@geekmidas/logger 10.0.0-alpha.67 → 10.0.0-alpha.69
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/pino.cjs +5 -0
- package/dist/pino.cjs.map +1 -1
- package/dist/pino.d.cts +2 -1
- package/dist/pino.d.cts.map +1 -1
- package/dist/pino.d.mts +2 -1
- package/dist/pino.d.mts.map +1 -1
- package/dist/pino.mjs +6 -1
- package/dist/pino.mjs.map +1 -1
- package/dist/redact-paths.cjs +49 -0
- package/dist/redact-paths.cjs.map +1 -1
- package/dist/redact-paths.d.cts +14 -0
- package/dist/redact-paths.d.cts.map +1 -1
- package/dist/redact-paths.d.mts +14 -0
- package/dist/redact-paths.d.mts.map +1 -1
- package/dist/redact-paths.mjs +48 -1
- package/dist/redact-paths.mjs.map +1 -1
- package/package.json +1 -1
package/dist/pino.cjs
CHANGED
|
@@ -81,7 +81,12 @@ function createLogger(options = {}) {
|
|
|
81
81
|
...baseOptions,
|
|
82
82
|
...options.level && { level: options.level },
|
|
83
83
|
...redact && { redact },
|
|
84
|
+
...redact && { hooks: { logMethod(args, method) {
|
|
85
|
+
const redacted = args.map((arg) => typeof arg === "string" ? require_redact_paths.redactUrlCredentials(arg) : arg);
|
|
86
|
+
return method.apply(this, redacted);
|
|
87
|
+
} } },
|
|
84
88
|
formatters: {
|
|
89
|
+
...redact && { log: (object) => require_redact_paths.redactUrlCredentialsIn(object) },
|
|
85
90
|
bindings() {
|
|
86
91
|
return { nodeVersion: process.version };
|
|
87
92
|
},
|
package/dist/pino.cjs.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pino.cjs","names":["DEFAULT_REDACT_PATHS"],"sources":["../src/pino.ts"],"sourcesContent":["/**\n * Pino logger with built-in redaction support for sensitive data.\n *\n * Redaction is on by default: a logger that was never told about passwords\n * and tokens still masks them. `redact: false` is the explicit opt-out.\n *\n * @example\n * ```typescript\n * import { createLogger, DEFAULT_REDACT_PATHS } from '@geekmidas/logger/pino';\n *\n * // Redaction with sensible defaults — the same as `redact: true`\n * const logger = createLogger();\n *\n * // Sensitive data is automatically masked\n * logger.info({ password: 'secret123', user: 'john' }, 'Login');\n * // Output: { password: '[Redacted]', user: 'john' } Login\n *\n * // Add custom paths (merged with defaults)\n * const logger2 = createLogger({ redact: ['user.ssn'] });\n *\n * // Override defaults for full control\n * const logger3 = createLogger({\n * redact: {\n * paths: ['onlyThis'],\n * resolution: 'override',\n * }\n * });\n * ```\n *\n * @module\n */\nimport { pino } from 'pino';\nimport {
|
|
1
|
+
{"version":3,"file":"pino.cjs","names":["DEFAULT_REDACT_PATHS","redactUrlCredentials","redactUrlCredentialsIn"],"sources":["../src/pino.ts"],"sourcesContent":["/**\n * Pino logger with built-in redaction support for sensitive data.\n *\n * Redaction is on by default: a logger that was never told about passwords\n * and tokens still masks them. `redact: false` is the explicit opt-out.\n *\n * @example\n * ```typescript\n * import { createLogger, DEFAULT_REDACT_PATHS } from '@geekmidas/logger/pino';\n *\n * // Redaction with sensible defaults — the same as `redact: true`\n * const logger = createLogger();\n *\n * // Sensitive data is automatically masked\n * logger.info({ password: 'secret123', user: 'john' }, 'Login');\n * // Output: { password: '[Redacted]', user: 'john' } Login\n *\n * // Add custom paths (merged with defaults)\n * const logger2 = createLogger({ redact: ['user.ssn'] });\n *\n * // Override defaults for full control\n * const logger3 = createLogger({\n * redact: {\n * paths: ['onlyThis'],\n * resolution: 'override',\n * }\n * });\n * ```\n *\n * @module\n */\nimport { type LogFn, type Logger, pino } from 'pino';\nimport {\n\tDEFAULT_REDACT_PATHS,\n\tredactUrlCredentials,\n\tredactUrlCredentialsIn,\n} from './redact-paths';\nimport type { CreateLoggerOptions, RedactOptions } from './types';\n\n// Re-export for backwards compatibility\nexport { DEFAULT_REDACT_PATHS } from './redact-paths';\n\n/**\n * Type for the resolved pino redact config (without our custom resolution field).\n */\ntype PinoRedactConfig =\n\t| string[]\n\t| {\n\t\t\tpaths: string[];\n\t\t\tcensor?: string | ((value: unknown, path: string[]) => unknown);\n\t\t\tremove?: boolean;\n\t };\n\n/**\n * Resolves redaction configuration from options.\n * Returns undefined only when redaction is turned off with `false`; leaving it\n * unset is the same as `true`, so sensitive paths are masked unless someone\n * decides they should not be.\n *\n * By default (resolution: 'merge'), custom paths are merged with DEFAULT_REDACT_PATHS.\n * With resolution: 'override', only the custom paths are used.\n */\nfunction resolveRedactConfig(\n\tredact: boolean | RedactOptions | undefined,\n): PinoRedactConfig | undefined {\n\tif (redact === false) {\n\t\treturn undefined;\n\t}\n\n\tif (redact === undefined || redact === true) {\n\t\treturn DEFAULT_REDACT_PATHS;\n\t}\n\n\t// Array syntax - merge with defaults\n\tif (Array.isArray(redact)) {\n\t\treturn [...DEFAULT_REDACT_PATHS, ...redact];\n\t}\n\n\t// Object syntax - check resolution mode\n\tconst { resolution = 'merge', paths, censor, remove } = redact;\n\n\tconst resolvedPaths =\n\t\tresolution === 'override' ? paths : [...DEFAULT_REDACT_PATHS, ...paths];\n\n\t// Return clean pino config without our resolution field\n\tconst config: PinoRedactConfig = { paths: resolvedPaths };\n\tif (censor !