@elisra-devops/docgen-data-provider 1.141.0 → 1.143.0

package/src/utils/logger.ts

@@ -4,7 +4,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as Transport from 'winston-transport';
 import { runContextStore } from './runContext';
-import { getLogSink, DiagnosticEvent } from './logSink';
+import { getLogSink, DiagnosticEvent, CONTEXT_LIMITS } from './logSink';
 let logger: winston.Logger;
 
 // Merges the ambient runId (set by content-control's request middleware, once Phase 3 lands
@@ -29,7 +29,24 @@ export const withRunContext = winston.format((info) => {
 // "accesskey" (not just "minioaccesskey") so this also catches an *AccessKeyId-style field —
 // a real gap found in api-gate's copy during the Phase 5 manifest work: only the *SecretKey
 // sibling was covered before, via "secret". Applied here too to keep the four copies in sync.
-const SENSITIVE_KEY = /token|pat|password|secret|authorization|accesskey|minioaccesskey|miniosecretkey/i;
+// Word-based, not substring: the key is split into lower-case words (camelCase, kebab-case and
+// snake_case alike) and judged by how it *ends*. A substring test matched "pat" inside
+// "areaPath" / "path" / "patch" and blanked ordinary ADO fields; this keeps `accessToken`,
+// `x-docgen-ingest-token`, `minioSecretKey`, `PAT`, `password` redacted while `areaPath` stays.
+const SENSITIVE_TAILS = ['token', 'password', 'secret', 'authorization', 'accesskey', 'secretkey', 'apikey'];
+const SENSITIVE_LAST_WORDS = new Set(['pat', 'pwd', 'cookie', 'tokens', 'passwords', 'secrets']);
+export function isSensitiveKey(key: string): boolean {
+  const words = key
+    .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+    .replace(/([A-Z]+)([A-Z][a-z])/g, '$1 $2')
+    .toLowerCase()
+    .split(/[^a-z0-9]+/)
+    .filter(Boolean);
+  if (words.length === 0) return false;
+  if (SENSITIVE_LAST_WORDS.has(words[words.length - 1])) return true;
+  const tail = words.slice(-2).join('');
+  return SENSITIVE_TAILS.some((t) => tail.endsWith(t));
+}
 
 // A per-key try/catch on the *read*, not just around the whole loop: a getter that throws
 // (e.g. `{ get boom() { throw ... } }`) would otherwise abort redaction for every remaining
@@ -44,7 +61,7 @@ function safeRead(obj: Record<string, unknown>, key: string): { ok: true; value:
     return { ok: false };
   }
 }
-function redactValue(value: unknown, depth = 0, seen = new WeakSet<object>()): unknown {
+export function redactValue(value: unknown, depth = 0, seen = new WeakSet<object>()): unknown {
   if (depth > 6 || value === null || typeof value !== 'object') return value;
   if (seen.has(value as object)) return '[Circular]';
   seen.add(value as object);
@@ -56,7 +73,7 @@ function redactValue(value: unknown, depth = 0, seen = new WeakSet<object>()): u
       out[key] = '[Unreadable property]';
       continue;
     }
-    out[key] = SENSITIVE_KEY.test(key) ? '[REDACTED]' : redactValue(read.value, depth + 1, seen);
+    out[key] = isSensitiveKey(key) ? '[REDACTED]' : redactValue(read.value, depth + 1, seen);
   }
   return out;
 }
@@ -75,7 +92,7 @@ export const redact = winston.format((info) => {
       ? '[Unreadable property]'
       : // A top-level primitive (e.g. token: "abc") has no children for redactValue to walk into —
         // the key itself has to be checked here too, not just inside the recursive object walk.
-        SENSITIVE_KEY.test(key)
+        isSensitiveKey(key)
         ? '[REDACTED]'
         : redactValue(read.value);
     try {
@@ -116,7 +133,26 @@ function readOwnVersion(): string {
 const safeMessageString = (value: unknown): string =>
   typeof value === 'symbol' ? value.toString() : String(value);
 
-const textFormat = winston.format.printf((info) => `${info.timestamp} - ${info.level}: ${safeMessageString(info.message)}`);
+// A failed ADO request's description (helpers/requestContext.ts), attached to the thrown error
+// and merged onto the record by winston. In text mode — the default, which prints only the
+// message — this is the only way the URL reaches stdout for a record whose own message doesn't
+// carry it. Never throws: this runs inside the formatter, which has no try/catch around it.
+const requestSuffix = (ctx: unknown): string => {
+  try {
+    if (!ctx || typeof ctx !== 'object') return '';
+    const c = ctx as Record<string, unknown>;
+    if (typeof c.url !== 'string') return '';
+    const method = typeof c.method === 'string' ? `${c.method} ` : '';
+    const status = typeof c.status === 'number' ? ` -> ${c.status}` : '';
+    return ` [${method}${c.url}${status}]`;
+  } catch {
+    return '';
+  }
+};
+
+const textFormat = winston.format.printf(
+  (info) => `${info.timestamp} - ${info.level}: ${safeMessageString(info.message)}${requestSuffix(info.adoRequest)}`
+);
 
