@gasket/plugin-elastic-apm 6.45.0 → 6.46.1-7.0.0-cli.6.0

package/README.md

@@ -34,21 +34,36 @@ Add a `--require` flag to a `package.json` start script:
   "scripts": {
     "build": "gasket build",
 -   "start": "gasket start",
-+   "start": "gasket start --require elastic-apm-node/start",
++   "start": "gasket start --require ./setup.js",
     "local": "gasket local"
   }
 ```
 
+Add a `setup.js` script to the root of your app
+
+```
+// setup.js
+require('dotenv').config();
+
+require('elastic-apm-node').start({
+  serviceName: 'my-service-name',
+  secretToken: process.env.ELASTIC_APM_SECRET_TOKEN,
+  serverUrl: process.env.ELASTIC_APM_SERVER_URL
+  // any additional configurations options
+});
+```
+
 ## Configuration
 
 The [start recommendations] for the APM agent are to require it as early as
-possible in your app. For Gasket apps, using `--require elastic-apm-node/start`
+possible in your app. For Gasket apps, using `--require ./setup.js`
 will accomplish this. To configure the APM agent, set the environment variables
 described in the [configuration options documentation].
 
 In particular, the APM server URL (`ELASTIC_APM_SERVER_URL`) and secret token
-(`ELASTIC_APM_SECRET_TOKEN`) are both required configuration. If either
-of these are not present, the APM agent will be disabled.
+(`ELASTIC_APM_SECRET_TOKEN`) are both required configuration. If either of these
+are not present, the APM agent will be disabled.
+
 
 ### Plugin Configurations
 
@@ -72,26 +87,29 @@ module.exports = {
 };
 ```
 
-### Custom Start Configurations
+#### Custom Filtering Sensitive Fields
 
-For scenarios where you need to configure the start options for the APM agent,
-you can do so in a custom setup script and require it instead.
-
-For example, add a `setup.js` script to the root of your app:
+If your application’s users send session credentials or any other sensitive
+information in their cookies, you may wish to filter them out before they are
+stored in Elasticsearch. Specify a list of cookie names to redact in
+`setup.js` using the [sanitizeFieldNames] configuration option:
 
 ```
 // setup.js
+require('dotenv').config();
+
 require('elastic-apm-node').start({
-  // any configuration options
-})
+  ...,
+  sanitizeFieldNames: ['foo', 'bar', '*token*']
+});
 ```
 
-Then adjust your start script to require it instead:
+The `sanitizeFieldNames` config option can be used for:
+- request and response HTTP headers
+- HTTP request cookies
+- any form field captured during an `application/x-www-form-urlencoded` data request
 
-```diff
--   "start": "gasket start --require elastic-apm-node/start",
-+   "start": "gasket start --require ./setup.js",
-```
+To filter out other data, use the [APM Add Filter API].
 
 ### Custom Filters
 
@@ -103,7 +121,9 @@ hooks of your Gasket app, such as with the [init] or [middleware] lifecycles.
 
 ### apmTransaction
 
-Enables customizing an APM transaction. Hooks receive the current APM [Transaction](https://www.elastic.co/guide/en/apm/agent/nodejs/current/transaction-api.html) and details about the request. Hooks may be asynchronous. The request details are as follows:
+Enables customizing an APM transaction. Hooks receive the current APM
+[Transaction] and details about the request. Hooks may be asynchronous. The
+request details are as follows:
 
 | Property | Description |
 |----------|-------------|
@@ -120,11 +140,11 @@ module.exports = (gasket, transaction, { req, res }) => {
 
 ## How it works
 
-This plugin hooks the Gasket [preboot] lifecycle from [@gasket/plugin-start]
-and will set up additional filtering, such as for sensitive cookies. If the
+This plugin hooks the Gasket [preboot] lifecycle from [@gasket/plugin-start] and
+will set up additional filtering, such as for sensitive cookies. If the
 `preboot` hook finds that the APM agent has not yet been started using the
-recommended `--require elastic-apm-node/start`, it will start it here.
-However, you risk not bootstrapping necessary modules with a late start.
+recommended `--require elastic-apm-node/start`, it will start it here. However,
+you risk not bootstrapping necessary modules with a late start.
 
