@friggframework/core 2.0.0-next.112 → 2.0.0-next.114

package/logs/redact.js

@@ -0,0 +1,328 @@
+const { CONTRACT_KEYS } = require('./contract-keys');
+
+const DENIED_SUFFIXES = [
+    'token',
+    'secret',
+    'password',
+    'apikey',
+    'privatekey',
+    'signature',
+    'authorization',
+    'cookie',
+    'pwd',
+    'passphrase',
+    'credentials',
+    'sessionid',
+];
+
+// Core encryption registry leaves and exact names the suffix rule does not
+// cover. `header` is Node's raw `_header` request text. `domain` is not
+// seeded (too common); a module can still register it as a credential field.
+const deniedKeys = new Set([
+    'hashword',
+    'cookies',
+    'apikeyvalue',
+    'mapping',
+    'auth',
+    'header',
+]);
+
+// Record-contract fields. A credential field with one of these names must not
+// blank the field in every record.
+const PROTECTED_KEYS = new Set(CONTRACT_KEYS.map(normalizeKey));
+
+const DENIED_SUFFIX = new RegExp(`(?:${DENIED_SUFFIXES.join('|')})$`);
+const PAIR_KEYS = new Set(['code', 'codeverifier']);
+const DIGEST_KEY = /(sha(1|256)|hash|digest|checksum)$/;
+
+const MAX_SCRUB_INPUT = 65536;
+
+const URL_IN_TEXT = /\b[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^\s"'<>`]+/g;
+const URL_TRAILING_PUNCT = /[.,;:!?)\]}]+$/;
+const ABSOLUTE_URL = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//;
+const RAW_ABSOLUTE_PATH = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^/?#]*([^?#]*)/;
+const RAW_RELATIVE_PATH = /^[^?#]*/;
+const PATH_TOKEN_SEGMENT = /^[A-Za-z0-9_.~-]{20,}$/;
+const PREFIXED_TOKEN =
+    /(?<![A-Za-z0-9_-])(?:(?:sk|rk)_(?:live|test)_|whsec_|xox[abprs]-|gh[opsu]_|github_pat_|shp(?:at|ss)_|glpat-|npm_)[A-Za-z0-9_-]{16,}|\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g;
+const JWT = /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*/g;
+const AUTH_SCHEME = /\b(Bearer|bearer|BEARER|Basic|basic|BASIC|Token|token|TOKEN)(\s+)([A-Za-z0-9._~+/=-]{8,})/g;
+const AUTH_SCHEME_WORD = /^(bearer|basic|token)$/i;
+const COLON_PAIR = /(?<![A-Za-z0-9_-])([A-Za-z_][A-Za-z0-9_.-]{0,99})(["']?)(\s*:\s*)(["']?)([^\s"',;{}]+)/g;
+const COOKIE_LINE = /(?<![A-Za-z0-9_-])((?:set-)?cookie)(\s*:\s*)([^\r\n]+)/gi;
+const CODE_PAIR = /(?<![A-Za-z0-9_.-])code=/;
+const JSON_PAIR = /"([^"\\]{1,100})"(\s*:\s*)"((?:[^"\\]|\\.)*)"/g;
+const TEXT_PAIR = /(?<![A-Za-z0-9_.-])([A-Za-z0-9_.-]{1,100})=([^\s&"'<>,;)]+)/g;
+const HEX_RUN = /(?<![A-Za-z0-9])[0-9a-fA-F]{40,}(?![A-Za-z0-9])/g;
+const BASE64_RUN = /(?<![A-Za-z0-9+/=_-])[A-Za-z0-9+/_-]{40,}={0,2}(?![A-Za-z0-9+/=_-])/g;
+const FORM_TEXT = /^[A-Za-z0-9_.%[\]-]+=[^&\s]*(?:&[A-Za-z0-9_.%[\]-]+=[^&\s]*)+$/;
+const PATH_SEGMENT = /^[A-Za-z0-9_-]*$/;
+
+function redacted(value) {
+    return `[REDACTED:${value.length}]`;
+}
+
+function normalizeKey(key) {
+    if (typeof key !== 'string') {
+        if (typeof key !== 'number') return '';
+        key = String(key);
+    }
+    return key.toLowerCase().replace(/[-_\s]/g, '');
+}
+
+// The *Normalized variants take a normalizeKey() result, so a walk
+// normalizes each key once.
