@foam-ai/node 0.1.0-alpha.5 → 0.1.0-alpha.6

package/dist/redaction-keys.js

@@ -0,0 +1,421 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SENSITIVE_QUERY_KEYS = exports.SENSITIVE_HTTP_HEADERS = exports.SENSITIVE_KEYS = void 0;
+const PASSWORD_KEYS = [
+    "admin_password",
+    "basic_auth_password",
+    "confirm_password",
+    "connection_password",
+    "current_password",
+    "database_password",
+    "db_pass",
+    "db_password",
+    "ftp_password",
+    "http_password",
+    "keystore_password",
+    "master_password",
+    "mail_password",
+    "mysql_pwd",
+    "new_password",
+    "old_password",
+    "pass",
+    "passcode",
+    "passphrase",
+    "passwd",
+    "password",
+    "password_confirmation",
+    "postgres_password",
+    "pwd",
+    "redis_password",
+    "root_password",
+    "smtp_password",
+    "user_password",
+];
+const TOKEN_KEYS = [
+    "access_token_secret",
+    "activation_token",
+    "access_token",
+    "api_token",
+    "assertion",
+    "auth",
+    "auth_token",
+    "authentication_token",
+    "authorization",
+    "authorization_code",
+    "bearer",
+    "bearer_token",
+    "bot_token",
+    "ci_job_token",
+    "client_assertion",
+    "client_secret",
+    "credential",
+    "credentials",
+    "deploy_token",
+    "email_verification_token",
+    "id_token",
+    "identity_token",
+    "invite_token",
+    "jwt",
+    "jwt_token",
+    "magic_link_token",
+    "oauth_token",
+    "oauth2_token",
+    "oauth_token_secret",
+    "password_reset_token",
+    "personal_access_token",
+    "registration_token",
+    "request_token",
+    "refresh_token",
+    "reset_token",
+    "saml_assertion",
+    "saml_response",
+    "secret_token",
+    "security_token",
+    "service_token",
+    "sso_token",
+    "token",
+    "unsubscribe_token",
+    "verification_token",
+];
+const KEY_MATERIAL_KEYS = [
+    "access_key",
+    "access_key_id",
+    "api_key",
+    "api_secret",
+    "amqp_url",
+    "apikey",
+    "app_key",
+    "app_secret",
+    "application_key",
+    "application_secret",
+    "aws_access_key_id",
+    "aws_secret_access_key",
+    "consumer_key",
+    "consumer_secret",
+    "broker_url",
+    "connection_string",
+    "connection_uri",
+    "credential_blob",
+    "decryption_key",
+    "database_url",
+    "database_connection_string",
+    "db_url",
+    "dsn",
+    "encryption_key",
+    "gcp_service_account_key",
+    "google_application_credentials",
+    "key",
+    "key_password",
+    "key_store_password",
+    "keystore",
+    "license_key",
+    "mnemonic",
+    "mongodb_uri",
+    "kube_config",
+    "kubeconfig",
+    "pem",
+    "private_key",
+    "privatekey",
+    "proxy_authorization",
+    "redis_url",
+    "redis_uri",
+    "rabbitmq_url",
+    "secret",
+    "secret_access_key",
+    "secret_key",
+    "seed_phrase",
+    "service_account_json",
+    "service_account_key",
+    "shared_secret",
+    "signature",
+    "signing_key",
+    "signing_secret",
+    "ssh_private_key",
+    "smtp_url",
+    "tls_private_key",
+    "wallet_private_key",
+    "wallet_seed",
+    "webhook_secret",
+    "www_authenticate",
+];
+const SESSION_KEYS = [
+    "_csrf",
+    "_csrf_token",
+    "_session",
+    "_xsrf",
+    "aiohttp_session",
+    "anti_forgery_token",
+    "backup_code",
+    "backup_codes",
+    "connect.sid",
+    "cookie",
+    "csrf",
+    "csrf_token",
+    "csrftoken",
+    "django_session",
+    "hotp",
+    "laravel_session",
+    "mfa",
