@hanzo/event 0.3.40 → 0.3.42

package/dist/scrub.d.ts

@@ -3,6 +3,11 @@
 export declare function redactCredentialParams(s: string): string;
 /** redactSecrets removes known secret shapes. Always applied. */
 export declare function redactSecrets(s: string): string;
+/** withoutFragment returns a URL with its fragment removed. A browser never
+ *  sends the fragment to any server — it is where an app keeps what must stay
+ *  on the device, a share link's secret among them — so the client does not
+ *  send it either. */
+export declare function withoutFragment(url: string): string;
 /** scrubPII masks emails and IPs. Applied unless PII capture is enabled. */
 export declare function scrubPII(s: string): string;
 /** Longest free-text field this module will scrub. Every pattern here is a regex

package/dist/scrub.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scrub.d.ts","sourceRoot":"","sources":["../src/scrub.ts"],"names":[],"mappings":"AA8GA;6EAC6E;AAC7E,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,iEAAiE;AACjE,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED,4EAA4E;AAC5E,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAK1C;AAED;;;;yEAIyE;AACzE,eAAO,MAAM,aAAa,OAAO,CAAA;AAEjC;4DAC4D;AAC5D,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,SAAgB,GAAG,MAAM,CAE/D;AAED;qFACqF;AACrF,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,UAAU,UAAQ,GAAG,MAAM,CAM3E"}
+{"version":3,"file":"scrub.d.ts","sourceRoot":"","sources":["../src/scrub.ts"],"names":[],"mappings":"AA8GA;6EAC6E;AAC7E,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAExD;AAYD,iEAAiE;AACjE,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAK/C;AAED;;;sBAGsB;AACtB,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGnD;AAED,4EAA4E;AAC5E,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAK1C;AAED;;;;yEAIyE;AACzE,eAAO,MAAM,aAAa,OAAO,CAAA;AAEjC;4DAC4D;AAC5D,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,SAAgB,GAAG,MAAM,CAE/D;AAED;qFACqF;AACrF,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,UAAU,UAAQ,GAAG,MAAM,CAM3E"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanzo/event",
-  "version": "0.3.40",
+  "version": "0.3.42",
   "description": "Hanzo Event — the ONE telemetry client. Emits pageview/event/identify/group to the Hanzo Cloud event stream (POST /v1/event), AND reports errors to Sentry as real Sentry envelopes — the error plane needs a DSN, without one nothing reaches Sentry. First-touch attribution, beacon-on-unload, auto error capture, client-side secret/PII scrubbing, a shared event + goal vocabulary. Subsumes @sentry.",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
@@ -23,7 +23,7 @@
   "repository": {
     "type": "git",
     "url": "git+https://github.com/hanzoai/ui.git",
-    "directory": "pkgs/event"
+    "directory": "pkg/event"
   },
   "keywords": [
     "analytics",

package/src/core.test.ts

@@ -270,6 +270,25 @@ describe('Analytics capture', () => {
       })
     })
 
+    // A share link keeps its secret in the fragment, which a browser never sends
+    // to a server. Stamped from window.location.href, it reached /v1/event on
+    // every event of the page, and a 43-character base64url secret matches no
+    // other secret shape. The fragment is dropped from every stamped location.
+    it('never sends a fragment', () => {
+      const secret = 'Zq3LwX0p-Tf9_aB7kQmN2rS8vY1cD4eF6gH5jK0lMnO'
+      withLocation('https://hanzo.ai/chat/shared#' + secret, 'https://hanzo.ai/login#' + secret, () => {
+        const a = mk()
+        a.pageview()
+        a.capture('$click')
+        a.flush()
+        for (const e of tx.all) {
+          expect(JSON.stringify(e)).not.toContain(secret)
+          expect(e.url).toBe('https://hanzo.ai/chat/shared')
+          expect(e.referrer).toBe('https://hanzo.ai/login')
+        }
+      })
+    })
+
     // A redactor that mangles ordinary URLs would destroy the analytics it
     // exists to protect, so the common case must pass through byte-for-byte.
     it('leaves an ordinary url untouched', () => {