== undefined) config.censor = censor;\n\tif (remove !== undefined) config.remove = remove;\n\n\treturn config;\n}\n\n/**\n * Creates a pino logger instance with optional redaction support.\n *\n * @param options - Logger configuration options\n * @returns A configured pino logger instance\n *\n * @example\n * ```typescript\n * // Basic logger — sensitive paths are redacted by default\n * const logger = createLogger({ level: 'debug' });\n *\n * // Opt out of redaction\n * const rawLogger = createLogger({ redact: false });\n *\n * // Pretty printing in development\n * const devLogger = createLogger({ pretty: true });\n * ```\n */\nexport function createLogger(options: CreateLoggerOptions = {}) {\n\t// Pretty printing spawns a transport worker and writes for humans; in\n\t// production the output is for a log pipeline, so `pretty` is ignored there.\n\tconst pretty = options?.pretty && process.env.NODE_ENV !== 'production';\n\tconst baseOptions = pretty\n\t\t? {\n\t\t\t\ttransport: {\n\t\t\t\t\ttarget: 'pino-pretty',\n\t\t\t\t\toptions: { colorize: true },\n\t\t\t\t},\n\t\t\t}\n\t\t: {};\n\n\tconst redact = resolveRedactConfig(options.redact);\n\n\tconst pinoOptions = {\n\t\t...baseOptions,\n\t\t...(options.level && { level: options.level }),\n\t\t...(redact && { redact }),\n\t\t// Redaction also masks the credentials of any URL, in any field or in\n\t\t// the message: `s3://KEY:SECRET@uploads` is logged with its secret\n\t\t// under a name no path list can predict.\n\t\t...(redact && {\n\t\t\thooks: {\n\t\t\t\tlogMethod(this: Logger, args: Parameters<LogFn>, method: LogFn) {\n\t\t\t\t\tconst redacted = args.map((arg) =>\n\t\t\t\t\t\ttypeof arg === 'string' ? redactUrlCredentials(arg) : arg,\n\t\t\t\t\t) as Parameters<LogFn>;\n\t\t\t\t\treturn method.apply(this, redacted);\n\t\t\t\t},\n\t\t\t},\n\t\t}),\n\t\tformatters: {\n\t\t\t...(redact && {\n\t\t\t\tlog: (object: Record<string, unknown>) =>\n\t\t\t\t\tredactUrlCredentialsIn(object),\n\t\t\t}),\n\t\t\tbindings() {\n\t\t\t\treturn { nodeVersion: process.version };\n\t\t\t},\n\t\t\tlevel: (label: string) => {\n\t\t\t\treturn { level: label.toUpperCase() };\n\t\t\t},\n\t\t},\n\t};\n\n\t// A transport writes on its own worker, so a destination only applies when\n\t// the logger is not pretty-printing.\n\treturn options.destination && !pretty\n\t\t? pino(pinoOptions, options.destination)\n\t\t: pino(pinoOptions);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8DA,SAAS,oBACR,QAC+B;CAC/B,IAAI,WAAW,OACd;CAGD,IAAI,WAAW,KAAA,KAAa,WAAW,MACtC,OAAOA,qBAAAA;CAIR,IAAI,MAAM,QAAQ,MAAM,GACvB,OAAO,CAAC,GAAGA,qBAAAA,sBAAsB,GAAG,MAAM;CAI3C,MAAM,EAAE,aAAa,SAAS,OAAO,QAAQ,WAAW;CAMxD,MAAM,SAA2B,EAAE,OAHlC,eAAe,aAAa,QAAQ,CAAC,GAAGA,qBAAAA,sBAAsB,GAAG,KAAK,EAGf;CACxD,IAAI,WAAW,KAAA,GAAW,OAAO,SAAS;CAC1C,IAAI,WAAW,KAAA,GAAW,OAAO,SAAS;CAE1C,OAAO;AACR;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,aAAa,UAA+B,CAAC,GAAG;CAG/D,MAAM,SAAS,SAAS,UAAU,QAAQ,IAAI,aAAa;CAC3D,MAAM,cAAc,SACjB,EACA,WAAW;EACV,QAAQ;EACR,SAAS,EAAE,UAAU,KAAK;CAC3B,EACD,IACC,CAAC;CAEJ,MAAM,SAAS,oBAAoB,QAAQ,MAAM;CAEjD,MAAM,cAAc;EACnB,GAAG;EACH,GAAI,QAAQ,SAAS,EAAE,OAAO,QAAQ,MAAM;EAC5C,GAAI,UAAU,EAAE,OAAO;EAIvB,GAAI,UAAU,EACb,OAAO,EACN,UAAwB,MAAyB,QAAe;GAC/D,MAAM,WAAW,KAAK,KAAK,QAC1B,OAAO,QAAQ,WAAWC,qBAAAA,qBAAqB,GAAG,IAAI,GACvD;GACA,OAAO,OAAO,MAAM,MAAM,QAAQ;EACnC,EACD,EACD;EACA,YAAY;GACX,GAAI,UAAU,EACb,MAAM,WACLC,qBAAAA,uBAAuB,MAAM,EAC/B;GACA,WAAW;IACV,OAAO,EAAE,aAAa,QAAQ,QAAQ;GACvC;GACA,QAAQ,UAAkB;IACzB,OAAO,EAAE,OAAO,MAAM,YAAY,EAAE;GACrC;EACD;CACD;CAIA,OAAO,QAAQ,eAAe,CAAC,UAAA,GAC5B,KAAA,KAAA,CAAK,aAAa,QAAQ,WAAW,KAAA,GACrC,KAAA,KAAA,CAAK,WAAW;AACpB"}
|
package/dist/pino.d.cts
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { CreateLoggerOptions } from "./types.cjs";
|
|
2
2
|
import { DEFAULT_REDACT_PATHS } from "./redact-paths.cjs";
|
|
3
|
+
import { Logger } from "pino";
|
|
3
4
|
//#region src/pino.d.ts
|
|
4
5
|
/**
|
|
5
6
|
* Creates a pino logger instance with optional redaction support.
|
|
@@ -19,7 +20,7 @@ import { DEFAULT_REDACT_PATHS } from "./redact-paths.cjs";
|
|
|
19
20
|
* const devLogger = createLogger({ pretty: true });
|
|
20
21
|
* ```
|
|
21
22
|
*/
|
|
22
|
-
export declare function createLogger(options?: CreateLoggerOptions):
|
|
23
|
+
export declare function createLogger(options?: CreateLoggerOptions): Logger<never, boolean>;
|
|
23
24
|
//#endregion
|
|
24
25
|
export { DEFAULT_REDACT_PATHS };
|
|
25
26
|
//# sourceMappingURL=pino.d.cts.map
|
package/dist/pino.d.cts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pino.d.cts","names":[],"sources":["../src/pino.ts"],"mappings":"
|
|
1
|
+
{"version":3,"file":"pino.d.cts","names":[],"sources":["../src/pino.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;wBA8GgB,aAAa,UAAS,sBAAwB"}
|
package/dist/pino.d.mts
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { CreateLoggerOptions } from "./types.mjs";
|
|
2
2
|
import { DEFAULT_REDACT_PATHS } from "./redact-paths.mjs";
|
|
3
|
+
import { Logger } from "pino";
|
|
3
4
|
//#region src/pino.d.ts
|
|
4
5
|
/**
|
|
5
6
|
* Creates a pino logger instance with optional redaction support.
