@jasonwch/nodebb-plugin-meilisearch-r 1.2.0 → 1.2.1

package/lib/client.js

@@ -12,6 +12,7 @@ const {
 	EMBEDDER_TASK_TIMEOUT_MS, EMBEDDER_TASK_BG_TIMEOUT_MS, EMBEDDER_TASK_BG_INTERVAL_MS,
 	MEILI_HTTP_TIMEOUT_MS,
 } = require('./constants');
+const { redactSecrets } = require('./redact');
 
 async function ensureIndex(plugin, uid, primaryKey) {
 	try {
@@ -69,15 +70,24 @@ function startEmbedderPoller(plugin, plan, taskUid) {
 			});
 			embedderPollers.delete(taskUid);
 			if (task.status !== 'succeeded') {
-				// Delayed failure: fingerprint was optimistically persisted at enqueue time
-				// (see plugin.updateEmbedders catch-block). Clear it so the next save pushes
-				// fresh config rather than silently skipping as "already applied".
+				// C1c fix: redact any apiKey that Meilisearch may echo in task.error.message before
+				// sending to admin toasts. Issue 2 admin-room filter already limits toast recipients,
+				// but defense-in-depth handles the case where Meilisearch wraps the apiKey in the error.
+				// A3-style inner try/catch: if redaction itself fails, fall back to raw reason rather
+				// than crashing the poller's failure-handling path.
+				const rawReason = task.error?.message || `task ${task.status}`;
+				let safeReason;
+				try {
+					safeReason = await redactSecrets(rawReason, plugin);
+				} catch {
+					safeReason = rawReason;
+				}
 				await clearAppliedConfig(plugin, plan.indexName);
 				plugin.healthy = false;
 				plugin.notifyAdmins(`embedder:${plan.indexName}`, {
 					type: 'danger',
 					titleKey: '[[meilisearch:admin.semanticEmbedderDelayedFailed]]',
-					message: `${plan.indexName}: ${task.error?.message || `task ${task.status}`}`,
+					message: `${plan.indexName}: ${safeReason}`,
 				});
 			} else {
 				// Delayed success: mark taskUid as null (sync-verified) so reattachPollers
@@ -98,13 +108,30 @@ function startEmbedderPoller(plugin, plan, taskUid) {
 				return;
 			}
 			// Network error or other non-timeout failure — task status is genuinely unknown.
-			// Don't clear the fingerprint on a transient blip (would cause unnecessary re-push).
-			// If the task actually failed, reattachPollers will catch it on the next restart
-			// via the persisted taskUid → getTask(uid) → status: "failed" → clearAppliedConfig.
-			winston.warn(`[plugin/meilisearch] Embedder poller for "${plan.indexName}" (task ${taskUid}) hit an error (non-fatal, fingerprint preserved): ${err.message}`);
+			// C1 fix: redact any apiKey echoed in err.message before logging.
+			// A3-style inner try/catch: fall back to raw err.message if redaction itself fails.
+			const rawPollerErr = err.message;
+			let safePollerErr;
+			try {
+				safePollerErr = await redactSecrets(rawPollerErr, plugin);
+			} catch {
+				safePollerErr = rawPollerErr;
+			}
+			winston.warn(`[plugin/meilisearch] Embedder poller for "${plan.indexName}" (task ${taskUid}) hit an error (non-fatal, fingerprint preserved): ${safePollerErr}`);
 		}
 	};
-	poll().catch(err => winston.error(`[plugin/meilisearch] embedder poller crashed: ${err.message}`));
+	poll().catch(async err => {
+		// A3: inner try/catch makes the redaction layer airtight against future regressions
+		// where redactSecrets itself might throw (currently fully guarded internally, but
+		// defense-in-depth ensures the log path still runs).
+		let safeCrashErr;
+		try {
+			safeCrashErr = await redactSecrets(err.message, plugin);
+		} catch {
+			safeCrashErr = '<redaction failed>';
+		}
+		winston.error(`[plugin/meilisearch] embedder poller crashed: ${safeCrashErr}`);
+	});
 }
 
