@futdevpro/nts-dynamo 1.15.99 → 1.15.100

package/src/_collections/client-safe-error.util.spec.ts

@@ -0,0 +1,95 @@
+import { DyFM_EnvironmentFlag, DyFM_Error } from '@futdevpro/fsm-dynamo';
+
+import { DyNTS_ClientSafeError_Util } from './client-safe-error.util';
+import { DyNTS_global_settings } from './global-settings.const';
+
+// A kliens-safe error-strip SSOT tesztjei (BFR-FDPAUTHSERVICE-002) — a 3 strip-szabály +
+// a nem-DyFM fail-safe ág. A DyFM_Error mező-neveit a valós instansán verifikáljuk (no-guessing).
+describe('| DyNTS_ClientSafeError_Util', (): void => {
+
+  /** Egy teljes-mezős DyFM_Error a strip-tesztekhez (a leak-vektor mezőkkel feltöltve). */
+  function buildRichError(): DyFM_Error {
+    const error: DyFM_Error = new DyFM_Error({
+      message: 'internal reason',
+      userMessage: 'user facing message',
+      errorCode: 'DyNTS-TEST-CSE0',
+      error: new Error('inner cause'),
+      additionalContent: { userId: 'u1' },
+      confidentialContent: { secret: 's3cr3t' },
+    });
+
+    return error;
+  }
+
+  afterEach((): void => {
+    // a prod-teszt env-átállítását visszaállítjuk (a global-settings megosztott singleton)
+    DyNTS_global_settings.env_settings.environment = DyFM_EnvironmentFlag.local;
+  });
+
+  it('| MINDIG strip-eli a leak-vektor mezőket (nem-prod env-ben is)', (): void => {
+    DyNTS_global_settings.env_settings.environment = DyFM_EnvironmentFlag.local;
+    const error: DyFM_Error = buildRichError();
+
+    const safe: Record<string, unknown> = DyNTS_ClientSafeError_Util.toClientSafe(error) as Record<string, unknown>;
+
+    expect(safe['__localStack']).toBeUndefined();
+    expect(safe['stack']).toBeUndefined();
+    expect(safe['___systemVersion']).toBeUndefined();
+    expect(safe['___issuer']).toBeUndefined();
+    expect(safe['___issuerSystem']).toBeUndefined();
+    expect(safe['___issuerService']).toBeUndefined();
+    expect(safe['confidentialContent']).toBeUndefined();
+    expect(safe['error']).toBeUndefined();
+    expect(safe['errors']).toBeUndefined();
+  });
+
+  it('| MEGTARTJA a kliens-fogyasztott mezőket (_message, _errorCodes, __userMessage)', (): void => {
+    DyNTS_global_settings.env_settings.environment = DyFM_EnvironmentFlag.local;
+    const error: DyFM_Error = buildRichError();
+
+    const safe: Record<string, unknown> = DyNTS_ClientSafeError_Util.toClientSafe(error) as Record<string, unknown>;
+
+    expect(safe['_message']).toBe('internal reason');
+    expect(safe['__userMessage']).toBe('user facing message');
+    expect(Array.isArray(safe['_errorCodes'])).toBeTrue();
+    expect((safe['_errorCodes'] as string[]).join(',')).toContain('DyNTS-TEST-CSE0');
+  });
+
+  it('| nem-prod env: az additionalContent (diagnosztikai snapshot) MARAD', (): void => {
+    DyNTS_global_settings.env_settings.environment = DyFM_EnvironmentFlag.local;
+    const error: DyFM_Error = buildRichError();
+
+    const safe: Record<string, unknown> = DyNTS_ClientSafeError_Util.toClientSafe(error) as Record<string, unknown>;
+
+    expect(safe['additionalContent']).toEqual({ userId: 'u1' });
+  });
+
+  it('| prod env: az additionalContent IS strip-elve', (): void => {
+    DyNTS_global_settings.env_settings.environment = DyFM_EnvironmentFlag.prod;
+    const error: DyFM_Error = buildRichError();
+
+    const safe: Record<string, unknown> = DyNTS_ClientSafeError_Util.toClientSafe(error) as Record<string, unknown>;
+
+    expect(safe['additionalContent']).toBeUndefined();
+    // a mindig-strip lista prod-ban is érvényes
+    expect(safe['__localStack']).toBeUndefined();
+    expect(safe['stack']).toBeUndefined();
+  });
+
+  it('| nem-DyFM object-error: fail-safe minimál { message } shape (axios-config nem szivárog)', (): void => {
+    const axiosLike: { message: string; config: { headers: { authorization: string } } } = {
+      message: 'Request failed with status code 401',
+      config: { headers: { authorization: 'Bearer LEAK' } },
+    };
+
+    const safe: Record<string, unknown> = DyNTS_ClientSafeError_Util.toClientSafe(axiosLike) as Record<string, unknown>;
+
+    expect(safe['message']).toBe('Request failed with status code 401');
+    expect(safe['config']).toBeUndefined();
+  });
+
+  it('| nem-object error (string/undefined): változatlanul átmegy', (): void => {
+    expect(DyNTS_ClientSafeError_Util.toClientSafe('plain string')).toBe('plain string');
+    expect(DyNTS_ClientSafeError_Util.toClientSafe(undefined)).toBeUndefined();
+  });
+});