 ## License
 
@@ -138,3 +158,6 @@ However, you risk not bootstrapping necessary modules with a late start.
 [configuration options documentation]:https://www.elastic.co/guide/en/apm/agent/nodejs/current/configuration.html
 [start recommendations]:https://www.elastic.co/guide/en/apm/agent/nodejs/master/agent-api.html#apm-start
 [Elastic APM docs]:https://www.elastic.co/guide/en/apm/agent/nodejs/master/agent-api.html
+[sanitizeFieldNames]:https://www.elastic.co/guide/en/apm/agent/nodejs/4.x/configuration.html#sanitize-field-names
+[APM Add Filter API]:https://www.elastic.co/guide/en/apm/agent/nodejs/4.x/agent-api.html#apm-add-filter
+[Transaction]:(https://www.elastic.co/guide/en/apm/agent/nodejs/current/transaction-api.html)

package/lib/cookies.js

@@ -24,6 +24,8 @@ const sensitiveCookies = (config) => {
  * @returns {object} a modified version of the incoming APM payload
  */
 const filterSensitiveCookies = (config) => (payload) => {
+  const cookiesToRedact = sensitiveCookies(config);
+
   if (
     payload.context &&
     payload.context.request &&
@@ -31,14 +33,24 @@ const filterSensitiveCookies = (config) => (payload) => {
     payload.context.request.headers.cookie
   ) {
     let cookie = payload.context.request.headers.cookie;
-
-    sensitiveCookies(config).forEach((sc) => {
+    cookiesToRedact.forEach((sc) => {
       cookie = cookie.replace(new RegExp(sc + '=([^;]+)'), sc + '=[REDACTED]');
     });
 
     payload.context.request.headers.cookie = cookie;
   }
 
+  if (payload.context &&
+    payload.context.request &&
+    payload.context.request.cookies
+  ) {
+    cookiesToRedact.forEach((sc) => {
+      if (sc in payload.context.request.cookies) {
+        payload.context.request.cookies[sc] = '[REDACTED]';
+      }
+    });
+  }
+
   return payload;
 };
 

package/lib/index.d.ts

@@ -7,7 +7,7 @@ declare module '@gasket/engine' {
       sensitiveCookies?: Array<string>
     },
   }
-
+  
   export interface HookExecTypes {
     apmTransaction(
       transaction: Transaction,

package/lib/index.js

@@ -1,8 +1,6 @@
 const { filterSensitiveCookies } = require('./cookies');
 const middleware = require('./middleware');
-const { dependencies } = require('../package.json');
-
-const isDefined = o => typeof o !== 'undefined';
+const { devDependencies } = require('../package.json');
 
 /**
  * Determines if the Elastic APM agent has sufficient config to be active
@@ -11,18 +9,13 @@ const isDefined = o => typeof o !== 'undefined';
  * @returns {boolean} A combined config object
  */
 const isActive = (config, env) => {
-  const { active, serverUrl, secretToken } = config;
+  const { active } = config;
 
   if (active || env.ELASTIC_APM_ACTIVE) {
     return true;
   }
 
-  const combined = {
-    serverUrl: serverUrl || env.ELASTIC_APM_SERVER_URL,
-    secretToken: secretToken || env.ELASTIC_APM_SECRET_TOKEN
-  };
-
-  if (combined.serverUrl && combined.secretToken) {
+  if (env.ELASTIC_APM_SERVER_URL && env.ELASTIC_APM_SECRET_TOKEN) {
     return true;
   }
 
@@ -33,17 +26,8 @@ module.exports = {
   hooks: {
     configure: {
       handler: async (gasket, config) => {
-        const { logger } = gasket;
         config.elasticAPM = config.elasticAPM || {};
 
-        const { serverUrl, secretToken } = config.elasticAPM;
-        if (isDefined(serverUrl)) {
-          logger.notice('DEPRECATED config `elasticAPM.serverUrl`. Use env var: ELASTIC_APM_SERVER_URL');
-        }
-        if (isDefined(secretToken)) {
-          logger.notice('DEPRECATED config `elasticAPM.secretToken`. Use env var: ELASTIC_APM_SECRET_TOKEN');
-        }
-
         // eslint-disable-next-line no-process-env
         config.elasticAPM.active = isActive(config.elasticAPM, process.env);
 
@@ -57,15 +41,14 @@ module.exports = {
         if (command && command.id === 'local') return;
 