 // Recover embedder pollers after process restart. embedderPollers (line 42) is module-level
@@ -135,13 +162,22 @@ async function reattachPollers(plugin) {
 				continue;
 			}
 			// Task failed during downtime — clear stale fingerprint + alert
-			winston.warn(`[plugin/meilisearch] Embedder task ${taskUid} for "${indexName}" failed during downtime: ${task.error?.message || task.status}`);
+			// C1b fix: redact any apiKey from task.error.message before logging + alerting.
+			// A3-style inner try/catch: fall back to raw reason if redaction itself fails.
+			const rawFailReason = task.error?.message || `task ${task.status}`;
+			let safeFailReason;
+			try {
+				safeFailReason = await redactSecrets(rawFailReason, plugin);
+			} catch {
+				safeFailReason = rawFailReason;
+			}
+			winston.warn(`[plugin/meilisearch] Embedder task ${taskUid} for "${indexName}" failed during downtime: ${safeFailReason}`);
 			await clearAppliedConfig(plugin, indexName);
 			plugin.healthy = false;
 			plugin.notifyAdmins(`embedder:${indexName}`, {
 				type: 'danger',
 				titleKey: '[[meilisearch:admin.semanticEmbedderDelayedFailed]]',
-				message: `${indexName}: ${task.error?.message || `task ${task.status}`}`,
+				message: `${indexName}: ${safeFailReason}`,
 			});
 		} catch (err) {
 			// Non-fatal: taskUid may be 404 (purged from Meilisearch's ~24h history), or
@@ -198,6 +234,10 @@ module.exports = function attachClient(plugin) {
 			if (!plugin.healthy) {
 				winston.warn('[plugin/meilisearch] MeiliSearch host is unhealthy');
 			} else {
+				// B2b: SDK write/health error path — drainPending replay errors may contain
+				// document content snippets from already-indexed posts (rare; only if
+				// Meilisearch rejects a batch quoting the bad doc). Accepted risk for
+				// low-frequency replay failures; document content is already-in-DB data.
 				drainPending(plugin).catch(err => winston.error(`[plugin/meilisearch] drain failed: ${err.message}`));
 			}
 			return plugin.healthy;
@@ -219,6 +259,8 @@ module.exports = function attachClient(plugin) {
 			await ensureIndex(plugin, 'chat_message', 'mid');
 			await plugin.client.index('chat_message').updateFilterableAttributes(['roomId', 'uid', 'timestamp']);
 		} catch (err) {
+			// B2b: SDK settings error path — updateFilterableAttributes errors don't typically
+			// echo credentials or document content; accepted risk for low-frequency settings failures.
 			winston.error(`[plugin/meilisearch] ensureChatMessageIndex failed: ${err.message}`);
 			plugin.healthy = false;
 		}
@@ -423,7 +465,17 @@ module.exports = function attachClient(plugin) {
 				}
 				return { ...plan, taskUid: null };  // sync-verified success — no reconciliation needed
 			} catch (err) {
-				const reason = err.message;
+				// C1a fix: redact any apiKey from err.message before logging + alerting.
+				// Meilisearch may echo the configured apiKey in 401/403 error responses.
+				// A3-style inner try/catch: fall back to raw err.message if redaction itself fails,
+				// preserving the catch block's responsibility (alert + return null).
+				const rawReason = err.message;
+				let reason;
+				try {
+					reason = await redactSecrets(rawReason, plugin);
+				} catch {
+					reason = rawReason;
+				}
 				winston.error(`[plugin/meilisearch] Failed to apply "${plan.indexName}" embedder (semantic search): ${reason}`);
 				plugin.notifyAdmins(`embedder:${plan.indexName}`, {
 					type: 'danger',

package/lib/hooks/posts.js

@@ -146,8 +146,11 @@ module.exports = function attachPostHooks(plugin) {
 				},
 				{ batch: REINDEX_BATCH_SIZE },
 			);
-		} catch (err) {
-			winston.error(`[plugin/meilisearch] reindexTopicPosts failed: ${err.message}`);
+	} catch (err) {
+		// B2b: SDK write error path — may contain document content snippets from already-indexed
+		// posts (rare; only if Meilisearch rejects a batch quoting the bad doc). Accepted risk
+		// for low-frequency write failures; document content is already-in-DB data.
+		winston.error(`[plugin/meilisearch] reindexTopicPosts failed: ${err.message}`);
 			plugin.healthy = false;
 			await enqueuePending('reindexTopicPosts', { tid });
 		}
@@ -172,7 +175,10 @@ module.exports = function attachPostHooks(plugin) {
 				await postIndex.deleteDocuments(mainPidArr);
 			}
 		} catch (err) {
-			winston.error(`[plugin/meilisearch] deindexTopicPosts failed: ${err.message}`);
+			// B2b: SDK write error path — may contain document content snippets from already-indexed
+		// posts (rare; only if Meilisearch rejects a batch quoting the bad doc). Accepted risk
+		// for low-frequency write failures; document content is already-in-DB data.
+		winston.error(`[plugin/meilisearch] deindexTopicPosts failed: ${err.message}`);
 			plugin.healthy = false;
 			await enqueuePending('deindexTopicPosts', { tid });
 		}