|
|
@@ -19,7 +20,7 @@ import { DEFAULT_REDACT_PATHS } from "./redact-paths.mjs";
|
|
|
19
20
|
* const devLogger = createLogger({ pretty: true });
|
|
20
21
|
* ```
|
|
21
22
|
*/
|
|
22
|
-
export declare function createLogger(options?: CreateLoggerOptions):
|
|
23
|
+
export declare function createLogger(options?: CreateLoggerOptions): Logger<never, boolean>;
|
|
23
24
|
//#endregion
|
|
24
25
|
export { DEFAULT_REDACT_PATHS };
|
|
25
26
|
//# sourceMappingURL=pino.d.mts.map
|
package/dist/pino.d.mts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pino.d.mts","names":[],"sources":["../src/pino.ts"],"mappings":"
|
|
1
|
+
{"version":3,"file":"pino.d.mts","names":[],"sources":["../src/pino.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;wBA8GgB,aAAa,UAAS,sBAAwB"}
|
package/dist/pino.mjs
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { DEFAULT_REDACT_PATHS } from "./redact-paths.mjs";
|
|
1
|
+
import { DEFAULT_REDACT_PATHS, redactUrlCredentials, redactUrlCredentialsIn } from "./redact-paths.mjs";
|
|
2
2
|
import { pino } from "pino";
|
|
3
3
|
//#region src/pino.ts
|
|
4
4
|
/**
|
|
@@ -80,7 +80,12 @@ function createLogger(options = {}) {
|
|
|
80
80
|
...baseOptions,
|
|
81
81
|
...options.level && { level: options.level },
|
|
82
82
|
...redact && { redact },
|
|
83
|
+
...redact && { hooks: { logMethod(args, method) {
|
|
84
|
+
const redacted = args.map((arg) => typeof arg === "string" ? redactUrlCredentials(arg) : arg);
|
|
85
|
+
return method.apply(this, redacted);
|
|
86
|
+
} } },
|
|
83
87
|
formatters: {
|
|
88
|
+
...redact && { log: (object) => redactUrlCredentialsIn(object) },
|
|
84
89
|
bindings() {
|
|
85
90
|
return { nodeVersion: process.version };
|
|
86
91
|
},
|
package/dist/pino.mjs.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pino.mjs","names":[],"sources":["../src/pino.ts"],"sourcesContent":["/**\n * Pino logger with built-in redaction support for sensitive data.\n *\n * Redaction is on by default: a logger that was never told about passwords\n * and tokens still masks them. `redact: false` is the explicit opt-out.\n *\n * @example\n * ```typescript\n * import { createLogger, DEFAULT_REDACT_PATHS } from '@geekmidas/logger/pino';\n *\n * // Redaction with sensible defaults — the same as `redact: true`\n * const logger = createLogger();\n *\n * // Sensitive data is automatically masked\n * logger.info({ password: 'secret123', user: 'john' }, 'Login');\n * // Output: { password: '[Redacted]', user: 'john' } Login\n *\n * // Add custom paths (merged with defaults)\n * const logger2 = createLogger({ redact: ['user.ssn'] });\n *\n * // Override defaults for full control\n * const logger3 = createLogger({\n * redact: {\n * paths: ['onlyThis'],\n * resolution: 'override',\n * }\n * });\n * ```\n *\n * @module\n */\nimport { pino } from 'pino';\nimport {
|
|
1
|
+
{"version":3,"file":"pino.mjs","names":[],"sources":["../src/pino.ts"],"sourcesContent":["/**\n * Pino logger with built-in redaction support for sensitive data.\n *\n * Redaction is on by default: a logger that was never told about passwords\n * and tokens still masks them. `redact: false` is the explicit opt-out.\n *\n * @example\n * ```typescript\n * import { createLogger, DEFAULT_REDACT_PATHS } from '@geekmidas/logger/pino';\n *\n * // Redaction with sensible defaults — the same as `redact: true`\n * const logger = createLogger();\n *\n * // Sensitive data is automatically masked\n * logger.info({ password: 'secret123', user: 'john' }, 'Login');\n * // Output: { password: '[Redacted]', user: 'john' } Login\n *\n * // Add custom paths (merged with defaults)\n * const logger2 = createLogger({ redact: ['user.ssn'] });\n *\n * // Override defaults for full control\n * const logger3 = createLogger({\n * redact: {\n * paths: ['onlyThis'],\n * resolution: 'override',\n * }\n * });\n * ```\n *\n * @module\n */\nimport { type LogFn, type Logger, pino } from 'pino';\nimport {\n\tDEFAULT_REDACT_PATHS,\n\tredactUrlCredentials,\n\tredactUrlCredentialsIn,\n} from './redact-paths';\nimport type { CreateLoggerOptions, RedactOptions } from './types';\n\n// Re-export for backwards compatibility\nexport { DEFAULT_REDACT_PATHS } from './redact-paths';\n\n/**\n * Type for the resolved pino redact config (without our custom resolution field).\n */\ntype PinoRedactConfig =\n\t| string[]\n\t| {\n\t\t\tpaths: string[];\n\t\t\tcensor?: string | ((value: unknown, path: string[]) => unknown);\n\t\t\tremove?: boolean;\n\t };\n\n/**\n * Resolves redaction configuration from options.\n * Returns undefined only when redaction is turned off with `false`; leaving it\n * unset is the same as `true`, so sensitive paths are masked unless someone\n * decides they should not be.\n *\n * By default (resolution: 'merge'), custom paths are merged with DEFAULT_REDACT_PATHS.\n * With resolution: 'override', only the custom paths are used.\n */\nfunction resolveRedactConfig(\n\tredact: boolean | RedactOptions | undefined,\n): PinoRedactConfig | undefined {\n\tif (redact === false) {\n\t\treturn undefined;\n\t}\n\n\tif (redact === undefined || redact === true) {\n\t\treturn DEFAULT_REDACT_PATHS;\n\t}\n\n\t// Array syntax - merge with defaults\n\tif (Array.isArray(redact)) {\n\t\treturn [...DEFAULT_REDACT_PATHS, ...redact];\n\t}\n\n\t// Object syntax - check resolution mode\n\tconst { resolution = 'merge', paths, censor, remove } = redact;\n\n\tconst resolvedPaths =\n\t\tresolution === 'override' ? paths : [...DEFAULT_REDACT_PATHS, ...paths];\n\n\t// Return clean pino config without our resolution field\n\tconst config: PinoRedactConfig = { paths: resolvedPaths };\n\tif (censor !