+    "mfa_code",
+    "otp",
+    "phpsessid",
+    "pin",
+    "recovery_code",
+    "recovery_codes",
+    "remember_token",
+    "session",
+    "session_id",
+    "session_key",
+    "session_token",
+    "sessionid",
+    "set_cookie",
+    "setcookie",
+    "sid",
+    "symfony",
+    "totp",
+    "user_session",
+    "x_csrf_token",
+    "x_csrftoken",
+    "x_xsrf_token",
+    "xsrf",
+    "xsrf_token",
+];
+const PERSONAL_AND_FINANCIAL_KEYS = [
+    "account_number",
+    "bank_account",
+    "card",
+    "card_number",
+    "credit_card",
+    "credit_card_number",
+    "cvc",
+    "cvv",
+    "date_of_birth",
+    "dob",
+    "driver_license",
+    "drivers_license",
+    "iban",
+    "ip_address",
+    "national_id",
+    "passport_number",
+    "remote_addr",
+    "routing_number",
+    "sort_code",
+    "ssn",
+    "tax_id",
+    "x_forwarded_for",
+    "x_real_ip",
+];
+const PROVIDER_KEYS = [
+    "algolia_admin_api_key",
+    "anthropic_api_key",
+    "artifactory_api_key",
+    "airtable_api_key",
+    "azure_api_key",
+    "buildkite_agent_token",
+    "circle_token",
+    "cohere_api_key",
+    "cloudflare_api_token",
+    "consul_http_token",
+    "datadog_api_key",
+    "datadog_app_key",
+    "discord_bot_token",
+    "docker_password",
+    "docker_config_json",
+    "digitalocean_token",
+    "firebase_service_account",
+    "gemini_api_key",
+    "github_token",
+    "gitlab_token",
+    "google_api_key",
+    "groq_api_key",
+    "honeycomb_api_key",
+    "huggingface_token",
+    "heroku_api_key",
+    "jfrog_access_token",
+    "linear_api_key",
+    "mapbox_access_token",
+    "new_relic_license_key",
+    "nomad_token",
+    "notion_token",
+    "npm_token",
+    "openai_api_key",
+    "pagerduty_routing_key",
+    "pypi_token",
+    "sentry_auth_token",
+    "sentry_dsn",
+    "sendgrid_api_key",
+    "shopify_access_token",
+    "shopify_api_secret",
+    "slack_app_token",
+    "slack_bot_token",
+    "slack_signing_secret",
+    "stripe_secret_key",
+    "stripe_webhook_secret",
+    "supabase_service_role_key",
+    "telegram_bot_token",
+    "terraform_cloud_token",
+    "twilio_auth_token",
+    "vault_token",
+    "vercel_oidc_token",
+    "x_api_key",
+    "x_auth_token",
+];
+exports.SENSITIVE_KEYS = [
+    ...PASSWORD_KEYS,
+    ...TOKEN_KEYS,
+    ...KEY_MATERIAL_KEYS,
+    ...SESSION_KEYS,
+    ...PERSONAL_AND_FINANCIAL_KEYS,
+    ...PROVIDER_KEYS,
+];
+exports.SENSITIVE_HTTP_HEADERS = [
+    "authentication_info",
+    "authorization",
+    "cf_access_authenticated_user_email",
+    "cf_access_jwt_assertion",
+    "cookie",
+    "grpcgateway_authorization",
+    "impersonate_group",
+    "impersonate_user",
+    "jenkins_crumb",
+    "job_token",
+    "ocp_apim_subscription_key",
+    "private_token",
+    "proxy_authenticate",
+    "proxy_authentication_info",
+    "proxy_authorization",
+    "set_cookie",
+    "stripe_signature",
+    "www_authenticate",
+    "x_access_token",
+    "x_algolia_api_key",
+    "x_amz_credential",
+    "x_amz_security_token",
+    "x_amz_signature",
+    "x_amzn_oidc_accesstoken",
+    "x_amzn_oidc_data",
+    "x_amzn_oidc_identity",
+    "x_api_key",
+    "x_asana_request_token",
+    "x_aws_ec2_metadata_token",
+    "x_auth_request_access_token",
+    "x_auth_request_email",
+    "x_auth_request_groups",
+    "x_auth_request_preferred_username",
+    "x_auth_request_user",
+    "x_auth_token",
+    "x_box_signature_primary",
+    "x_box_signature_secondary",