+function isDeniedNormalized(normalized) {
+    if (!normalized || PROTECTED_KEYS.has(normalized)) return false;
+    return deniedKeys.has(normalized) || DENIED_SUFFIX.test(normalized);
+}
+
+function isDeniedKey(key) {
+    return isDeniedNormalized(normalizeKey(key));
+}
+
+function isDigestNormalized(normalized) {
+    return DIGEST_KEY.test(normalized);
+}
+
+function isDigestKey(key) {
+    return isDigestNormalized(normalizeKey(key));
+}
+
+function isPairKey(key, { withState = false } = {}) {
+    const normalized = normalizeKey(key);
+    return (
+        isDeniedKey(key) ||
+        PAIR_KEYS.has(normalized) ||
+        (withState && normalized === 'state')
+    );
+}
+
+// Returns the leaves it skipped as record-contract keys, so a caller can warn.
+function addDeniedKeys(keys) {
+    const ignored = [];
+    if (!Array.isArray(keys)) return ignored;
+    for (const key of keys) {
+        if (typeof key !== 'string') continue;
+        const rawLeaf = key.split('.').pop();
+        const leaf = normalizeKey(rawLeaf);
+        if (!leaf) continue;
+        if (PROTECTED_KEYS.has(leaf)) ignored.push(rawLeaf);
+        else deniedKeys.add(leaf);
+    }
+    return ignored;
+}
+
+function hasMixedClasses(run) {
+    return /[A-Z]/.test(run) && /[a-z]/.test(run) && /[0-9]/.test(run);
+}
+
+function isPathLike(run) {
+    if (!run.startsWith('/')) return false;
+    const segments = run.split('/');
+    if (segments.length < 3) return false;
+    return segments.every(
+        (segment) => segment.length < 40 && PATH_SEGMENT.test(segment)
+    );
+}
+
+function isRedactedValue(value) {
+    return value === 'REDACTED' || value.startsWith('[REDACTED');
+}
+
+function scrubTokens(text, { allowHex = false } = {}) {
+    let out = text.replace(PREFIXED_TOKEN, redacted);
+    out = out.replace(JWT, redacted);
+    out = out.replace(AUTH_SCHEME, (match, scheme, space, credential) => {
+        const classes = [/[A-Z]/, /[a-z]/, /[0-9]/, /[._~+/=-]/].filter((re) =>
+            re.test(credential)
+        ).length;
+        return classes >= 2 ? `${scheme}${space}${redacted(credential)}` : match;
+    });
+    out = out.replace(JSON_PAIR, (match, key, colon, value) =>
+        isDeniedKey(key) || normalizeKey(key) === 'codeverifier'
+            ? `"${key}"${colon}"${redacted(value)}"`
+            : match
+    );
+    out = out.replace(COOKIE_LINE, (match, key, colon, value) =>
+        isRedactedValue(value) ? match : `${key}${colon}${redacted(value)}`
+    );
+    out = out.replace(COLON_PAIR, (match, key, close, colon, open, value) =>
+        isDeniedKey(key) &&
+        !isRedactedValue(value) &&
+        !AUTH_SCHEME_WORD.test(value)
+            ? `${key}${close}${colon}${open}${redacted(value)}`
+            : match
+    );
+    const withState = CODE_PAIR.test(out);
+    out = out.replace(TEXT_PAIR, (match, key, value) =>
+        isPairKey(key, { withState }) && !isRedactedValue(value)
+            ? `${key}=${redacted(value)}`
+            : match
+    );
+    if (!allowHex) out = out.replace(HEX_RUN, redacted);
+    out = out.replace(BASE64_RUN, (run) =>
+        hasMixedClasses(run) && !isPathLike(run)
+            ? redacted(run)
+            : run
+    );
+    return out;
+}
+
+function queryKeys(search) {
+    return search
+        .replace(/^[?#]/, '')
+        .split('&')
+        .map((pair) => pair.split('=')[0])
+        .filter(Boolean);
+}
+
+function redactParams(search, prefix) {
+    const keys = queryKeys(search);
+    if (keys.length === 0) return '';
+    return `${prefix}${keys.map((key) => `${key}=REDACTED`).join('&')}`;
+}
+
+function redactHash(hash) {
+    if (!hash) return '';
+    if (hash.includes('=')) return redactParams(hash, '#');
+    return scrubTokens(hash);
+}
+
+// A long segment mixing upper case, lower case and digits is an opaque
+// token (webhook secrets live in paths); hex ids and UUIDs lack one class.