== undefined) config.censor = censor;\n\tif (remove !== undefined) config.remove = remove;\n\n\treturn config;\n}\n\n/**\n * Creates a pino logger instance with optional redaction support.\n *\n * @param options - Logger configuration options\n * @returns A configured pino logger instance\n *\n * @example\n * ```typescript\n * // Basic logger — sensitive paths are redacted by default\n * const logger = createLogger({ level: 'debug' });\n *\n * // Opt out of redaction\n * const rawLogger = createLogger({ redact: false });\n *\n * // Pretty printing in development\n * const devLogger = createLogger({ pretty: true });\n * ```\n */\nexport function createLogger(options: CreateLoggerOptions = {}) {\n\t// Pretty printing spawns a transport worker and writes for humans; in\n\t// production the output is for a log pipeline, so `pretty` is ignored there.\n\tconst pretty = options?.pretty && process.env.NODE_ENV !== 'production';\n\tconst baseOptions = pretty\n\t\t? {\n\t\t\t\ttransport: {\n\t\t\t\t\ttarget: 'pino-pretty',\n\t\t\t\t\toptions: { colorize: true },\n\t\t\t\t},\n\t\t\t}\n\t\t: {};\n\n\tconst redact = resolveRedactConfig(options.redact);\n\n\tconst pinoOptions = {\n\t\t...baseOptions,\n\t\t...(options.level && { level: options.level }),\n\t\t...(redact && { redact }),\n\t\t// Redaction also masks the credentials of any URL, in any field or in\n\t\t// the message: `s3://KEY:SECRET@uploads` is logged with its secret\n\t\t// under a name no path list can predict.\n\t\t...(redact && {\n\t\t\thooks: {\n\t\t\t\tlogMethod(this: Logger, args: Parameters<LogFn>, method: LogFn) {\n\t\t\t\t\tconst redacted = args.map((arg) =>\n\t\t\t\t\t\ttypeof arg === 'string' ? redactUrlCredentials(arg) : arg,\n\t\t\t\t\t) as Parameters<LogFn>;\n\t\t\t\t\treturn method.apply(this, redacted);\n\t\t\t\t},\n\t\t\t},\n\t\t}),\n\t\tformatters: {\n\t\t\t...(redact && {\n\t\t\t\tlog: (object: Record<string, unknown>) =>\n\t\t\t\t\tredactUrlCredentialsIn(object),\n\t\t\t}),\n\t\t\tbindings() {\n\t\t\t\treturn { nodeVersion: process.version };\n\t\t\t},\n\t\t\tlevel: (label: string) => {\n\t\t\t\treturn { level: label.toUpperCase() };\n\t\t\t},\n\t\t},\n\t};\n\n\t// A transport writes on its own worker, so a destination only applies when\n\t// the logger is not pretty-printing.\n\treturn options.destination && !pretty\n\t\t? pino(pinoOptions, options.destination)\n\t\t: pino(pinoOptions);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8DA,SAAS,oBACR,QAC+B;CAC/B,IAAI,WAAW,OACd;CAGD,IAAI,WAAW,KAAA,KAAa,WAAW,MACtC,OAAO;CAIR,IAAI,MAAM,QAAQ,MAAM,GACvB,OAAO,CAAC,GAAG,sBAAsB,GAAG,MAAM;CAI3C,MAAM,EAAE,aAAa,SAAS,OAAO,QAAQ,WAAW;CAMxD,MAAM,SAA2B,EAAE,OAHlC,eAAe,aAAa,QAAQ,CAAC,GAAG,sBAAsB,GAAG,KAAK,EAGf;CACxD,IAAI,WAAW,KAAA,GAAW,OAAO,SAAS;CAC1C,IAAI,WAAW,KAAA,GAAW,OAAO,SAAS;CAE1C,OAAO;AACR;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,aAAa,UAA+B,CAAC,GAAG;CAG/D,MAAM,SAAS,SAAS,UAAU,QAAQ,IAAI,aAAa;CAC3D,MAAM,cAAc,SACjB,EACA,WAAW;EACV,QAAQ;EACR,SAAS,EAAE,UAAU,KAAK;CAC3B,EACD,IACC,CAAC;CAEJ,MAAM,SAAS,oBAAoB,QAAQ,MAAM;CAEjD,MAAM,cAAc;EACnB,GAAG;EACH,GAAI,QAAQ,SAAS,EAAE,OAAO,QAAQ,MAAM;EAC5C,GAAI,UAAU,EAAE,OAAO;EAIvB,GAAI,UAAU,EACb,OAAO,EACN,UAAwB,MAAyB,QAAe;GAC/D,MAAM,WAAW,KAAK,KAAK,QAC1B,OAAO,QAAQ,WAAW,qBAAqB,GAAG,IAAI,GACvD;GACA,OAAO,OAAO,MAAM,MAAM,QAAQ;EACnC,EACD,EACD;EACA,YAAY;GACX,GAAI,UAAU,EACb,MAAM,WACL,uBAAuB,MAAM,EAC/B;GACA,WAAW;IACV,OAAO,EAAE,aAAa,QAAQ,QAAQ;GACvC;GACA,QAAQ,UAAkB;IACzB,OAAO,EAAE,OAAO,MAAM,YAAY,EAAE;GACrC;EACD;CACD;CAIA,OAAO,QAAQ,eAAe,CAAC,SAC5B,KAAK,aAAa,QAAQ,WAAW,IACrC,KAAK,WAAW;AACpB"}
|
package/dist/redact-paths.cjs
CHANGED
|
@@ -62,7 +62,56 @@ const DEFAULT_REDACT_PATHS = [
|
|
|
62
62
|
"databaseUrl",
|
|
63
63
|
"database_url"
|
|
64
64
|
];
|
|
65
|
+
/**
|
|
66
|
+
* `scheme://user:password@` — the userinfo of a URL that carries a secret.
|
|
67
|
+
* A user with no password (`ssh://git@host`) names nobody's secret and is left
|
|
68
|
+
* alone.
|
|
69
|
+
*/
|
|
70
|
+
const URL_CREDENTIALS = /\b([a-z][a-z0-9+.-]*:\/\/)[^\s/?#@:]*:[^\s/?#@]*@/gi;
|
|
71
|
+
/**
|
|
72
|
+
* Replace the credentials of every URL in `text` with `REDACTED`, so
|
|
73
|
+
* `s3://KEY:SECRET@uploads` is logged as `s3://REDACTED@uploads`.
|
|
74
|
+
*
|
|
75
|
+
* Path redaction cannot catch these: a URL turns up under any field name —
|
|
76
|
+
* `url`, `origin`, `endpoint` — or inside a message, and blanking every such
|
|
77
|
+
* field would hide the half of it that is useful.
|
|
78
|
+
*/
|
|
79
|
+
function redactUrlCredentials(text) {
|
|
80
|
+
return text.replace(URL_CREDENTIALS, "$1REDACTED@");
|
|
81
|
+
}
|
|
82
|
+
/** Deep enough for a log object; past it, values are logged as they are. */
|
|
83
|
+
const MAX_DEPTH = 6;
|
|
84
|
+
/**
|
|
85
|
+
* A copy of `value` with {@link redactUrlCredentials} applied to every string
|
|
86
|
+
* in it. Objects and arrays without such a string are returned as they were.
