       }),
     );
 
-    const timeoutId = setTimeout(() => {
+    timeoutId = setTimeout(() => {
       requestPromise.cancel();
     }, options.requestTimeout || 30000);
 
     const response = await requestPromise;
 
-    clearTimeout(timeoutId);
-
     const responseContentType = response.headers.get('Content-Type');
     const invalidContentType =
       responseContentType && !responseContentType.includes('application/json');
@@ -242,7 +276,7 @@ export async function request<T>(options: RequestOptions): Promise<T> {
           buildApiErrorInitObject(
             options.method,
             url,
-            headers,
+            redactedHeaders,
             options.body,
             response,
             undefined,
@@ -308,7 +342,7 @@ export async function request<T>(options: RequestOptions): Promise<T> {
           buildApiErrorInitObjectFromJobResult(
             options.method,
             url,
-            headers,
+            redactedHeaders,
             options.body,
             jobResult.status,
             jobResult.payload,
@@ -328,7 +362,7 @@ export async function request<T>(options: RequestOptions): Promise<T> {
       buildApiErrorInitObject(
         options.method,
         url,
-        headers,
+        redactedHeaders,
         options.body,
         response,
         responseBody,
@@ -373,7 +407,7 @@ export async function request<T>(options: RequestOptions): Promise<T> {
         buildTimeoutErrorInitObject(
           options.method,
           url,
-          headers,
+          redactedHeaders,
           options.body,
           preCallStack,
         ),
@@ -381,5 +415,7 @@ export async function request<T>(options: RequestOptions): Promise<T> {
     }
 
     throw error;
+  } finally {
+    clearTimeout(timeoutId);
   }
 }