+function redactPathSegment(segment) {
+    if (PATH_TOKEN_SEGMENT.test(segment) && hasMixedClasses(segment)) {
+        return redacted(segment);
+    }
+    return scrubTokens(segment);
+}
+
+// The raw path, not URL#pathname, which percent-encodes `{proxy+}`.
+function redactPath(pathname) {
+    return pathname.split('/').map(redactPathSegment).join('/');
+}
+
+function redactUrlFallback(raw) {
+    const out = raw
+        .replace(/(:\/\/)[^/?#@\s]*@/, '$1')
+        .replace(/([?&#][^=&#\s]+)=[^&#\s]*/g, '$1=REDACTED');
+    return scrubTokens(out);
+}
+
+function redactUrl(url) {
+    if (url === undefined || url === null) return '';
+    let raw;
+    try {
+        raw = url instanceof URL ? url.href : String(url);
+    } catch {
+        return '';
+    }
+    try {
+        if (ABSOLUTE_URL.test(raw)) {
+            const u = new URL(raw);
+            const path = raw.match(RAW_ABSOLUTE_PATH)[1];
+            return `${u.protocol}//${u.host}${redactPath(path)}${redactParams(
+                u.search,
+                '?'
+            )}${redactHash(u.hash)}`;
+        }
+        if (raw.startsWith('/')) {
+            const u = new URL(raw, 'https://relative.invalid');
+            return `${redactPath(raw.match(RAW_RELATIVE_PATH)[0])}${redactParams(
+                u.search,
+                '?'
+            )}${redactHash(u.hash)}`;
+        }
+    } catch {
+        return redactUrlFallback(raw);
+    }
+    return redactUrlFallback(raw);
+}
+
+function looksLikeJson(trimmed) {
+    if (trimmed.startsWith('{')) return trimmed.endsWith('}');
+    return /^\[\s*[{["\]\d-]/.test(trimmed) && trimmed.endsWith(']');
+}
+
+function scrubJsonText(text, originalLength) {
+    try {
+        return JSON.stringify(redactValue(JSON.parse(text)));
+    } catch {
+        return `[unparsed:${originalLength}]`;
+    }
+}
+
+function scrubFormText(text) {
+    const pairs = text.split('&').map((pair) => {
+        const index = pair.indexOf('=');
+        return [pair.slice(0, index), pair.slice(index + 1)];
+    });
+    const decodedKeys = pairs.map(([key]) => {
+        try {
+            return decodeURIComponent(key);
+        } catch {
+            return key;
+        }
+    });
+    const dropAll = isOAuthCallbackShape(decodedKeys);
+    return pairs
+        .map(([key, value], i) => {
+            if (dropAll || isPairKey(decodedKeys[i])) {
+                return `${key}=${redacted(value)}`;
+            }
+            return `${key}=${scrubTokens(value)}`;
+        })
+        .join('&');
+}
+
+function scrubText(text, options) {
+    const withUrls = text.replace(URL_IN_TEXT, (match) => {
+        const trailing = match.match(URL_TRAILING_PUNCT)?.[0] ?? '';
+        const core = trailing ? match.slice(0, -trailing.length) : match;
+        return `${redactUrl(core)}${trailing}`;
+    });
+    return scrubTokens(withUrls, options);
+}
+
+function scrubString(str, { allowHex = false } = {}) {
+    if (typeof str !== 'string' || str.length === 0) return str;
+    try {
+        const text =
+            str.length > MAX_SCRUB_INPUT ? str.slice(0, MAX_SCRUB_INPUT) : str;
+        const trimmed = text.trim();
+        if (looksLikeJson(trimmed)) return scrubJsonText(trimmed, str.length);
+        if (FORM_TEXT.test(trimmed)) return scrubFormText(trimmed);
+        return scrubText(text, { allowHex });
+    } catch {
+        return redacted(str);
+    }
+}
+
+function isOAuthCallbackShapeNormalized(normalizedKeys) {
+    const keys = new Set(normalizedKeys);
+    return keys.has('code') && (keys.has('state') || keys.has('codeverifier'));
+}
+
+function isOAuthCallbackShape(keys) {