+    "x_cf_access_jwt_assertion",
+    "x_csrf_token",
+    "x_circle_token",
+    "x_consul_token",
+    "x_credential_identifier",
+    "x_datadog_api_key",
+    "x_discord_signature_ed25519",
+    "x_docusign_signature_1",
+    "x_dropbox_signature",
+    "x_elastic_client_authentication",
+    "x_firebase_appcheck",
+    "x_forwarded_access_token",
+    "x_forwarded_email",
+    "x_forwarded_for",
+    "x_forwarded_user",
+    "x_functions_key",
+    "x_github_token",
+    "x_gitlab_token",
+    "x_goog_api_key",
+    "x_goog_firebase_installations_auth",
+    "x_goog_iap_jwt_assertion",
+    "x_hub_signature",
+    "x_hub_signature_256",
+    "x_honeycomb_api_key",
+    "x_honeycomb_team",
+    "x_intercom_hmac",
+    "x_jwt_assertion",
+    "x_linear_signature",
+    "x_mailgun_signature",
+    "x_master_key",
+    "x_meili_api_key",
+    "x_ms_client_principal",
+    "x_ms_token_aad_access_token",
+    "x_ms_token_aad_id_token",
+    "x_ms_token_aad_refresh_token",
+    "x_nf_client_connection_ip",
+    "x_nomad_token",
+    "x_npm_token",
+    "x_original_authorization",
+    "x_real_ip",
+    "x_remote_email",
+    "x_remote_groups",
+    "x_remote_user",
+    "x_pagerduty_signature",
+    "x_parse_rest_api_key",
+    "x_sendgrid_event_webhook_signature",
+    "x_session_token",
+    "x_shopify_hmac_sha256",
+    "x_signature",
+    "x_signature_ed25519",
+    "x_slack_signature",
+    "x_sonarqube_passcode",
+    "x_squarespace_hmacsha256_signature",
+    "x_twilio_signature",
+    "x_typesense_api_key",
+    "x_userinfo",
+    "x_vault_token",
+    "x_vercel_oidc_token",
+    "x_webhook_signature",
+    "x_webhook_secret",
+    "x_wix_webhook_signature",
+    "x_xsrf_token",
+    "x_zendesk_webhook_signature",
+];
+exports.SENSITIVE_QUERY_KEYS = [
+    "access_token",
+    "api_key",
+    "api_secret",
+    "api_token",
+    "apikey",
+    "assertion",
+    "auth",
+    "auth_token",
+    "authorization",
+    "authorization_code",
+    "bearer_token",
+    "client_assertion",
+    "client_secret",
+    "code",
+    "code_verifier",
+    "credential",
+    "hmac",
+    "id_token",
+    "invite_token",
+    "jwt",
+    "key",
+    "magic_link_token",
+    "oauth_token_secret",
+    "otp",
+    "password_reset_token",
+    "password",
+    "policy",
+    "pin",
+    "refresh_token",
+    "reset_token",
+    "saml_response",
+    "secret",
+    "secret_key",
+    "session",
+    "session_id",
+    "session_token",
+    "sig",
+    "signature",
+    "token",
+    "token_secret",
+    "unsubscribe_token",
+    "verification_token",
+    "x_amz_credential",
+    "x_amz_security_token",
+    "x_amz_signature",
+    "x_goog_credential",
+    "x_goog_signature",
+];

package/dist/redaction.d.ts

@@ -0,0 +1,24 @@
+export interface RedactOptions {
+    readonly secrets?: readonly string[];
+    readonly pii?: readonly string[];
+}
+export interface RedactionConfig {
+    readonly secretKeys: ReadonlySet<string>;
+    readonly piiKeys: ReadonlySet<string>;
+}
+export type KeyMatchKind = "floor" | "pii" | "secret";
+export declare function setActiveRedactionConfig(config: RedactionConfig): void;
+export declare function getActiveRedactionConfig(): RedactionConfig;
+export declare function normalizeKey(key: string): string;
+export declare function isFloorKey(key: string): boolean;
+export declare function isSensitiveQueryKey(key: string): boolean;
+export declare function keyMatch(key: string, config?: RedactionConfig): KeyMatchKind | undefined;