 // Bounded so one oversized message/stack can't produce an unbounded LogEvent document.
 const MAX_MESSAGE_LEN = 2000;
@@ -126,6 +162,26 @@ function clamp(value: unknown, max: number): string | undefined {
   return value.length > max ? value.slice(0, max) : value;
 }
 
+// Re-validates the request description at the transport instead of trusting its shape — it
+// arrives via an Error's own properties, which anything upstream could have set. Allowlisted
+// keys only, each type-checked and bounded.
+function pickContext(raw: unknown): DiagnosticEvent['context'] {
+  if (!raw || typeof raw !== 'object') return undefined;
+  const c = raw as Record<string, unknown>;
+  const context: NonNullable<DiagnosticEvent['context']> = {};
+  const method = clamp(c.method, CONTEXT_LIMITS.method);
+  const url = clamp(c.url, CONTEXT_LIMITS.url);
+  const requestBody = clamp(c.requestBody, CONTEXT_LIMITS.requestBody);
+  const responseExcerpt = clamp(c.responseExcerpt, CONTEXT_LIMITS.responseExcerpt);
+  if (method) context.method = method;
+  if (url) context.url = url;
+  if (requestBody) context.requestBody = requestBody;
+  if (responseExcerpt) context.responseExcerpt = responseExcerpt;
+  if (typeof c.status === 'number' && Number.isFinite(c.status)) context.status = c.status;
+  if (typeof c.attempt === 'number' && Number.isFinite(c.attempt)) context.attempt = c.attempt;
+  return Object.keys(context).length ? context : undefined;
+}
+
 // Ships warn/error records to whatever LogSink the host process (docgen-content-control's
 // index.ts) has installed — this package never installs one itself, only reads it. This is
 // the dominant source of real ADO error records (tfs.ts's executeWithRetry is the single
@@ -177,11 +233,14 @@ export class DiagnosticsTransport extends Transport {
           message,
           err: hasErr
             ? {
-                message,
+                // The error's own message when the call site supplied it (describeError); else
+                // the combined winston message, which is all a bare logger.error(err) leaves.
+                message: clamp(info.errMessage, MAX_MESSAGE_LEN) ?? message,
                 code: typeof info.code === 'string' ? info.code : undefined,
                 stack: clamp(info.stack, MAX_STACK_LEN),
               }
             : undefined,
+          context: pickContext(info.adoRequest),
           retainPending: !isWarnOrError && captureMode === 'retain-on-failure' ? true : undefined,
         };
         getLogSink()?.push(event);
@@ -208,11 +267,29 @@ const useJson = (process.env.LOG_FORMAT || 'text').toLowerCase() === 'json';
 // for free; info/warn/error volume (Phase 4's focus) is unaffected either way.
 const CONSOLE_LOG_LEVEL = process.env.LOG_LEVEL || 'info';
 
+// Drops a record before the (comparatively expensive) redact/splat/format work when nothing
+// would consume it: stdout wouldn't print it, and DiagnosticsTransport wouldn't persist it
+// (only debug/info under a verbose/retain-on-failure run are captured below warn). The logger's
+// own level gate must stay 'debug' for that capture, so this is the cheap early exit instead.
+const LEVEL_RANK: Record<string, number> = { error: 0, warn: 1, info: 2, http: 3, verbose: 4, debug: 5, silly: 6 };
+export const skipUncaptured = winston.format((info) => {
+  const printRank = LEVEL_RANK[CONSOLE_LOG_LEVEL];
+  const rank = LEVEL_RANK[String(info.level)];
+  if (printRank === undefined || rank === undefined || rank <= printRank) return info;
+  const mode = runContextStore.getStore()?.captureMode;
+  const captured =
+    DIAGNOSTICS_CAPTURE_ENABLED &&
+    (info.level === 'debug' || info.level === 'info') &&
+    (mode === 'verbose' || mode === 'retain-on-failure');
+  return captured ? info : false;
+});
+
 logger = winston.createLogger({
   level: 'debug',
   defaultMeta: { service: '@elisra-devops/docgen-data-provider', version: readOwnVersion() },
   format: useJson
     ? winston.format.combine(
+        skipUncaptured(),
         winston.format.errors({ stack: true }),
         winston.format.timestamp(),
         withRunContext(),
@@ -221,6 +298,7 @@ logger = winston.createLogger({
         winston.format.json()
       )
     : winston.format.combine(
+        skipUncaptured(),
         winston.format.errors({ stack: true }),
         winston.format.timestamp(),
         withRunContext(),