@gasket/plugin-elastic-apm 6.46.8 → 7.0.0--canary-1.0

package/README.md

@@ -34,21 +34,36 @@ Add a `--require` flag to a `package.json` start script:
   "scripts": {
     "build": "gasket build",
 -   "start": "gasket start",
-+   "start": "gasket start --require elastic-apm-node/start",
++   "start": "gasket start --require ./setup.js",
     "local": "gasket local"
   }
 ```
 
+Add a `setup.js` script to the root of your app
+
+```
+// setup.js
+require('dotenv').config();
+
+require('elastic-apm-node').start({
+  serviceName: 'my-service-name',
+  secretToken: process.env.ELASTIC_APM_SECRET_TOKEN,
+  serverUrl: process.env.ELASTIC_APM_SERVER_URL
+  // any additional configurations options
+});
+```
+
 ## Configuration
 
 The [start recommendations] for the APM agent are to require it as early as
-possible in your app. For Gasket apps, using `--require elastic-apm-node/start`
+possible in your app. For Gasket apps, using `--require ./setup.js`
 will accomplish this. To configure the APM agent, set the environment variables
 described in the [configuration options documentation].
 
 In particular, the APM server URL (`ELASTIC_APM_SERVER_URL`) and secret token
-(`ELASTIC_APM_SECRET_TOKEN`) are both required configuration. If either
-of these are not present, the APM agent will be disabled.
+(`ELASTIC_APM_SECRET_TOKEN`) are both required configuration. If either of these
+are not present, the APM agent will be disabled.
+
 
 ### Plugin Configurations
 
@@ -72,26 +87,29 @@ module.exports = {
 };
 ```
 
-### Custom Start Configurations
+#### Custom Filtering Sensitive Fields
 
-For scenarios where you need to configure the start options for the APM agent,
-you can do so in a custom setup script and require it instead.
-
-For example, add a `setup.js` script to the root of your app:
+If your application’s users send session credentials or any other sensitive
+information in their cookies, you may wish to filter them out before they are
+stored in Elasticsearch. Specify a list of cookie names to redact in
+`setup.js` using the [sanitizeFieldNames] configuration option:
 
 ```
 // setup.js
+require('dotenv').config();
+
 require('elastic-apm-node').start({
-  // any configuration options
-})
+  ...,
+  sanitizeFieldNames: ['foo', 'bar', '*token*']
+});
 ```
 
-Then adjust your start script to require it instead:
+The `sanitizeFieldNames` config option can be used for:
+- request and response HTTP headers
+- HTTP request cookies
+- any form field captured during an `application/x-www-form-urlencoded` data request
 
-```diff
--   "start": "gasket start --require elastic-apm-node/start",
-+   "start": "gasket start --require ./setup.js",
-```
+To filter out other data, use the [APM Add Filter API].
 
 ### Custom Filters
 
@@ -103,7 +121,9 @@ hooks of your Gasket app, such as with the [init] or [middleware] lifecycles.
 
 ### apmTransaction
 
-Enables customizing an APM transaction. Hooks receive the current APM [Transaction](https://www.elastic.co/guide/en/apm/agent/nodejs/current/transaction-api.html) and details about the request. Hooks may be asynchronous. The request details are as follows:
+Enables customizing an APM transaction. Hooks receive the current APM
+[Transaction] and details about the request. Hooks may be asynchronous. The
+request details are as follows:
 
 | Property | Description |
 |----------|-------------|
@@ -120,11 +140,11 @@ module.exports = (gasket, transaction, { req, res }) => {
 
 ## How it works
 
-This plugin hooks the Gasket [preboot] lifecycle from [@gasket/plugin-start]
-and will set up additional filtering, such as for sensitive cookies. If the
+This plugin hooks the Gasket [preboot] lifecycle from [@gasket/plugin-start] and
+will set up additional filtering, such as for sensitive cookies. If the
 `preboot` hook finds that the APM agent has not yet been started using the
-recommended `--require elastic-apm-node/start`, it will start it here.
-However, you risk not bootstrapping necessary modules with a late start.
+recommended `--require elastic-apm-node/start`, it will start it here. However,
+you risk not bootstrapping necessary modules with a late start.
 