|
|
87
|
+
*/
|
|
88
|
+
function redactUrlCredentialsIn(value, depth = 0) {
|
|
89
|
+
if (typeof value === "string") return redactUrlCredentials(value);
|
|
90
|
+
if (depth >= MAX_DEPTH || value === null || typeof value !== "object") return value;
|
|
91
|
+
if (Array.isArray(value)) {
|
|
92
|
+
let changed = false;
|
|
93
|
+
const next = value.map((item) => {
|
|
94
|
+
const redacted = redactUrlCredentialsIn(item, depth + 1);
|
|
95
|
+
if (redacted !== item) changed = true;
|
|
96
|
+
return redacted;
|
|
97
|
+
});
|
|
98
|
+
return changed ? next : value;
|
|
99
|
+
}
|
|
100
|
+
const proto = Object.getPrototypeOf(value);
|
|
101
|
+
if (proto !== Object.prototype && proto !== null) return value;
|
|
102
|
+
let next;
|
|
103
|
+
for (const [key, item] of Object.entries(value)) {
|
|
104
|
+
const redacted = redactUrlCredentialsIn(item, depth + 1);
|
|
105
|
+
if (redacted !== item) {
|
|
106
|
+
next ??= { ...value };
|
|
107
|
+
next[key] = redacted;
|
|
108
|
+
}
|
|
109
|
+
}
|
|
110
|
+
return next ?? value;
|
|
111
|
+
}
|
|
65
112
|
//#endregion
|
|
66
113
|
exports.DEFAULT_REDACT_PATHS = DEFAULT_REDACT_PATHS;
|
|
114
|
+
exports.redactUrlCredentials = redactUrlCredentials;
|
|
115
|
+
exports.redactUrlCredentialsIn = redactUrlCredentialsIn;
|
|
67
116
|
|
|
68
117
|
//# sourceMappingURL=redact-paths.cjs.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"redact-paths.cjs","names":[],"sources":["../src/redact-paths.ts"],"sourcesContent":["/**\n * Default sensitive field paths for redaction.\n *\n * These paths are automatically used when `redact: true` is set,\n * and merged with custom paths unless `resolution: 'override'` is specified.\n *\n * Includes:\n * - Authentication: password, token, apiKey, authorization, credentials\n * - Headers: authorization, cookie, x-api-key, x-auth-token\n * - Personal data: ssn, creditCard, cvv, pin\n * - Secrets: secret, connectionString, databaseUrl\n * - Wildcards: *.password, *.secret, *.token (catches nested fields)\n */\nexport const DEFAULT_REDACT_PATHS: string[] = [\n\t// Authentication & authorization\n\t'password',\n\t'pass',\n\t'passwd',\n\t'secret',\n\t'token',\n\t'accessToken',\n\t'refreshToken',\n\t'idToken',\n\t'apiKey',\n\t'api_key',\n\t'apikey',\n\t'auth',\n\t'authorization',\n\t'credential',\n\t'credentials',\n\n\t// Common nested patterns (headers, body, etc.)\n\t'*.password',\n\t'*.secret',\n\t'*.token',\n\t'*.apiKey',\n\t'*.api_key',\n\t'*.authorization',\n\t'*.accessToken',\n\t'*.refreshToken',\n\n\t// HTTP headers (case variations)\n\t'headers.authorization',\n\t'headers.Authorization',\n\t'headers[\"authorization\"]',\n\t'headers[\"Authorization\"]',\n\t'headers.cookie',\n\t'headers.Cookie',\n\t'headers[\"x-api-key\"]',\n\t'headers[\"X-Api-Key\"]',\n\t'headers[\"x-auth-token\"]',\n\t'headers[\"X-Auth-Token\"]',\n\n\t// Common sensitive data fields\n\t'ssn',\n\t'socialSecurityNumber',\n\t'social_security_number',\n\t'creditCard',\n\t'credit_card',\n\t'cardNumber',\n\t'card_number',\n\t'cvv',\n\t'cvc',\n\t'pin',\n\n\t// Database & connection strings\n\t'connectionString',\n\t'connection_string',\n\t'databaseUrl',\n\t'database_url',\n];\n"],"mappings":";;;;;;;;;;;;;;;AAaA,MAAa,uBAAiC;CAE7C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;AACD"}
|
|
1
|
+
{"version":3,"file":"redact-paths.cjs","names":[],"sources":["../src/redact-paths.ts"],"sourcesContent":["/**\n * Default sensitive field paths for redaction.\n *\n * These paths are automatically used when `redact: true` is set,\n * and merged with custom paths unless `resolution: 'override'` is specified.\n *\n * Includes:\n * - Authentication: password, token, apiKey, authorization, credentials\n * - Headers: authorization, cookie, x-api-key, x-auth-token\n * - Personal data: ssn, creditCard, cvv, pin\n * - Secrets: secret, connectionString, databaseUrl\n * - Wildcards: *.password, *.secret, *.token (catches nested fields)\n */\nexport const DEFAULT_REDACT_PATHS: string[] = [\n\t// Authentication & authorization\n\t'password',\n\t'pass',\n\t'passwd',\n\t'secret',\n\t'token',\n\t'accessToken',\n\t'refreshToken',\n\t'idToken',\n\t'apiKey',\n\t'api_key',\n\t'apikey',\n\t'auth',\n\t'authorization',\n\t'credential',\n\t'credentials',\n\n\t// Common nested patterns (headers, body, etc.)\n\t'*.password',\n\t'*.secret',\n\t'*.token',\n\t'*.apiKey',\n\t'*.api_key',\n\t'*.authorization',\n\t'*.accessToken',\n\t'*.refreshToken',\n\n\t// HTTP headers (case variations)\n\t'headers.authorization',\n\t'headers.Authorization',\n\t'headers[\"authorization\"]',\n\t'headers[\"Authorization\"]',\n\t'headers.cookie',\n\t'headers.Cookie',\n\t'headers[\"x-api-key\"]',\n\t'headers[\"X-Api-Key\"]',\n\t'headers[\"x-auth-token\"]',\n\t'headers[\"X-Auth-Token\"]',\n\n\t// Common sensitive data fields\n\t'ssn',\n\t'socialSecurityNumber',\n\t'social_security_number',\n\t'creditCard',\n\t'credit_card',\n\t'cardNumber',\n\t'card_number',\n\t'cvv',\n\t'cvc',\n\t'pin',\n\n\t// Database & connection strings\n\t'connectionString',\n\t'connection_string',\n\t'databaseUrl',\n\t'database_url',\n];\n\n/**\n * `scheme://user:password@` — the userinfo of a URL that carries a secret.