package/src/_collections/client-safe-error.util.ts

@@ -0,0 +1,72 @@
+import { DyFM_EnvironmentFlag, DyFM_Error } from '@futdevpro/fsm-dynamo';
+
+import { DyNTS_global_settings } from './global-settings.const';
+
+/**
+ * Kliens-safe error-body SSOT (BFR-FDPAUTHSERVICE-002 — error-response info-disclosure fix).
+ *
+ * A DyFM_Error HTTP-response-ba szerializálásakor a belső diagnosztikai mezők NEM mehetnek ki a
+ * kliensre — env-FÜGGETLENÜL (a korábbi prod-only strip a test/dev környezetben TELJES leaket
+ * hagyott: `__localStack` stack-trace, `___systemVersion`, issuer-lánc). A strip-szabályok:
+ *
+ *   1. MINDIG ki (env-független, kliens sehol nem fogyasztja → 0 regresszió):
+ *      `__localStack`, `stack`, `___systemVersion`, `___issuer`, `___issuerSystem`,
+ *      `___issuerService`, `confidentialContent`, `error`, `errors` (a nyers belső error-lánc
+ *      stack-eket hordoz).
+ *   2. CSAK prod-ban ki: `additionalContent` — test/dev környezetben a diagnosztikai state-snapshot
+ *      szándékosan kimegy (a hibafelület-debug erre épül), prod-ban nem.
+ *   3. MARAD (kliens-kompatibilitás — a FDP-kliens error-interceptorok fogyasztják):
+ *      `_message`, `_errorCodes`, `__userMessage`, `___status`, `level`.
+ *
+ * NEM-DyFM error (plain Error / axios-error / bármi más): minimál `{ message }` shape — a plain
+ * Error eddig is üres `{}`-ként szerializálódott (non-enumerable mezők), az axios-jellegű error-ok
+ * viszont enumerable config/request mezőkben auth-headert is szivárogtathatnak → fail-safe minimál.
+ *
+ * ⚠️ A metódus MUTÁLJA a kapott DyFM_Error-t (a meglévő endpoint-strip precedensét követve) —
+ * a hívási pont a response-küldés, ahol az error-objektum életciklusa véget ér.
+ */
+export class DyNTS_ClientSafeError_Util {
+
+  /** A MINDIG strip-elendő DyFM-mezők (env-független — kliens-fogyasztás nélküli leak-vektorok). */
+  private static readonly alwaysStripKeys: string[] = [
+    '__localStack',
+    'stack',
+    '___systemVersion',
+    '___issuer',
+    '___issuerSystem',
+    '___issuerService',
+    'confidentialContent',
+    'error',
+    'errors',
+  ];
+
+  /**
+   * Az error kliens-safe formára hozása a HTTP-response-küldés előtt.
+   * DyFM_Error: in-place strip (1-3. szabályok szerint); nem-DyFM object: minimál `{ message }`.
+   */
+  static toClientSafe(error: unknown): unknown {
+    // DyFM_Error: célzott mező-strip, a kliens-fogyasztott mezők megtartásával
+    if (DyFM_Error.isDyFMError(error)) {
+      const dyError: Record<string, unknown> = error as unknown as Record<string, unknown>;
+
+      for (const key of DyNTS_ClientSafeError_Util.alwaysStripKeys) {
+        delete dyError[key];
+      }
+
+      // prod: a diagnosztikai state-snapshot sem megy ki; test/dev: szándékosan marad (debug-UX)
+      if (DyNTS_global_settings.env_settings.environment === DyFM_EnvironmentFlag.prod) {
+        delete dyError['additionalContent'];
+      }
+
+      return error;
+    }
+
+    // nem-DyFM object-error (plain/axios/egyéb): fail-safe minimál shape — a nyers objektum
+    // enumerable mezői (pl. axios config.headers) szivárogtathatnak
+    if (error && typeof error === 'object') {
+      return { message: (error as Error).message ?? 'Internal server error' };
+    }
+
+    return error;
+  }
+}