+    return isOAuthCallbackShapeNormalized(keys.map(normalizeKey));
+}
+
+function redactValue(value) {
+    const { serializeValue } = require('./serialize');
+    return serializeValue(value);
+}
+
+module.exports = {
+    normalizeKey,
+    isDeniedKey,
+    isDeniedNormalized,
+    isDigestKey,
+    isDigestNormalized,
+    isOAuthCallbackShape,
+    isOAuthCallbackShapeNormalized,
+    addDeniedKeys,
+    redactUrl,
+    scrubString,
+    redactValue,
+};

package/logs/serialize.js

@@ -0,0 +1,329 @@
+const {
+    isDeniedNormalized,
+    isDigestNormalized,
+    isOAuthCallbackShapeNormalized,
+    normalizeKey,
+    redactUrl,
+    scrubString,
+} = require('./redact');
+
+const MAX_DEPTH = 6;
+const MAX_CAUSE_DEPTH = 3;
+const MAX_STRING = 2048;
+const MAX_AGGREGATE_ERRORS = 10;
+const HEADER_KEYS = new Set(['headers', 'multivalueheaders', 'rawheaders']);
+
+function attempt(fn, fallback) {
+    try {
+        return fn();
+    } catch {
+        return fallback;
+    }
+}
+
+function cutString(value) {
+    if (value.length <= MAX_STRING) return value;
+    const suffix = `…[truncated:${value.length}]`;
+    return value.slice(0, MAX_STRING - suffix.length) + suffix;
+}
+
+function cleanString(value, normalizedKey = '') {
+    return cutString(
+        scrubString(value, { allowHex: isDigestNormalized(normalizedKey) })
+    );
+}
+
+function isError(value) {
+    return attempt(
+        () =>
+            value instanceof Error ||
+            Object.prototype.toString.call(value) === '[object Error]',
+        false
+    );
+}
+
+function isHeadersLike(value) {
+    if (typeof Headers !== 'undefined' && value instanceof Headers) return true;
+    return (
+        !(value instanceof Map) &&
+        typeof value.get === 'function' &&
+        typeof value.has === 'function' &&
+        typeof value.forEach === 'function' &&
+        typeof value.entries === 'function'
+    );
+}
+
+function headerNames(value) {
+    if (value === null || value === undefined) return value;
+    if (typeof value !== 'object') return '[REDACTED]';
+    if (value instanceof Map) return [...value.keys()].map(String);
+    if (Array.isArray(value)) {
+        if (value.every((entry) => typeof entry === 'string')) {
+            return value.filter((_entry, i) => i % 2 === 0);
+        }
+        return value.every(Array.isArray)
+            ? value.map((entry) => cleanString(String(entry[0])))
+            : '[REDACTED]';
+    }
+    if (isHeadersLike(value)) {
+        const names = [];
+        value.forEach((_v, name) => names.push(String(name)));
+        return names;
+    }
+    return Object.keys(value);
+}
+
+function walkObject(value, depth, seen) {
+    const keys = Object.keys(value);
+    const normalizedKeys = keys.map(normalizeKey);
+    const dropAll = isOAuthCallbackShapeNormalized(normalizedKeys);
+    const out = {};
+    for (let i = 0; i < keys.length; i += 1) {
+        const key = keys[i];
+        const normalized = normalizedKeys[i];
+        if (dropAll || isDeniedNormalized(normalized)) {
+            out[key] = '[REDACTED]';
+            continue;
+        }
+        let child;
+        try {
+            child = value[key];
+        } catch {
+            out[key] = '[Getter threw]';
+            continue;
+        }
+        if (HEADER_KEYS.has(normalized)) {
+            out[key] = attempt(() => headerNames(child), '[Unserializable]');
+            continue;
+        }
+        const result = walk(child, depth + 1, seen, normalized);
+        if (result !== undefined) out[key] = result;
+    }
+    return out;
+}
+
+function walkContainer(value, depth, seen) {
+    if (value instanceof Map) {
