@friggframework/core 2.0.0--canary.654.ebad223.0 → 2.0.0--canary.654.3cd4278.0

package/logs/__fixtures__/secrets.js

@@ -1,22 +1,59 @@
-// Fake values only. They avoid real provider prefixes so push protection stays quiet.
+// Fake values, generated at load time so secret scanners find no literal in
+// the source. A fixed seed per name keeps every run identical.
+const MIXED = 'BCDFGHJKLMNPQRSTVWXZbcdfghjkmnpqrstvwxz23456789';
+const HEX = '0123456789abcdef';
+
+function seededRandom(name) {
+    let seed = [...name].reduce(
+        (h, c) => Math.imul(h ^ c.charCodeAt(0), 16777619),
+        2166136261
+    );
+    return () => {
+        seed = (seed + 0x6d2b79f5) | 0;
+        let t = Math.imul(seed ^ (seed >>> 15), seed | 1);
+        t ^= t + Math.imul(t ^ (t >>> 7), t | 61);
+        return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+    };
+}
+
+function draw(name, alphabet, length) {
+    const next = seededRandom(name);
+    let out = '';
+    for (let i = 0; i < length; i += 1) {
+        out += alphabet[Math.floor(next() * alphabet.length)];
+    }
+    return out;
+}
+
+// The fixed 'Zq' + 'B7k' start puts upper case, lower case and a digit in every token.
+function fakeToken(name, length = 28) {
+    return `ZqB7k${draw(name, MIXED, length - 5)}`;
+}
+
+const base64url = (value) => Buffer.from(value).toString('base64url');
+
 const SECRETS = Object.freeze({
-    bearer: 'ZqvbLv8tZrQ8kNM5Jq4SRrvrMpRC',
-    apiKeyQuery: 'ZqGkGLq6NLF7vXc7cJTWV4BwX3Ld',
-    friggApiKey: 'Zq4kPQhzWCfJXwXxq7KKSMcpt5bk',
-    cookie: 'ZqKBfkjbBx63hpkzVMfQnw8S3wNS',
-    oauthCode: 'ZqMNW4x97kwsvhwk48BnsXD3JCCB',
-    codeVerifier: 'Zq64cfH4zmrmJmxHpNRG6z8QTdDh',
-    password: 'ZqtkDW2Cbh5kH7SnbK4FGQLRxJLT',
-    clientSecret: 'ZqVbQLw3kDGwxHgrBW32MKLHJgtr',
-    accessToken: 'Zqnw6cnh5ZXpQLB5njSxZKQDPhJc',
-    refreshToken: 'ZqhDdt92NR5cvMsvQ6DFmM2qfJFS',
-    idToken: 'ZqCGFMSgJDmq8NKJ6ZG4vSjVd6Gw',
-    hashword: 'ZqvVPT8cjhxtt9cddR2NqrHSzP66',
-    dbPassword: 'ZqZkGTVwpk38sVnHhKZzWFg9djPW',
-    signature: 'Zq7b634PtgG9Ft4BJ9cjrMTZXjNX',
-    jwt: 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJmYWtlLXVzZXItMTIzNDUifQ.ZmFrZVNpZ25hdHVyZUZvclRlc3RzT25seQ',
-    hexToken: '9f2c4e7a1b3d5f8e0a6c2b4d7e9f1a3c5b7d9e2f',
-    base64Run: 'QmFzZTY0RmFrZVNlY3JldFZhbHVlRm9yVGVzdHNPbmx5MTIzNDU2Nzg5MA==',
+    bearer: fakeToken('bearer'),
+    apiKeyQuery: fakeToken('apiKeyQuery'),
+    friggApiKey: fakeToken('friggApiKey'),
+    cookie: fakeToken('cookie'),
+    oauthCode: fakeToken('oauthCode'),
+    codeVerifier: fakeToken('codeVerifier'),
+    password: fakeToken('password'),
+    clientSecret: fakeToken('clientSecret'),
+    accessToken: fakeToken('accessToken'),
+    refreshToken: fakeToken('refreshToken'),
+    idToken: fakeToken('idToken'),
+    hashword: fakeToken('hashword'),
+    dbPassword: fakeToken('dbPassword'),
+    signature: fakeToken('signature'),
+    jwt: [
+        base64url(JSON.stringify({ alg: 'HS256' })),
+        base64url(JSON.stringify({ sub: `fake-${draw('jwtSub', MIXED, 8)}` })),
+        base64url(draw('jwtSig', MIXED, 24)),
+    ].join('.'),
+    hexToken: draw('hexToken', HEX, 40),
+    base64Run: Buffer.from(draw('base64Run', MIXED, 42)).toString('base64'),
 });
 