package/src/_models/control-models/endpoint-params.control-model.ts

@@ -7,6 +7,7 @@ import {
 } from '@futdevpro/fsm-dynamo';
 
 import { DyNTS_global_settings } from '../../_collections/global-settings.const';
+import { DyNTS_ClientSafeError_Util } from '../../_collections/client-safe-error.util';
 import { DyNTS_RouteSecurity } from '../../_enums/route-security.enum';
 import { DyNTS_GlobalService } from '../../_services/core/global.service';
 
@@ -487,20 +488,11 @@ export class DyNTS_Endpoint_Params<
         res.status(500);
       }
 
-      if (
-        DyNTS_global_settings.env_settings.environment === DyFM_EnvironmentFlag.prod &&
-        error instanceof DyFM_Error
-      ) {
-        delete (error as DyFM_Error).confidentialContent;
-        delete (error as DyFM_Error).additionalContent;
-        delete (error as DyFM_Error).error;
-        delete (error as DyFM_Error).errors;
-        delete (error as DyFM_Error).stack;
-        delete (error as DyFM_Error).__localStack;
-        /* DyFM_Error.deleteErrorContent(error as DyFM_Error); */
-      }
-
-      res.send(error);
+      // Kliens-safe strip ENV-FÜGGETLENÜL (BFR-FDPAUTHSERVICE-002): a korábbi prod-only blokk a
+      // test/dev környezetben TELJES DyFM-leaket hagyott (__localStack + ___systemVersion + issuer).
+      // A szabályok (mindig-strip / prod-only additionalContent / kliens-mezők megtartása) SSOT-ja
+      // a DyNTS_ClientSafeError_Util.
+      res.send(DyNTS_ClientSafeError_Util.toClientSafe(error));
 
       if (this.logRequest) {
         if (this.logResponseContent) {

package/src/_services/server/app.server.ts

@@ -30,6 +30,7 @@ import {
 import { DyNTS_defaultFallbackCacheMaxAge } from '../../_collections/default-fallback-cache-max-age.const';
 import { DyNTS_defaultNotFoundPageHtml } from '../../_collections/default-not-found-page.const';
 import { DyNTS_global_settings } from '../../_collections/global-settings.const';
+import { DyNTS_ClientSafeError_Util } from '../../_collections/client-safe-error.util';
 import { DyNTS_getEnvironment_settings } from '../../_collections/get-environment-settings.util';
 import { DyNTS_createSecurityHeadersMiddleware } from '../../_collections/security-headers.util';
 import { DyNTS_SecurityHeaders_Settings } from '../../_models/interfaces/security-headers-settings.interface';
@@ -1482,7 +1483,10 @@ export abstract class DyNTS_App extends DyNTS_SingletonService {
 
         await DyNTS_GlobalService.globalErrorHandler?.(d_error, req, res);
 
-        res.send(error)
+        // Kliens-safe strip (BFR-FDPAUTHSERVICE-002): az express-error út eddig NYERS error-t küldött
+        // (0 strip) — DyFM-nél belső stack/verzió/issuer, axios-jellegű error-nál akár auth-header is
+        // kimehetett. A strip-szabályok SSOT-ja a DyNTS_ClientSafeError_Util.
+        res.send(DyNTS_ClientSafeError_Util.toClientSafe(error))
       } else {
         DyFM_Log.H_error(
           'WTF??? express error; without error?...' + 

package/src/index.ts

@@ -54,6 +54,7 @@ export * from './_models/interfaces/cors-settings.interface';
 export * from './_models/interfaces/security-headers-settings.interface';
 export * from './_models/interfaces/db-query-options.interface';
 export * from './_collections/security-headers.util';
+export * from './_collections/client-safe-error.util';
 
 // models/CONTROL MODELS
 export * from './_models/control-models/api-call-params.control-model';