 ## License
 
@@ -138,3 +158,6 @@ However, you risk not bootstrapping necessary modules with a late start.
 [configuration options documentation]:https://www.elastic.co/guide/en/apm/agent/nodejs/current/configuration.html
 [start recommendations]:https://www.elastic.co/guide/en/apm/agent/nodejs/master/agent-api.html#apm-start
 [Elastic APM docs]:https://www.elastic.co/guide/en/apm/agent/nodejs/master/agent-api.html
+[sanitizeFieldNames]:https://www.elastic.co/guide/en/apm/agent/nodejs/4.x/configuration.html#sanitize-field-names
+[APM Add Filter API]:https://www.elastic.co/guide/en/apm/agent/nodejs/4.x/agent-api.html#apm-add-filter
+[Transaction]:(https://www.elastic.co/guide/en/apm/agent/nodejs/current/transaction-api.html)

package/lib/configure.js

@@ -0,0 +1,34 @@
+/**
+ * Determines if the Elastic APM agent has sufficient config to be active
+ * @param {import('./index').ExtendedAgentConfigOptions} config Apm agent config
+ * @param {NodeJS.ProcessEnv} env Environment variables
+ * @returns {boolean} A combined config object
+ */
+const isActive = (config, env) => {
+  const { active, serverUrl, secretToken } = config;
+
+  if (active || env.ELASTIC_APM_ACTIVE) {
+    return true;
+  }
+
+  const combined = {
+    serverUrl: serverUrl || env.ELASTIC_APM_SERVER_URL,
+    secretToken: secretToken || env.ELASTIC_APM_SECRET_TOKEN
+  };
+
+  if (combined.serverUrl && combined.secretToken) {
+    return true;
+  }
+
+  return false;
+};
+
+/** @type {import('@gasket/core').HookHandler<'configure'>} */
+module.exports = async function configure(gasket, config) {
+  config.elasticAPM = config.elasticAPM || {};
+
+  // eslint-disable-next-line no-process-env
+  config.elasticAPM.active = isActive(config.elasticAPM, process.env);
+
+  return { ...config };
+};

package/lib/cookies.js

@@ -1,8 +1,7 @@
 /**
  * Returns an array of cookie names which are considered sensitive because they
  * may contain session credential or PII
- *
- * @param {*} config the Gasket config object
+ * @param {import('@gasket/core').GasketConfig} config the Gasket config
  * @returns {string[]} an array of cookie names
  */
 const sensitiveCookies = (config) => {
@@ -18,28 +17,42 @@ const sensitiveCookies = (config) => {
 
 /**
  * Redacts the contents of user-specified sensitive cookies
- *
- * @param {object} config The Gasket config
- * @param {object} payload The APM payload
- * @returns {object} a modified version of the incoming APM payload
+ * @type {import('./index').filterSensitiveCookies}
  */
-const filterSensitiveCookies = (config) => (payload) => {
-  if (
-    payload.context &&
+const filterSensitiveCookies = function (config) {
+  return function (payload) {
+    const cookiesToRedact = sensitiveCookies(config);
+
+    if (
+      payload.context &&
     payload.context.request &&
     payload.context.request.headers &&
     payload.context.request.headers.cookie
-  ) {
-    let cookie = payload.context.request.headers.cookie;
+    ) {
+      let cookie = payload.context.request.headers.cookie;
+      cookiesToRedact.forEach((sc) => {
+        cookie = cookie.replace(
+          new RegExp(sc + '=([^;]+)'),
+          sc + '=[REDACTED]'
+        );
+      });
 