         // prefer app-level dependency in case of duplicates
-        const apm = require(
-          require.resolve('elastic-apm-node', { paths: [config.root, __dirname] })
-        );
+        const apm = require(require.resolve('elastic-apm-node', {
+          paths: [config.root, __dirname]
+        }));
 
         if (!apm.isStarted()) {
-          apm.start({
-            ...config.elasticAPM
-          });
-          logger.notice('DEPRECATED started Elastic APM agent late. Use `--require elastic-apm-node/start`');
+          logger.warn(
+            'Elastic APM agent is not started. Use `--require ./setup.js`'
+          );
         }
 
         apm.addFilter(filterSensitiveCookies(config));
@@ -75,38 +58,48 @@ module.exports = {
       timing: {
         after: ['@gasket/plugin-start']
       },
-      handler(gasket, { pkg }) {
+      handler(gasket, { pkg, files }) {
+        const generatorDir = `${__dirname}/../generator`;
+
         pkg.add('dependencies', {
-          'elastic-apm-node': dependencies['elastic-apm-node']
+          'elastic-apm-node': devDependencies['elastic-apm-node'],
+          'dotenv': devDependencies.dotenv
         });
         pkg.add('scripts', {
-          start: 'gasket start --require elastic-apm-node/start'
+          start: 'gasket start --require ./setup.js'
         });
+
+        files.add(`${generatorDir}/*`);
       }
     },
     middleware,
     metadata(gasket, meta) {
       return {
         ...meta,
-        configurations: [{
-          name: 'elasticAPM',
-          link: 'README.md#configuration',
-          description: 'Configuration to provide additional setup helpers',
-          type: 'object'
-        }, {
-          name: 'elasticAPM.sensitiveCookies',
-          link: 'README.md#configuration',
-          description: 'List of sensitive cookies to filter',
-          type: 'string[]',
-          default: '[]'
-        }],
-        lifecycles: [{
-          name: 'apmTransaction',
-          method: 'exec',
-          description: 'Modify the APM transaction',
-          link: 'README.md#apmtransaction',
-          parent: 'middleware'
-        }]
+        configurations: [
+          {
+            name: 'elasticAPM',
+            link: 'README.md#configuration',
+            description: 'Configuration to provide additional setup helpers',
+            type: 'object'
+          },
+          {
+            name: 'elasticAPM.sensitiveCookies',
+            link: 'README.md#configuration',
+            description: 'List of sensitive cookies to filter',
+            type: 'string[]',
+            default: '[]'
+          }
+        ],
+        lifecycles: [
+          {
+            name: 'apmTransaction',
+            method: 'exec',
+            description: 'Modify the APM transaction',
+            link: 'README.md#apmtransaction',
+            parent: 'middleware'
+          }
+        ]
       };
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gasket/plugin-elastic-apm",
-  "version": "6.45.0",
+  "version": "6.46.1-7.0.0-cli.6.0",
   "description": "Adds Elastic APM instrumentation to your application",
   "main": "lib",
   "types": "lib/index.d.ts",
@@ -39,16 +39,14 @@
     "url": "https://github.com/godaddy/gasket/issues"
   },
   "homepage": "https://github.com/godaddy/gasket/tree/main/packages/gasket-plugin-elastic-apm",
-  "dependencies": {
-    "elastic-apm-node": "^3.50.0"
-  },
   "devDependencies": {
-    "@gasket/engine": "^6.45.0",
+    "@gasket/engine": "^6.46.1-7.0.0-cli.6.0",
+    "dot-env": "^0.0.1",
+    "elastic-apm-node": "^4.4.1",
     "eslint": "^8.56.0",
     "eslint-config-godaddy": "^7.0.2",
     "eslint-plugin-jest": "^27.6.3",
     "eslint-plugin-json": "^3.1.0",
-    "eslint-plugin-mocha": "^10.2.0",
     "eslint-plugin-unicorn": "^44.0.0",
     "jest": "^29.7.0",
     "nyc": "^15.1.0"
@@ -68,5 +66,5 @@
   "jest": {
     "testEnvironment": "node"
   },
-  "gitHead": "e567d11560a0d3721ffbd4649fa4ee8b6b739afb"
+  "gitHead": "0d3c61e5ba470fbca7ae5e331d15e41b57410fe0"
 }