+        const out = {};
+        for (const [k, v] of value) {
+            const key = String(k);
+            const normalized = normalizeKey(key);
+            if (isDeniedNormalized(normalized)) {
+                out[key] = '[REDACTED]';
+                continue;
+            }
+            const result = walk(v, depth + 1, seen, normalized);
+            if (result !== undefined) out[key] = result;
+        }
+        return out;
+    }
+    if (value instanceof Set) {
+        return [...value].map((v) => walk(v, depth + 1, seen) ?? null);
+    }
+    if (Array.isArray(value)) {
+        return value.map((v) => walk(v, depth + 1, seen) ?? null);
+    }
+    if (isHeadersLike(value)) return headerNames(value);
+    return walkObject(value, depth, seen);
+}
+
+function walkSpecial(value) {
+    if (value instanceof Date) {
+        return Number.isNaN(value.getTime())
+            ? 'Invalid Date'
+            : value.toISOString();
+    }
+    if (value instanceof URL) return redactUrl(value);
+    if (value instanceof URLSearchParams) {
+        return [...value.keys()].map((k) => `${k}=REDACTED`).join('&');
+    }
+    if (Buffer.isBuffer(value)) return { type: 'Buffer', length: value.length };
+    if (ArrayBuffer.isView(value)) {
+        return {
+            type: value.constructor?.name ?? 'TypedArray',
+            length: value.byteLength,
+        };
+    }
+    if (value instanceof ArrayBuffer) {
+        return { type: 'ArrayBuffer', length: value.byteLength };
+    }
+    if (value instanceof RegExp) return cleanString(String(value));
+    if (
+        (value._bsontype === 'ObjectId' || value._bsontype === 'ObjectID') &&
+        typeof value.toHexString === 'function'
+    ) {
+        return value.toHexString();
+    }
+    return undefined;
+}
+
+function walk(value, depth, seen, normalizedKey) {
+    switch (typeof value) {
+        case 'string':
+            return cleanString(value, normalizedKey);
+        case 'number':
+            return Number.isFinite(value) ? value : String(value);
+        case 'boolean':
+            return value;
+        case 'bigint':
+            return value.toString();
+        case 'undefined':
+        case 'symbol':
+        case 'function':
+            return undefined;
+        default:
+            break;
+    }
+    if (value === null) return null;
+    if (isError(value)) return serializeErrorAt(value, 0, new WeakSet());
+    if (seen.has(value)) return '[Circular]';
+    if (depth >= MAX_DEPTH) return '[Depth]';
+    try {
+        const special = walkSpecial(value);
+        if (special !== undefined) return special;
+        seen.add(value);
+        try {
+            return walkContainer(value, depth, seen);
+        } finally {
+            seen.delete(value);
+        }
+    } catch {
+        return '[Unserializable]';
+    }
+}
+
+function serializeValue(value, { depth = 0 } = {}) {
+    try {
+        return walk(value, depth, new WeakSet());
+    } catch {
+        return '[Unserializable]';
+    }
+}
+
+function errorType(err) {
+    const ctorName = attempt(() => err.constructor?.name, undefined);
+    const name = attempt(() => err.name, undefined);
+    if (typeof ctorName === 'string' && ctorName && ctorName !== 'Error') {
+        return ctorName;
+    }
+    if (typeof name === 'string' && name) return name;
+    return ctorName || 'Error';
+}
+
+function lastParagraph(message) {
+    const paragraphs = message
+        .split(/\n\s*\n/)
+        .map((p) => p.trim())
+        .filter(Boolean);
+    return paragraphs[paragraphs.length - 1] ?? '';
+}
+
+function errorStatus(err) {
+    const status = attempt(