-    sensitiveCookies(config).forEach((sc) => {
-      cookie = cookie.replace(new RegExp(sc + '=([^;]+)'), sc + '=[REDACTED]');
-    });
+      payload.context.request.headers.cookie = cookie;
+    }
 
-    payload.context.request.headers.cookie = cookie;
-  }
+    if (payload.context &&
+    payload.context.request &&
+    payload.context.request.cookies
+    ) {
+      cookiesToRedact.forEach((sc) => {
+        if (sc in payload.context.request.cookies) {
+          payload.context.request.cookies[sc] = '[REDACTED]';
+        }
+      });
+    }
 
-  return payload;
+    return payload;
+  };
 };
 
 module.exports = {

package/lib/index.d.ts

@@ -1,12 +1,17 @@
 import type { IncomingMessage, ServerResponse } from 'http';
-import type { Agent, AgentConfigOptions, Transaction } from 'elastic-apm-node';
-import type { MaybeAsync } from '@gasket/engine';
+import type { AgentConfigOptions, Transaction, Payload } from 'elastic-apm-node';
+import type { MaybeAsync, GasketConfig } from '@gasket/core';
+import type { GasketData } from '@gasket/data';
 
-declare module '@gasket/engine' {
+export function filterSensitiveCookies(config: GasketConfig): function(Payload): Payload;
+
+export interface ExtendedAgentConfigOptions extends AgentConfigOptions {
+  sensitiveCookies?: Array<string>;
+}
+
+declare module '@gasket/core' {
   export interface GasketConfig {
-    elasticAPM?: AgentConfigOptions & {
-      sensitiveCookies?: Array<string>
-    },
+    elasticAPM?: ExtendedAgentConfigOptions;
   }
 
   export interface Gasket {
@@ -17,9 +22,20 @@ declare module '@gasket/engine' {
     apmTransaction(
       transaction: Transaction,
       details: {
-        req: IncomingMessage,
-        res: ServerResponse
+        req: IncomingMessage;
+        res: ServerResponse & {
+          locals?: {
+            gasketData: GasketData & {
+              locale?: string;
+            };
+          };
+        };
       }
-    ): MaybeAsync<void>
+    ): MaybeAsync<void>;
   }
 }
+
+export default {
+  name: '@gasket/plugin-elastic-apm',
+  hooks: {}
+};

package/lib/index.js

@@ -1,115 +1,65 @@
-const { filterSensitiveCookies } = require('./cookies');
-const middleware = require('./middleware');
-const { dependencies } = require('../package.json');
-
-const isDefined = o => typeof o !== 'undefined';
+/// <reference types="create-gasket-app" />
+/// <reference types="@gasket/plugin-metadata" />
 
-/**
- * Determines if the Elastic APM agent has sufficient config to be active
- * @param {object} config gasket config
- * @param {object<string,any>} env environment variables
- * @returns {boolean} A combined config object
- */
-const isActive = (config, env) => {
-  const { active, serverUrl, secretToken } = config;
-
-  if (active || env.ELASTIC_APM_ACTIVE) {
-    return true;
-  }
-
-  const combined = {
-    serverUrl: serverUrl || env.ELASTIC_APM_SERVER_URL,
-    secretToken: secretToken || env.ELASTIC_APM_SECRET_TOKEN
-  };
-
-  if (combined.serverUrl && combined.secretToken) {
-    return true;
-  }
-
-  return false;
-};
+const middleware = require('./middleware');
+const preboot = require('./preboot');
+const configure = require('./configure');
+const { devDependencies, name } = require('../package.json');
 