-module.exports = { SECRETS };
+module.exports = { SECRETS, fakeToken };

package/logs/__fixtures__/vectors.js

@@ -1,14 +1,14 @@
 // ADR-048 §14 redaction vectors. Each vector is one log call that carries
 // secrets; the suite asserts that no 8-char window of them reaches a record.
-const { SECRETS: S } = require('./secrets');
+const { SECRETS: S, fakeToken } = require('./secrets');
 const { httpApiV2Event, restV1Event, sqsEvent } = require('./events');
 const { summarizeLambdaEvent } = require('../summarize-event');
 
 const secretUrl = `https://api.example.com/v1/items?api_key=${S.apiKeyQuery}`;
-const SIGNATURE_VALUE = 'fakeSgnValue2Gh9Tc5Wp7LmQx3';
+const SIGNATURE_VALUE = fakeToken('signatureValue', 27);
 
 // Built by concatenation so push protection does not match the prefixes.
-const TOKEN_TAIL = 'ZqPr3fixTail8Hn2Kd8Ws1Yc6';
+const TOKEN_TAIL = fakeToken('prefixTail', 25);
 const PREFIXED_TOKENS = [
     'sk_' + 'live_' + TOKEN_TAIL,
     'whsec' + '_' + TOKEN_TAIL,

package/logs/redact.js

@@ -237,7 +237,7 @@ function redactUrl(url) {
             )}${redactHash(u.hash)}`;
         }
         if (raw.startsWith('/')) {
-            const u = new URL(raw, 'http://relative.invalid');
+            const u = new URL(raw, 'https://relative.invalid');
             return `${redactPath(raw.match(RAW_RELATIVE_PATH)[0])}${redactParams(
                 u.search,
                 '?'

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@friggframework/core",
     "prettier": "@friggframework/prettier-config",
-    "version": "2.0.0--canary.654.ebad223.0",
+    "version": "2.0.0--canary.654.3cd4278.0",
     "dependencies": {
         "@aws-sdk/client-apigatewaymanagementapi": "^3.588.0",
         "@aws-sdk/client-kms": "^3.588.0",
@@ -47,9 +47,9 @@
         }
     },
     "devDependencies": {
-        "@friggframework/eslint-config": "2.0.0--canary.654.ebad223.0",
-        "@friggframework/prettier-config": "2.0.0--canary.654.ebad223.0",
-        "@friggframework/test": "2.0.0--canary.654.ebad223.0",
+        "@friggframework/eslint-config": "2.0.0--canary.654.3cd4278.0",
+        "@friggframework/prettier-config": "2.0.0--canary.654.3cd4278.0",
+        "@friggframework/test": "2.0.0--canary.654.3cd4278.0",
         "@prisma/client": "^6.19.3",
         "@types/lodash": "4.17.15",
         "@typescript-eslint/eslint-plugin": "^8.0.0",
@@ -89,5 +89,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "ebad2239696f6fbfd7918a327bdbd45c737dc7e0"
+    "gitHead": "3cd42784313ae866c499d7c7549b7c28e39d3045"
 }