+        () => err.statusCode ?? err.status ?? err.response?.status,
+        undefined
+    );
+    if (typeof status === 'number' && Number.isFinite(status)) return status;
+    if (typeof status === 'string' && status) return cleanString(status);
+    return undefined;
+}
+
+function errorCode(err) {
+    const code = attempt(() => err.code, undefined);
+    if (typeof code === 'number' && Number.isFinite(code)) return code;
+    if (typeof code === 'string' && code) return cleanString(code);
+    return undefined;
+}
+
+function errorStack(err, type, message) {
+    const stack = attempt(() => err.stack, undefined);
+    if (typeof stack !== 'string') return undefined;
+    const frames = stack.split('\n').filter((line) => /^\s*at\s/.test(line));
+    return cutString(
+        [`${type}: ${message}`, ...frames.map((f) => scrubString(f))].join('\n')
+    );
+}
+
+function nested(value, depth, seen) {
+    if (depth > MAX_CAUSE_DEPTH) return '[Depth]';
+    if (value !== null && typeof value === 'object' && seen.has(value)) {
+        return '[Circular]';
+    }
+    return serializeErrorAt(value, depth, seen);
+}
+
+function nonErrorMessage(value) {
+    if (value === null || typeof value !== 'object') {
+        return cleanString(attempt(() => String(value), '[Unserializable]'));
+    }
+    const message = attempt(() => value.message, undefined);
+    if (typeof message === 'string') return cleanString(message);
+    return cutString(
+        attempt(() => JSON.stringify(serializeValue(value)), '[Unserializable]')
+    );
+}
+
+function serializeErrorAt(err, depth, seen) {
+    if (!isError(err)) {
+        return { type: 'NonError', message: nonErrorMessage(err) };
+    }
+    seen.add(err);
+    const type = cutString(scrubString(errorType(err)));
+    const rawMessage = attempt(() => err.message, '');
+    let message = typeof rawMessage === 'string' ? rawMessage : String(rawMessage);
+    if (type.startsWith('PrismaClient')) message = lastParagraph(message);
+    message = cleanString(message);
+
+    const out = { type, message };
+    const code = errorCode(err);
+    if (code !== undefined) out.code = code;
+    const status = errorStatus(err);
+    if (status !== undefined) out.status = status;
+    const stack = errorStack(err, type, message);
+    if (stack !== undefined) out.stack = stack;
+
+    const cause = attempt(() => err.cause, undefined);
+    if (cause !== undefined && cause !== null) {
+        out.cause = nested(cause, depth + 1, seen);
+    }
+
+    const errors = attempt(() => err.errors, undefined);
+    if (type === 'AggregateError' && Array.isArray(errors)) {
+        out.errors = errors
+            .slice(0, MAX_AGGREGATE_ERRORS)
+            .map((e) => nested(e, depth + 1, seen));
+    }
+    return out;
+}
+
+function serializeError(err) {
+    try {
+        return serializeErrorAt(err, 0, new WeakSet());
+    } catch {
+        return { type: 'Error', message: '[Unserializable]' };
+    }
+}
+
+function toSanitizedSurrogate(err) {
+    const serialized = serializeError(err);
+    const surrogate = new Error(serialized.message);
+    surrogate.name =
+        serialized.type === 'NonError' ? 'Error' : serialized.type;
+    surrogate.stack =
+        serialized.stack ?? `${surrogate.name}: ${serialized.message}`;
+    if (serialized.code !== undefined) surrogate.code = serialized.code;
+    if (serialized.status !== undefined) {
+        surrogate.statusCode = serialized.status;
+    }
+    return surrogate;
+}
+
+module.exports = {
+    isError,
+    serializeValue,
+    serializeError,
+    toSanitizedSurrogate,
+    MAX_DEPTH,
+    MAX_CAUSE_DEPTH,
+    MAX_STRING,
+};