+export declare function tailMask(value: unknown): string;
+export declare function maskForMatch(kind: KeyMatchKind, value: unknown): string;
+export declare function redactQueryPairs(query: string, config?: RedactionConfig): string;
+export declare function redactUrlLike(text: string, config?: RedactionConfig): string;
+export declare function redactString(text: string, config?: RedactionConfig): string;
+export declare function redactDeep(value: unknown, config?: RedactionConfig): unknown;
+export declare function redactAttributeValue(key: string, value: unknown, config?: RedactionConfig): unknown;
+export declare function redactAttributesCopy(attributes: Readonly<Record<string, unknown>>, config?: RedactionConfig): Record<string, unknown>;
+export declare function resolveRedactionConfig(redact: unknown): RedactionConfig;

package/dist/redaction.js

@@ -0,0 +1,270 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setActiveRedactionConfig = setActiveRedactionConfig;
+exports.getActiveRedactionConfig = getActiveRedactionConfig;
+exports.normalizeKey = normalizeKey;
+exports.isFloorKey = isFloorKey;
+exports.isSensitiveQueryKey = isSensitiveQueryKey;
+exports.keyMatch = keyMatch;
+exports.tailMask = tailMask;
+exports.maskForMatch = maskForMatch;
+exports.redactQueryPairs = redactQueryPairs;
+exports.redactUrlLike = redactUrlLike;
+exports.redactString = redactString;
+exports.redactDeep = redactDeep;
+exports.redactAttributeValue = redactAttributeValue;
+exports.redactAttributesCopy = redactAttributesCopy;
+exports.resolveRedactionConfig = resolveRedactionConfig;
+const constants_js_1 = require("./constants.js");
+const redaction_keys_js_1 = require("./redaction-keys.js");
+const EMPTY_CONFIG = {
+    secretKeys: new Set(),
+    piiKeys: new Set(),
+};
+const FLOOR_KEYS = new Set(redaction_keys_js_1.SENSITIVE_KEYS);
+const HTTP_HEADERS = new Set(redaction_keys_js_1.SENSITIVE_HTTP_HEADERS);
+const QUERY_KEYS = new Set(redaction_keys_js_1.SENSITIVE_QUERY_KEYS);
+const HEADER_PREFIXES = ["http.request.header.", "http.response.header."];
+const BARE_QUERY_KEYS = new Set(["url.query"]);
+const BODY_KEYS = new Set([
+    "http.request.body.content",
+    "http.response.body.content",
+]);
+const MAX_DEPTH = 10;
+const QUERY_PAIR_CAP = 256;
+let activeConfig = EMPTY_CONFIG;
+function setActiveRedactionConfig(config) {
+    activeConfig = config;
+}
+function getActiveRedactionConfig() {
+    return activeConfig;
+}
+function normalizeKey(key) {
+    return key
+        .trim()
+        .replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2")
+        .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+        .replace(/-/g, "_")
+        .toLowerCase();
+}
+function isFloorKey(key) {
+    return FLOOR_KEYS.has(normalizeKey(key));
+}
+function isSensitiveHeader(key) {
+    return HTTP_HEADERS.has(normalizeKey(key));
+}
+function isSensitiveQueryKey(key) {
+    const normalized = normalizeKey(key);
+    return FLOOR_KEYS.has(normalized) || QUERY_KEYS.has(normalized);
+}
+function keyMatch(key, config = activeConfig) {
+    const normalized = normalizeKey(key);
+    if (FLOOR_KEYS.has(normalized))
+        return "floor";
+    if (config.piiKeys.has(normalized))
+        return "pii";
+    if (config.secretKeys.has(normalized))
+        return "secret";
+    return undefined;
+}
+function tailMask(value) {
+    if (value === constants_js_1.REDACTED_VALUE)
+        return constants_js_1.REDACTED_VALUE;
+    if (typeof value === "string" || typeof value === "number") {