package/src/core.ts

@@ -49,7 +49,7 @@ import { dsnForProduct } from './dsn'
 import { keyForPage } from './org'
 import { EXCEPTION, PAGEVIEW } from './events'
 import { exceptionProperties } from './exception'
-import { scrubText } from './scrub'
+import { scrubText, withoutFragment } from './scrub'
 import {
   buildEnvelope,
   buildSentryEvent,
@@ -645,10 +645,13 @@ export class Analytics {
     // definition of "must not leave the browser", already tested, mirroring the
     // server's. Guarded on presence so an absent field stays absent instead of
     // becoming the empty string that `host` derivation reads as a page.
+    //
+    // The fragment goes first and whole: nothing after `#` is ever the server's
+    // (see withoutFragment), so it is dropped rather than scrubbed.
     const capturePII = this.cfg.capturePII ?? false
-    if (wire.url) wire.url = scrubText(wire.url, capturePII)
-    if (wire.path) wire.path = scrubText(wire.path, capturePII)
-    if (wire.referrer) wire.referrer = scrubText(wire.referrer, capturePII)
+    if (wire.url) wire.url = scrubText(withoutFragment(wire.url), capturePII)
+    if (wire.path) wire.path = scrubText(withoutFragment(wire.path), capturePII)
+    if (wire.referrer) wire.referrer = scrubText(withoutFragment(wire.referrer), capturePII)
     return wire
   }
 

package/src/events.ts

@@ -9,7 +9,7 @@
  * and there is still exactly one definition.
  *
  * Nothing about the API moved. Every existing import keeps working, the names
- * and their values are unchanged, and `pkgs/events/test/catalog.mjs` fails the
+ * and their values are unchanged, and `pkg/events/test/catalog.mjs` fails the
  * build if a name and its meaning ever disagree.
  *
  * The naming convention lives with the names, in @hanzo/events and TAXONOMY.md:

package/src/org.ts

@@ -76,17 +76,22 @@ export const ORG_DOMAIN: Readonly<Record<string, readonly string[]>> = Object.fr
 })
 
 /**
- * Each org's publishable key — the same values `universe`'s `SPA_INGEST_KEYRING`
- * serves to the identity hosts, which are each brand's own insights team token.
- * Add an org here the day its project exists, never before.
+ * Each org's publishable key, and a copy: the values live in universe at
+ * infra/k8s/id/configmap.yaml as SPA_INGEST_KEYRING, which serves them to the
+ * identity hosts, and this table is what a statically exported page carries when
+ * it cannot ask. The two must say the same thing. Add an org the day its project
+ * exists, never before.
  *
- * A key is only as real as the project it names: recreate the project and this
- * file moves with it, or every beacon answers 403 and reports nowhere.
+ * A key is only as real as the project it names, and these had stopped naming
+ * one: all three answered `403 ingest_key_unknown` against /v1/event, so every
+ * page that fell back to this table reported nowhere while looking fine. The
+ * copy drifted silently because nothing compares it to the keyring. If you
+ * recreate a project, move BOTH.
  */
 export const ORG_KEY: Keyring = Object.freeze({
-  hanzo: 'pk-bCcNBDOLwdIovV349jVGH1ShEOq7rAcaKLsX_bLnRMo',
-  lux: 'pk-GxCDhpEn89qajMyuMdMs6mcE4UVQBkv8F2swEKHC67Y',
-  zoo: 'pk-bS-xKESMhuhK_wfSmpRf1H_IH8A3x6Y5NV70TD7ycWE',
+  hanzo: 'pk-rM_CdaF2MQckGCrla113SrR1oH4zvqN8xh2I95Z9tY8',
+  lux: 'pk-gUZp6ZVfhJzSwK-rb4oLbVkpCnMBx5uSCpxf_5yEhQk',
+  zoo: 'pk-3TKpKnERV9AQSsBUERWkZejC1O1mUxc1jRzsP3MPbs4',
 })
 