\n * A user with no password (`ssh://git@host`) names nobody's secret and is left\n * alone.\n */\nconst URL_CREDENTIALS = /\\b([a-z][a-z0-9+.-]*:\\/\\/)[^\\s/?#@:]*:[^\\s/?#@]*@/gi;\n\n/**\n * Replace the credentials of every URL in `text` with `REDACTED`, so\n * `s3://KEY:SECRET@uploads` is logged as `s3://REDACTED@uploads`.\n *\n * Path redaction cannot catch these: a URL turns up under any field name —\n * `url`, `origin`, `endpoint` — or inside a message, and blanking every such\n * field would hide the half of it that is useful.\n */\nexport function redactUrlCredentials(text: string): string {\n\treturn text.replace(URL_CREDENTIALS, '$1REDACTED@');\n}\n\n/** Deep enough for a log object; past it, values are logged as they are. */\nconst MAX_DEPTH = 6;\n\n/**\n * A copy of `value` with {@link redactUrlCredentials} applied to every string\n * in it. Objects and arrays without such a string are returned as they were.\n */\nexport function redactUrlCredentialsIn<T>(value: T, depth = 0): T {\n\tif (typeof value === 'string') {\n\t\treturn redactUrlCredentials(value) as T;\n\t}\n\tif (depth >= MAX_DEPTH || value === null || typeof value !== 'object') {\n\t\treturn value;\n\t}\n\tif (Array.isArray(value)) {\n\t\tlet changed = false;\n\t\tconst next = value.map((item) => {\n\t\t\tconst redacted = redactUrlCredentialsIn(item, depth + 1);\n\t\t\tif (redacted !== item) changed = true;\n\t\t\treturn redacted;\n\t\t});\n\t\treturn (changed ? next : value) as T;\n\t}\n\tconst proto = Object.getPrototypeOf(value);\n\tif (proto !== Object.prototype && proto !== null) return value;\n\n\tlet next: Record<string, unknown> | undefined;\n\tfor (const [key, item] of Object.entries(value)) {\n\t\tconst redacted = redactUrlCredentialsIn(item, depth + 1);\n\t\tif (redacted !== item) {\n\t\t\tnext ??= { ...(value as Record<string, unknown>) };\n\t\t\tnext[key] = redacted;\n\t\t}\n\t}\n\treturn (next ?? value) as T;\n}\n"],"mappings":";;;;;;;;;;;;;;;AAaA,MAAa,uBAAiC;CAE7C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;AACD;;;;;;AAOA,MAAM,kBAAkB;;;;;;;;;AAUxB,SAAgB,qBAAqB,MAAsB;CAC1D,OAAO,KAAK,QAAQ,iBAAiB,aAAa;AACnD;;AAGA,MAAM,YAAY;;;;;AAMlB,SAAgB,uBAA0B,OAAU,QAAQ,GAAM;CACjE,IAAI,OAAO,UAAU,UACpB,OAAO,qBAAqB,KAAK;CAElC,IAAI,SAAS,aAAa,UAAU,QAAQ,OAAO,UAAU,UAC5D,OAAO;CAER,IAAI,MAAM,QAAQ,KAAK,GAAG;EACzB,IAAI,UAAU;EACd,MAAM,OAAO,MAAM,KAAK,SAAS;GAChC,MAAM,WAAW,uBAAuB,MAAM,QAAQ,CAAC;GACvD,IAAI,aAAa,MAAM,UAAU;GACjC,OAAO;EACR,CAAC;EACD,OAAQ,UAAU,OAAO;CAC1B;CACA,MAAM,QAAQ,OAAO,eAAe,KAAK;CACzC,IAAI,UAAU,OAAO,aAAa,UAAU,MAAM,OAAO;CAEzD,IAAI;CACJ,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,KAAK,GAAG;EAChD,MAAM,WAAW,uBAAuB,MAAM,QAAQ,CAAC;EACvD,IAAI,aAAa,MAAM;GACtB,SAAS,EAAE,GAAI,MAAkC;GACjD,KAAK,OAAO;EACb;CACD;CACA,OAAQ,QAAQ;AACjB"}
|
package/dist/redact-paths.d.cts
CHANGED
|
@@ -13,5 +13,19 @@
|
|
|
13
13
|
* - Wildcards: *.password, *.secret, *.token (catches nested fields)
|
|
14
14
|
*/
|
|
15
15
|
export declare const DEFAULT_REDACT_PATHS: string[];
|
|
16
|
+
/**
|
|
17
|
+
* Replace the credentials of every URL in `text` with `REDACTED`, so
|
|
18
|
+
* `s3://KEY:SECRET@uploads` is logged as `s3://REDACTED@uploads`.
|
|
19
|
+
*
|
|
20
|
+
* Path redaction cannot catch these: a URL turns up under any field name —
|
|
21
|
+
* `url`, `origin`, `endpoint` — or inside a message, and blanking every such
|
|
22
|
+
* field would hide the half of it that is useful.
|
|
23
|
+
*/
|
|
24
|
+
export declare function redactUrlCredentials(text: string): string;
|
|
25
|
+
/**
|
|
26
|
+
* A copy of `value` with {@link redactUrlCredentials} applied to every string
|
|
27
|
+
* in it. Objects and arrays without such a string are returned as they were.
|
|
28
|
+
*/
|
|
29
|
+
export declare function redactUrlCredentialsIn<T>(value: T, depth?: number): T;
|
|
16
30
|
//#endregion
|
|
17
31
|
//# sourceMappingURL=redact-paths.d.cts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"redact-paths.d.cts","names":[],"sources":["../src/redact-paths.ts"],"mappings":";;;;;;;;;;;;;;qBAaa"}
|
|
1
|
+
{"version":3,"file":"redact-paths.d.cts","names":[],"sources":["../src/redact-paths.ts"],"mappings":";;;;;;;;;;;;;;qBAaa;;;;;;;;;wBA0EG,qBAAqB;;;;;wBAWrB,uBAAuB,GAAG,OAAO,GAAG,iBAAY"}
|
package/dist/redact-paths.d.mts
CHANGED
|
@@ -13,5 +13,19 @@
|
|
|
13
13
|
* - Wildcards: *.password, *.secret, *.token (catches nested fields)
|
|
14
14
|
*/
|
|
15
15
|
export declare const DEFAULT_REDACT_PATHS: string[];
|
|
16
|
+
/**
|
|
17
|
+
* Replace the credentials of every URL in `text` with `REDACTED`, so
|
|
18
|
+
* `s3://KEY:SECRET@uploads` is logged as `s3://REDACTED@uploads`.
|
|
19
|
+
*
|
|
20
|
+
* Path redaction cannot catch these: a URL turns up under any field name —
|
|
21
|
+
* `url`, `origin`, `endpoint` — or inside a message, and blanking every such
|
|
22
|
+
* field would hide the half of it that is useful.