-module.exports = {
+/** @type {import('@gasket/core').Plugin} */
+const plugin = {
+  name,
   hooks: {
-    configure: {
-      handler: async (gasket, config) => {
-        const { logger } = gasket;
-        config.elasticAPM = config.elasticAPM || {};
-
-        const { serverUrl, secretToken } = config.elasticAPM;
-        if (isDefined(serverUrl)) {
-          logger.notice('DEPRECATED config `elasticAPM.serverUrl`. Use env var: ELASTIC_APM_SERVER_URL');
-        }
-        if (isDefined(secretToken)) {
-          logger.notice('DEPRECATED config `elasticAPM.secretToken`. Use env var: ELASTIC_APM_SECRET_TOKEN');
-        }
-
-        // eslint-disable-next-line no-process-env
-        config.elasticAPM.active = isActive(config.elasticAPM, process.env);
-
-        return { ...config };
-      }
-    },
-    preboot: {
-      handler: async (gasket) => {
-        const { config, logger, command } = gasket;
-
-        if (command && command.id === 'local') return;
-
-        // prefer app-level dependency in case of duplicates
-        const apm = require(
-          require.resolve('elastic-apm-node', { paths: [config.root, __dirname] })
-        );
-
-        if (!apm.isStarted()) {
-          apm.start({
-            ...config.elasticAPM
-          });
-          logger.notice('DEPRECATED started Elastic APM agent late. Use `--require elastic-apm-node/start`');
-        }
-
-        apm.addFilter(filterSensitiveCookies(config));
-
-        gasket.apm = apm;
-      }
-    },
+    configure,
+    preboot,
     create: {
       timing: {
         after: ['@gasket/plugin-start']
       },
-      handler(gasket, { pkg }) {
+      handler(gasket, { pkg, files }) {
+        const generatorDir = `${__dirname}/../generator`;
+
         pkg.add('dependencies', {
-          'elastic-apm-node': dependencies['elastic-apm-node']
+          'elastic-apm-node': devDependencies['elastic-apm-node']
         });
         pkg.add('scripts', {
-          start: 'gasket start --require elastic-apm-node/start'
+          start: 'gasket start --require ./setup.js'
         });
+
+        files.add(`${generatorDir}/*`);
       }
     },
     middleware,
     metadata(gasket, meta) {
       return {
         ...meta,
-        configurations: [{
-          name: 'elasticAPM',
-          link: 'README.md#configuration',
-          description: 'Configuration to provide additional setup helpers',
-          type: 'object'
-        }, {
-          name: 'elasticAPM.sensitiveCookies',
-          link: 'README.md#configuration',
-          description: 'List of sensitive cookies to filter',
-          type: 'string[]',
-          default: '[]'
-        }],
-        lifecycles: [{
-          name: 'apmTransaction',
-          method: 'exec',
-          description: 'Modify the APM transaction',
-          link: 'README.md#apmtransaction',
-          parent: 'middleware'
-        }]
+        configurations: [
+          {
+            name: 'elasticAPM',
+            link: 'README.md#configuration',
+            description: 'Configuration to provide additional setup helpers',
+            type: 'object'
+          },
+          {
+            name: 'elasticAPM.sensitiveCookies',
+            link: 'README.md#configuration',
+            description: 'List of sensitive cookies to filter',
+            type: 'string[]',
+            default: '[]'
+          }
+        ],
+        lifecycles: [
+          {
+            name: 'apmTransaction',
+            method: 'exec',
+            description: 'Modify the APM transaction',
+            link: 'README.md#apmtransaction',
+            parent: 'middleware'
+          }
+        ]
       };
     }
   }
 };
+
+module.exports = plugin;

package/lib/middleware.js

@@ -1,22 +1,10 @@
-/* eslint-disable spaced-comment */
-// @ts-check
-/// <reference types="./index" />
-/// <reference types="../../gasket-plugin-nextjs" />
-
-/**
- * @typedef {import('@gasket/engine').Gasket} Gasket
- * @typedef {import('http').IncomingMessage}  Request
- * @typedef {import('http').ServerResponse}   Response
- */
-
-const { callbackify } = require('util');
+/// <reference types="@gasket/plugin-express" />
 