+        const text = String(value);
+        if (text.length >= constants_js_1.TAIL_MASK_THRESHOLD)
+            return constants_js_1.FULL_MASK + text.slice(-4);
+    }
+    return constants_js_1.FULL_MASK;
+}
+function maskForMatch(kind, value) {
+    return kind === "secret" ? tailMask(value) : constants_js_1.REDACTED_VALUE;
+}
+function decodeKey(value) {
+    try {
+        return decodeURIComponent(value.replace(/\+/g, " "));
+    }
+    catch {
+        return value;
+    }
+}
+function redactPair(pair, config) {
+    const separator = pair.indexOf("=");
+    if (separator < 0)
+        return pair;
+    const key = decodeKey(pair.slice(0, separator));
+    if (keyMatch(key, config) || isSensitiveQueryKey(key)) {
+        return `${pair.slice(0, separator)}=${constants_js_1.REDACTED_VALUE}`;
+    }
+    return pair;
+}
+function redactQueryPairs(query, config = activeConfig) {
+    const result = [];
+    let start = 0;
+    let count = 0;
+    while (start <= query.length) {
+        if (count >= QUERY_PAIR_CAP) {
+            result.push(constants_js_1.REDACTED_VALUE);
+            break;
+        }
+        const next = query.indexOf("&", start);
+        result.push(redactPair(next < 0 ? query.slice(start) : query.slice(start, next), config));
+        count += 1;
+        if (next < 0)
+            break;
+        start = next + 1;
+    }
+    return result.join("&");
+}
+function redactSegment(segment, config) {
+    return segment.includes("=") ? redactQueryPairs(segment, config) : segment;
+}
+function redactUrlLike(text, config = activeConfig) {
+    const hash = text.indexOf("#");
+    const head = hash < 0 ? text : text.slice(0, hash);
+    const fragment = hash < 0 ? undefined : text.slice(hash + 1);
+    const query = head.indexOf("?");
+    const redactedHead = query < 0
+        ? redactSegment(head, config)
+        : `${head.slice(0, query + 1)}${redactQueryPairs(head.slice(query + 1), config)}`;
+    if (fragment === undefined)
+        return redactedHead;
+    const fragmentQuery = fragment.indexOf("?");
+    const redactedFragment = fragmentQuery < 0
+        ? redactSegment(fragment, config)
+        : `${redactSegment(fragment.slice(0, fragmentQuery), config)}?${redactQueryPairs(fragment.slice(fragmentQuery + 1), config)}`;
+    return `${redactedHead}#${redactedFragment}`;
+}
+function redactString(text, config = activeConfig) {
+    return text.includes("=") ? redactUrlLike(text, config) : text;
+}
+function redactNode(value, config, depth, ancestors) {
+    if (depth > MAX_DEPTH)
+        return constants_js_1.FULL_MASK;
+    if (typeof value === "string")
+        return redactString(value, config);
+    if (value === null ||
+        value === undefined ||
+        typeof value === "number" ||
+        typeof value === "boolean") {
+        return value;
+    }
+    if (typeof value !== "object")
+        return constants_js_1.FULL_MASK;
+    if (ArrayBuffer.isView(value) || value instanceof ArrayBuffer)
+        return value;
+    if (ancestors.has(value))
+        return constants_js_1.FULL_MASK;
+    ancestors.add(value);
+    try {
+        if (Array.isArray(value)) {
+            return value.map((item) => redactNode(item, config, depth + 1, ancestors));
+        }
+        const result = {};
+        for (const [key, item] of Object.entries(value)) {
+            const match = keyMatch(key, config);
+            result[key] = match
+                ? maskForMatch(match, item)
