@dx-do/util 6.3.4 → 6.4.0

package/dist/index.cjs.js

@@ -29886,6 +29886,99 @@ function mapSupportReviver(key, value) {
     return value;
 }
 
+/**
+ * Redaction helpers for keeping auth tokens and other secrets out of logs.
+ *
+ * Auth tokens live in axios `error.config.headers` — e.g. `Authorization: Bearer
+ * <userToken>` and `X-Asm-Auth: <dxASMToken>`. Anything that serializes a whole
+ * error / config / headers object (`JSON.stringify`, an AxiosError's `.toJSON()`,
+ * `console.log(err)`, or a logger that deep-prints its argument) will spill them.
+ * These helpers strip the secrets before anything is logged or re-thrown.
+ */
+const REDACTED = '[REDACTED]';
+/** Lowercased object-key names whose values must never be logged. */
+const SENSITIVE_KEYS = new Set([
+    'authorization',
+    'x-asm-auth',
+    'cookie',
+    'set-cookie',
+    'proxy-authorization',
+    'usertoken',
+    'dxasmtoken',
+    'tenanttoken',
+    'agenttoken',
+    'accesstoken',
+    'refreshtoken',
+    'password',
+    'apikey',
+    'x-api-key',
+]);
+/** Matches `Bearer <token>` anywhere in a string. */
+const BEARER = /Bearer\s+\S+/gi;
+function redactString(value) {
+    return value.replace(BEARER, `Bearer ${REDACTED}`);
+}
+/**
+ * Returns a deep copy of `value` with sensitive object keys masked and any
+ * `Bearer <token>` substrings scrubbed. Safe to pass anything: it is
+ * circular-reference safe (axios errors are circular), and `Error` instances are
+ * reduced to `{ name, message, stack }` (all scrubbed) so their token-bearing
+ * `config`/`request`/`response` are dropped entirely.
+ */
+function redactValue(value, seen = new WeakSet()) {
+    if (typeof value === 'string')
+        return redactString(value);
+    if (value === null || typeof value !== 'object')
+        return value;
+    if (seen.has(value))
+        return '[Circular]';
+    seen.add(value);
+    if (Array.isArray(value)) {
+        return value.map((entry) => redactValue(entry, seen));
+    }
+    if (value instanceof Error) {
+        return {
+            name: value.name,
+            message: redactString(value.message),
+            stack: value.stack ? redactString(value.stack) : undefined,
+        };
+    }
+    const out = {};
+    for (const [key, entry] of Object.entries(value)) {
+        out[key] = SENSITIVE_KEYS.has(key.toLowerCase())
+            ? REDACTED
+            : redactValue(entry, seen);
+    }
+    return out;
+}
+/**
+ * Strips auth tokens from an (possibly Axios) error IN PLACE and returns it, so it
+ * stays a throwable `Error` with its stack intact but no longer carries the token
+ * in `config.headers`, `response.config.headers`, or the raw request header string.
+ * Non-error / non-axios values are returned unchanged.
+ *
+ * Use this at the axios boundary (a response error interceptor) so every catch,
+ * re-throw, and top-level handler downstream sees a token-free error.
+ */
+function sanitizeAxiosError(err) {
+    if (!err || typeof err !== 'object')
+        return err;
+    const e = err;
+    // Only touch things that look like axios errors.
+    if (!e.isAxiosError && !e.config && !e.response)
+        return err;
+    if (e.config?.headers)
+        e.config.headers = redactValue(e.config.headers);
+    if (e.response?.config?.headers) {
+        e.response.config.headers = redactValue(e.response.config.headers);
+    }
+    // Node's ClientRequest keeps the raw request (incl. the Authorization line) in `_header`.
+    if (e.request && typeof e.request._header === 'string') {
+        e.request._header = redactString(e.request._header);
+    }
+    return err;
+}
+
 class RemoveEmptyTransform extends node_stream.Transform {
     _transform(chunk, encoding, callback) {
         const possiblyEmptyChunk = chunk.toString().trim();
@@ -29908,4 +30001,6 @@ exports.enumFromValue = enumFromValue;
 exports.enumToString = enumToString;
 exports.mapSupportReplacer = mapSupportReplacer;
 exports.mapSupportReviver = mapSupportReviver;
+exports.redactValue = redactValue;
+exports.sanitizeAxiosError = sanitizeAxiosError;
 //# sourceMappingURL=index.cjs.js.map