 /** `pk-` is publishable; `sk-` is not, and there is no third thing. Checked at the

package/src/scrub.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest'
-import { redactSecrets, scrubPII, scrubText, MAX_SCRUB_LEN } from './scrub'
+import { redactSecrets, scrubPII, scrubText, withoutFragment, MAX_SCRUB_LEN } from './scrub'
 
 describe('redactSecrets (always applied)', () => {
   it('redacts a hanzo key', () => {
@@ -121,3 +121,36 @@ describe('credential params in a URL', () => {
     expect(out).toContain('page=2')
   })
 })
+
+describe('a 256-bit base64url secret', () => {
+  const secret = 'Zq3LwX0p-Tf9_aB7kQmN2rS8vY1cD4eF6gH5jK0lMnO'
+  it('is redacted wherever it stands alone', () => {
+    expect(secret).toHaveLength(43)
+    for (const s of [secret, 'token ' + secret + ' expired', '/chat/shared/' + secret, '{"token":"' + secret + '"}']) {
+      expect(redactSecrets(s)).not.toContain(secret)
+      expect(redactSecrets(s)).toContain('[redacted]')
+    }
+  })
+  it('is redacted with no digit in it, and behind an encoded fragment mark', () => {
+    const letters = 'ZqLwXp-Tf_aBkQmNrSvYcDeFgHjKlMnOpQrStUvWxYz'
+    expect(letters).toHaveLength(43)
+    expect(redactSecrets('token=' + letters)).not.toContain(letters)
+    const returnUrl = 'https://hanzo.ai/login?next=%2Fchat%2Fshared%23' + secret
+    expect(redactSecrets(returnUrl)).not.toContain(secret)
+    expect(redactSecrets(returnUrl)).toContain('%23[redacted]')
+  })
+  it('leaves a longer or shorter run, and a word-only run, alone', () => {
+    expect(redactSecrets(secret + 'x')).toBe(secret + 'x')
+    expect(redactSecrets(secret.slice(1))).toBe(secret.slice(1))
+    const slug = 'the-quick-brown-fox-jumps-over-the-lazy-dogs'.slice(0, 43)
+    expect(slug).toHaveLength(43)
+    expect(redactSecrets(slug)).toBe(slug)
+  })
+})
+
+describe('withoutFragment', () => {
+  it('drops everything from the first #', () => {
+    expect(withoutFragment('https://hanzo.ai/chat/shared#abc#def')).toBe('https://hanzo.ai/chat/shared')
+    expect(withoutFragment('https://hanzo.ai/pricing?plan=pro')).toBe('https://hanzo.ai/pricing?plan=pro')
+  })
+})

package/src/scrub.ts

@@ -114,13 +114,33 @@ export function redactCredentialParams(s: string): string {
   return s.replace(RE_CREDENTIAL_PARAM, (_m, prefix: string) => prefix + REDACTED)
 }
 
+// A 256-bit secret written as unpadded base64url is exactly 43 characters of
+// [A-Za-z0-9_-] — the shape of a share-link secret, and of any other opaque key
+// minted the same way. The run must stand alone — nothing of the same alphabet
+// on either side, a percent-escape such as the `%23` of an encoded `#` counting
+// as a boundary — so it never fires inside a longer token, and it must mix upper
+// and lower case, which a random 32 bytes does with near certainty and an
+// ordinary word or slug does not. No lookbehind, so it runs on every engine the
+// client ships to.
+const RE_SECRET43 = /(^|[^A-Za-z0-9_-]|%[0-9A-Fa-f]{2})((?=[A-Za-z0-9_-]{0,42}[a-z])(?=[A-Za-z0-9_-]{0,42}[A-Z])[A-Za-z0-9_-]{43})(?![A-Za-z0-9_-])/g
+
 /** redactSecrets removes known secret shapes. Always applied. */
 export function redactSecrets(s: string): string {
   s = redactCredentialParams(s)
   for (const re of SECRET_PATTERNS) s = s.replace(re, REDACTED)
+  s = s.replace(RE_SECRET43, (_m, lead: string) => lead + REDACTED)
   return redactPAN(s)
 }
 
+/** withoutFragment returns a URL with its fragment removed. A browser never
+ *  sends the fragment to any server — it is where an app keeps what must stay
+ *  on the device, a share link's secret among them — so the client does not
+ *  send it either. */
+export function withoutFragment(url: string): string {
+  const at = url.indexOf('#')
+  return at < 0 ? url : url.slice(0, at)
+}
+
 /** scrubPII masks emails and IPs. Applied unless PII capture is enabled. */
 export function scrubPII(s: string): string {
   s = s.replace(RE_EMAIL, EMAIL_MARK)