+                : redactNode(item, config, depth + 1, ancestors);
+        }
+        return result;
+    }
+    finally {
+        ancestors.delete(value);
+    }
+}
+function redactDeep(value, config = activeConfig) {
+    try {
+        return redactNode(value, config, 0, new Set());
+    }
+    catch {
+        return constants_js_1.FULL_MASK;
+    }
+}
+function headerSuffix(key) {
+    const lower = key.toLowerCase();
+    for (const prefix of HEADER_PREFIXES) {
+        if (lower.startsWith(prefix) && key.length > prefix.length) {
+            return key.slice(prefix.length);
+        }
+    }
+    return undefined;
+}
+function maskElements(kind, value) {
+    return Array.isArray(value)
+        ? value.map((item) => maskForMatch(kind, item))
+        : maskForMatch(kind, value);
+}
+function redactAttributeValue(key, value, config = activeConfig) {
+    try {
+        const match = keyMatch(key, config);
+        if (match)
+            return maskElements(match, value);
+        const header = headerSuffix(key);
+        if (header) {
+            const headerMatch = keyMatch(header, config);
+            if (headerMatch)
+                return maskElements(headerMatch, value);
+            if (isSensitiveHeader(header))
+                return maskElements("floor", value);
+        }
+        if (BARE_QUERY_KEYS.has(key.toLowerCase()) && typeof value === "string") {
+            return redactQueryPairs(value, config);
+        }
+        if (BODY_KEYS.has(key))
+            return value;
+        if (typeof value === "string")
+            return redactString(value, config);
+        if (Array.isArray(value) ||
+            (value !== null && typeof value === "object" && !ArrayBuffer.isView(value))) {
+            return redactDeep(value, config);
+        }
+        if (value === null ||
+            value === undefined ||
+            typeof value === "number" ||
+            typeof value === "boolean" ||
+            ArrayBuffer.isView(value)) {
+            return value;
+        }
+        return constants_js_1.FULL_MASK;
+    }
+    catch {
+        return constants_js_1.FULL_MASK;
+    }
+}
+function redactAttributesCopy(attributes, config = activeConfig) {
+    const result = {};
+    for (const [key, value] of Object.entries(attributes)) {
+        result[key] = redactAttributeValue(key, value, config);
+    }
+    return result;
+}
+const REDACT_FIELDS = ["secrets", "pii"];
+function keyList(field, value) {
+    if (value === undefined || value === null)
+        return [];
+    if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
+        throw new TypeError(`[foam] redact.${field} must be an array of strings`);
+    }
+    return value;
+}
+function resolveRedactionConfig(redact) {
+    if (redact === undefined || redact === null)
+        return EMPTY_CONFIG;
+    if (typeof redact !== "object" || Array.isArray(redact)) {
+        throw new TypeError("[foam] redact must be an object");
+    }
+    const record = redact;
+    const unknown = Object.keys(record).filter((field) => !REDACT_FIELDS.includes(field));
+    if (unknown.length) {
+        throw new TypeError(`[foam] redact contains unknown fields: ${unknown.join(", ")}`);
+    }
+    return {
+        secretKeys: new Set(keyList("secrets", record.secrets)
+            .map(normalizeKey)
+            .filter(Boolean)),
+        piiKeys: new Set(keyList("pii", record.pii)
+            .map(normalizeKey)
+            .filter(Boolean)),
+    };
+}