 /**
  * Middleware for customizing transactions
- *
- * @param {Gasket}    gasket  The Gasket engine
- * @param {Request}   req     The HTTP request being handled
- * @param {Response}  res     The server response
+ * @param {import('@gasket/core').Gasket} gasket - The Gasket engine
+ * @param {import('http').IncomingMessage} req - The HTTP request being handled
+ * @param {import('http').ServerResponse} res - The server response
  */
 async function customizeTransaction(gasket, req, res) {
   const apm = gasket.apm;
@@ -33,9 +21,20 @@ async function customizeTransaction(gasket, req, res) {
   await gasket.exec('apmTransaction', transaction, { req, res });
 }
 
-module.exports = (gasket) => {
+/**
+ * Add middleware to gather config details
+ * @type {import('@gasket/core').HookHandler<'middleware'>}
+ */
+module.exports = function middleware(gasket) {
   return (
-    gasket.apm
-    && [callbackify(async (req, res) => customizeTransaction(gasket, req, res))]
+    gasket.apm &&
+    async function apmTransactionMiddleware(req, res, next) {
+      try {
+        customizeTransaction(gasket, req, res);
+      } catch (error) {
+        return next(error);
+      }
+      next();
+    }
   );
 };

package/lib/preboot.js

@@ -0,0 +1,29 @@
+/// <reference types="@gasket/plugin-start" />
+/// <reference types="@gasket/plugin-logger" />
+
+const { filterSensitiveCookies } = require('./cookies');
+
+/** @type {import('@gasket/core').HookHandler<'preboot'>} */
+module.exports = async function preboot(gasket) {
+  const { config, logger, command } = gasket;
+
+  if (command && command.id === 'local') return;
+
+  /**
+   * @type {import('elastic-apm-node')}
+   * Note: Prefer app-level dependency in case of duplicates
+   */
+  const apm = require(require.resolve('elastic-apm-node', {
+    paths: [config.root, __dirname]
+  }));
+
+  if (!apm.isStarted()) {
+    logger.warn(
+      'Elastic APM agent is not started. Use `--require ./setup.js`'
+    );
+  }
+
+  apm.addFilter(filterSensitiveCookies(config));
+
+  gasket.apm = apm;
+};

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@gasket/plugin-elastic-apm",
-  "version": "6.46.8",
+  "version": "7.0.0--canary-1.0",
   "description": "Adds Elastic APM instrumentation to your application",
-  "main": "lib",
+  "main": "lib/index.js",
   "types": "lib/index.d.ts",
   "files": [
     "lib"
@@ -14,9 +14,9 @@
     "test:runner": "jest test/*.test.js",
     "test:watch": "npm run test:runner -- --watch",
     "test:coverage": "npm run test:runner -- --coverage --coverageReporters text",
-    "posttest": "npm run lint",
+    "posttest": "npm run lint && npm run typecheck",
     "report": "npm run test:runner -- --coverage --coverageReporters lcov",
-    "typecheck:skip": "tsc",
+    "typecheck": "tsc",
     "typecheck:watch": "tsc --watch"
   },
   "repository": {
@@ -41,11 +41,9 @@
     "url": "https://github.com/godaddy/gasket/issues"
   },
   "homepage": "https://github.com/godaddy/gasket/tree/main/packages/gasket-plugin-elastic-apm",
-  "dependencies": {
-    "elastic-apm-node": "^3.50.0"
-  },
   "devDependencies": {
-    "@gasket/engine": "^6.46.8",
+    "@gasket/core": "^7.0.0--canary-1.0",
+    "elastic-apm-node": "^4.4.1",
     "eslint": "^8.56.0",
     "eslint-config-godaddy": "^7.1.0",
     "eslint-plugin-jest": "^27.6.3",
@@ -72,5 +70,5 @@
   "jest": {
     "testEnvironment": "node"
   },
-  "gitHead": "a4b0d22e57ca4c3e5b944d7153ac25c30ca094f3"
+  "gitHead": "58bd9162c377330143dd26c6ee72cf3d9e1775e0"
 }