|
|
23
|
+
*/
|
|
24
|
+
export declare function redactUrlCredentials(text: string): string;
|
|
25
|
+
/**
|
|
26
|
+
* A copy of `value` with {@link redactUrlCredentials} applied to every string
|
|
27
|
+
* in it. Objects and arrays without such a string are returned as they were.
|
|
28
|
+
*/
|
|
29
|
+
export declare function redactUrlCredentialsIn<T>(value: T, depth?: number): T;
|
|
16
30
|
//#endregion
|
|
17
31
|
//# sourceMappingURL=redact-paths.d.mts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"redact-paths.d.mts","names":[],"sources":["../src/redact-paths.ts"],"mappings":";;;;;;;;;;;;;;qBAaa"}
|
|
1
|
+
{"version":3,"file":"redact-paths.d.mts","names":[],"sources":["../src/redact-paths.ts"],"mappings":";;;;;;;;;;;;;;qBAaa;;;;;;;;;wBA0EG,qBAAqB;;;;;wBAWrB,uBAAuB,GAAG,OAAO,GAAG,iBAAY"}
|
package/dist/redact-paths.mjs
CHANGED
|
@@ -61,7 +61,54 @@ const DEFAULT_REDACT_PATHS = [
|
|
|
61
61
|
"databaseUrl",
|
|
62
62
|
"database_url"
|
|
63
63
|
];
|
|
64
|
+
/**
|
|
65
|
+
* `scheme://user:password@` — the userinfo of a URL that carries a secret.
|
|
66
|
+
* A user with no password (`ssh://git@host`) names nobody's secret and is left
|
|
67
|
+
* alone.
|
|
68
|
+
*/
|
|
69
|
+
const URL_CREDENTIALS = /\b([a-z][a-z0-9+.-]*:\/\/)[^\s/?#@:]*:[^\s/?#@]*@/gi;
|
|
70
|
+
/**
|
|
71
|
+
* Replace the credentials of every URL in `text` with `REDACTED`, so
|
|
72
|
+
* `s3://KEY:SECRET@uploads` is logged as `s3://REDACTED@uploads`.
|
|
73
|
+
*
|
|
74
|
+
* Path redaction cannot catch these: a URL turns up under any field name —
|
|
75
|
+
* `url`, `origin`, `endpoint` — or inside a message, and blanking every such
|
|
76
|
+
* field would hide the half of it that is useful.
|
|
77
|
+
*/
|
|
78
|
+
function redactUrlCredentials(text) {
|
|
79
|
+
return text.replace(URL_CREDENTIALS, "$1REDACTED@");
|
|
80
|
+
}
|
|
81
|
+
/** Deep enough for a log object; past it, values are logged as they are. */
|
|
82
|
+
const MAX_DEPTH = 6;
|
|
83
|
+
/**
|
|
84
|
+
* A copy of `value` with {@link redactUrlCredentials} applied to every string
|
|
85
|
+
* in it. Objects and arrays without such a string are returned as they were.
|
|
86
|
+
*/
|
|
87
|
+
function redactUrlCredentialsIn(value, depth = 0) {
|
|
88
|
+
if (typeof value === "string") return redactUrlCredentials(value);
|
|
89
|
+
if (depth >= MAX_DEPTH || value === null || typeof value !== "object") return value;
|
|
90
|
+
if (Array.isArray(value)) {
|
|
91
|
+
let changed = false;
|
|
92
|
+
const next = value.map((item) => {
|
|
93
|
+
const redacted = redactUrlCredentialsIn(item, depth + 1);
|
|
94
|
+
if (redacted !== item) changed = true;
|
|
95
|
+
return redacted;
|
|
96
|
+
});
|
|
97
|
+
return changed ? next : value;
|
|
98
|
+
}
|
|
99
|
+
const proto = Object.getPrototypeOf(value);
|
|
100
|
+
if (proto !== Object.prototype && proto !== null) return value;
|
|
101
|
+
let next;
|
|
102
|
+
for (const [key, item] of Object.entries(value)) {
|
|
103
|
+
const redacted = redactUrlCredentialsIn(item, depth + 1);
|
|
104
|
+
if (redacted !== item) {
|
|
105
|
+
next ??= { ...value };
|
|
106
|
+
next[key] = redacted;
|
|
107
|
+
}
|
|
108
|
+
}
|
|
109
|
+
return next ?? value;
|
|
110
|
+
}
|
|
64
111
|
//#endregion
|
|
65
|
-
export { DEFAULT_REDACT_PATHS };
|
|
112
|
+
export { DEFAULT_REDACT_PATHS, redactUrlCredentials, redactUrlCredentialsIn };
|
|
66
113
|
|
|
67
114
|
//# sourceMappingURL=redact-paths.mjs.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"redact-paths.mjs","names":[],"sources":["../src/redact-paths.ts"],"sourcesContent":["/**\n * Default sensitive field paths for redaction.\n *\n * These paths are automatically used when `redact: true` is set,\n * and merged with custom paths unless `resolution: 'override'` is specified.\n *\n * Includes:\n * - Authentication: password, token, apiKey, authorization, credentials\n * - Headers: authorization, cookie, x-api-key, x-auth-token\n * - Personal data: ssn, creditCard, cvv, pin\n * - Secrets: secret, connectionString, databaseUrl\n * - Wildcards: *.password, *.secret, *.token (catches nested fields)\n */\nexport const DEFAULT_REDACT_PATHS: string[] = [\n\t// Authentication & authorization\n\t'password',\n\t'pass',\n\t'passwd',\n\t'secret',\n\t'token',\n\t'accessToken',\n\t'refreshToken',\n\t'idToken',\n\t'apiKey',\n\t'api_key',\n\t'apikey',\n\t'auth',\n\t'authorization',\n\t'credential',\n\t'credentials',\n\n\t// Common nested patterns (headers, body, etc.)\n\t'*.password',\n\t'*.secret',\n\t'*.token',\n\t'*.apiKey',\n\t'*.api_key',\n\t'*.authorization',\n\t'*.accessToken',\n\t'*.refreshToken',\n\n\t// HTTP headers (case variations)\n\t'headers.authorization',\n\t'headers.Authorization',\n\t'headers[\"authorization\"]',\n\t'headers[\"Authorization\"]',\n\t'headers.cookie',\n\t'headers.Cookie',\n\t'headers[\"x-api-key\"]',\n\t'headers[\"X-Api-Key\"]',\n\t'headers[\"x-auth-token\"]',\n\t'headers[\"X-Auth-Token\"]',\n\n\t// Common sensitive data fields\n\t'ssn',\n\t'socialSecurityNumber',\n\t'social_security_number',\n\t'creditCard',\n\t'credit_card',\n\t'cardNumber',\n\t'card_number',\n\t'cvv',\n\t'cvc',\n\t'pin',\n\n\t// Database & connection strings\n\t'connectionString',\n\t'connection_string',\n\t'databaseUrl',\n\t'database_url',\n];\n"],"mappings":";;;;;;;;;;;;;;AAaA,MAAa,uBAAiC;CAE7C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;AACD"}
|
|
1
|
+
{"version":3,"file":"redact-paths.mjs","names":[],"sources":["../src/redact-paths.ts"],"sourcesContent":["/**\n * Default sensitive field paths for redaction.\n *\n * These paths are automatically used when `redact: true` is set,\n * and merged with custom paths unless `resolution: 'override'` is specified.\n *\n * Includes:\n * - Authentication: password, token, apiKey, authorization, credentials\n * - Headers: authorization, cookie, x-api-key, x-auth-token\n * - Personal data: ssn, creditCard, cvv, pin\n * - Secrets: secret, connectionString, databaseUrl\n * - Wildcards: *.password, *.secret, *.token (catches nested fields)\n */\nexport const DEFAULT_REDACT_PATHS: string[] = [\n\t// Authentication & authorization\n\t'password',\n\t'pass',\n\t'passwd',\n\t'secret',\n\t'token',\n\t'accessToken',\n\t'refreshToken',\n\t'idToken',\n\t'apiKey',\n\t'api_key',\n\t'apikey',\n\t'auth',\n\t'authorization',\n\t'credential',\n\t'credentials',\n\n\t// Common nested patterns (headers, body, etc.)\n\t'*.password',\n\t'*.secret',\n\t'*.token',\n\t'*.apiKey',\n\t'*.api_key',\n\t'*.authorization',\n\t'*.accessToken',\n\t'*.refreshToken',\n\n\t// HTTP headers (case variations)\n\t'headers.authorization',\n\t'headers.Authorization',\n\t'headers[\"authorization\"]',\n\t'headers[\"Authorization\"]',\n\t'headers.cookie',\n\t'headers.Cookie',\n\t'headers[\"x-api-key\"]',\n\t'headers[\"X-Api-Key\"]',\n\t'headers[\"x-auth-token\"]',\n\t'headers[\"X-Auth-Token\"]',\n\n\t// Common sensitive data fields\n\t'ssn',\n\t'socialSecurityNumber',\n\t'social_security_number',\n\t'creditCard',\n\t'credit_card',\n\t'cardNumber',\n\t'card_number',\n\t'cvv',\n\t'cvc',\n\t'pin',\n\n\t// Database & connection strings\n\t'connectionString',\n\t'connection_string',\n\t'databaseUrl',\n\t'database_url',\n];\n\n/**\n * `scheme://user:password@` — the userinfo of a URL that carries a secret.\n * A user with no password (`ssh://git@host`) names nobody's secret and is left\n * alone.\n */\nconst URL_CREDENTIALS = /\\b([a-z][a-z0-9+.-]*:\\/\\/)[^\\s/?#@:]*:[^\\s/?#@]*@/gi;\n\n/**\n * Replace the credentials of every URL in `text` with `REDACTED`, so\n * `s3://KEY:SECRET@uploads` is logged as `s3://REDACTED@uploads`.\n *\n * Path redaction cannot catch these: a URL turns up under any field name —\n * `url`, `origin`, `endpoint` — or inside a message, and blanking every such\n * field would hide the half of it that is useful.\n */\nexport function redactUrlCredentials(text: string): string {\n\treturn text.replace(URL_CREDENTIALS, '$1REDACTED@');\n}\n\n/** Deep enough for a log object; past it, values are logged as they are. */\nconst MAX_DEPTH = 6;\n\n/**\n * A copy of `value` with {@link redactUrlCredentials} applied to every string\n * in it. Objects and arrays without such a string are returned as they were.\n */\nexport function redactUrlCredentialsIn<T>(value: T, depth = 0): T {\n\tif (typeof value === 'string') {\n\t\treturn redactUrlCredentials(value) as T;\n\t}\n\tif (depth >= MAX_DEPTH || value === null || typeof value !== 'object') {\n\t\treturn value;\n\t}\n\tif (Array.isArray(value)) {\n\t\tlet changed = false;\n\t\tconst next = value.map((item) => {\n\t\t\tconst redacted = redactUrlCredentialsIn(item, depth + 1);\n\t\t\tif (redacted !== item) changed = true;\n\t\t\treturn redacted;\n\t\t});\n\t\treturn (changed ? next : value) as T;\n\t}\n\tconst proto = Object.getPrototypeOf(value);\n\tif (proto !== Object.prototype && proto !== null) return value;\n\n\tlet next: Record<string, unknown> | undefined;\n\tfor (const [key, item] of Object.entries(value)) {\n\t\tconst redacted = redactUrlCredentialsIn(item, depth + 1);\n\t\tif (redacted !== item) {\n\t\t\tnext ??= { ...(value as Record<string, unknown>) };\n\t\t\tnext[key] = redacted;\n\t\t}\n\t}\n\treturn (next ?? value) as T;\n}\n"],"mappings":";;;;;;;;;;;;;;AAaA,MAAa,uBAAiC;CAE7C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;AACD;;;;;;AAOA,MAAM,kBAAkB;;;;;;;;;AAUxB,SAAgB,qBAAqB,MAAsB;CAC1D,OAAO,KAAK,QAAQ,iBAAiB,aAAa;AACnD;;AAGA,MAAM,YAAY;;;;;AAMlB,SAAgB,uBAA0B,OAAU,QAAQ,GAAM;CACjE,IAAI,OAAO,UAAU,UACpB,OAAO,qBAAqB,KAAK;CAElC,IAAI,SAAS,aAAa,UAAU,QAAQ,OAAO,UAAU,UAC5D,OAAO;CAER,IAAI,MAAM,QAAQ,KAAK,GAAG;EACzB,IAAI,UAAU;EACd,MAAM,OAAO,MAAM,KAAK,SAAS;GAChC,MAAM,WAAW,uBAAuB,MAAM,QAAQ,CAAC;GACvD,IAAI,aAAa,MAAM,UAAU;GACjC,OAAO;EACR,CAAC;EACD,OAAQ,UAAU,OAAO;CAC1B;CACA,MAAM,QAAQ,OAAO,eAAe,KAAK;CACzC,IAAI,UAAU,OAAO,aAAa,UAAU,MAAM,OAAO;CAEzD,IAAI;CACJ,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,KAAK,GAAG;EAChD,MAAM,WAAW,uBAAuB,MAAM,QAAQ,CAAC;EACvD,IAAI,aAAa,MAAM;GACtB,SAAS,EAAE,GAAI,MAAkC;GACjD,KAAK,OAAO;EACb;CACD;CACA,OAAQ,QAAQ;AACjB"}
|