package/lib/hooks/topics.js

@@ -147,6 +147,10 @@ module.exports = function attachTopicHooks(plugin) {
 						postIndex.deleteDocuments(orphanPids));
 				}
 			} catch (err) {
+				// B2b: SDK write error path — may contain document content snippets from
+				// already-indexed posts (rare; only if Meilisearch rejects a batch quoting
+				// the bad doc). Accepted risk for low-frequency write failures; document
+				// content is already-in-DB data.
 				winston.error(`[plugin/meilisearch] onTopicMerge orphan cleanup for tid ${tid} failed: ${err.message}`);
 				plugin.healthy = false;
 				// Don't enqueue — orphans are cleaned by next reindex. Continue to next tid.
@@ -202,6 +206,10 @@ module.exports = function attachTopicHooks(plugin) {
 				);
 			}));
 		} catch (err) {
+			// B2b: SDK write error path — may contain document content snippets from
+			// already-indexed posts (rare; only if Meilisearch rejects a batch quoting
+			// the bad doc). Accepted risk for low-frequency write failures; document
+			// content is already-in-DB data.
 			winston.error(`[plugin/meilisearch] deindexTopicsPurge failed: ${err.message}`);
 			plugin.healthy = false;
 			await enqueuePending('deindexTopicsPurge', reducedPayload);

package/lib/redact.js

@@ -0,0 +1,131 @@
+'use strict';
+
+// Credential redaction for log/alert paths.
+//
+// Background: M5 + C1 fix. Meilisearch task error messages and settings diff logs may
+// echo the configured apiKey (e.g. "Unauthorized: key sk-abc123" or nested in JSON).
+// Without redaction, these flow to:
+//   - winston transports (stdout, logs/output.log, /admin/developer/logs)
+//   - log aggregators (Loki/ELK/Datadog) which sit OUTSIDE the admin trust boundary
+//   - admin ACP toasts (15s transient — already mitigated by Issue 2 admin-room filter)
+//
+// Strategy: dual-layer redaction
+//   1. Pattern-based regex: catches known API key shapes (OpenAI sk-*, Bearer tokens)
+//      even when we can't read the configured value (e.g. message logged before init)
+//   2. Value-based substitution: reads semanticSearchApiKey from settings and string-
+//      replaces any literal occurrence — catches custom REST tokens, future OpenAI
+//      key formats, and exotic auth schemes that don't match the regex.
+//
+// Value-based redaction requires a settings.getOne DB read on first call; cached for
+// 5 min so throttled error paths (notifyAdmins throttles 60s/key) incur ≤1 DB read/min.
+
+const settings = nodebb.require('./src/meta/settings');
+
+// Fields whose VALUES must never appear in winston diff logs (lib/settings.js isBreaking).
+// Listed by ACP field name. semanticSearchUrl is intentionally NOT included — it's an
+// internal hostname, not a credential, and admins need it for debugging connectivity.
+const SECRET_SETTINGS = new Set([
+	'semanticSearchApiKey',
+	'semanticSearchRestRequest',
+	'semanticSearchRestResponse',
+]);
+
+const REDACTION_PLACEHOLDER = '<redacted>';
+
+// Patterns to catch common API key formats in free-form error strings.
+// OpenAI keys: sk-*, sk-proj-*, sk-org-*, sk-svcacct-* — all start with "sk-"
+// and are at least 20 chars long (real keys are 40+ but we redact aggressively at 20).
+const KEY_PATTERNS = [
+	/\bsk-[a-zA-Z0-9_-]{20,}\b/g,
+	/\bBearer\s+[a-zA-Z0-9_-]{8,}\b/gi,
+];
+
+// Min length for value-based redaction — avoids replacing short strings that might
+// legitimately appear in error messages (e.g. an apiKey of "ab" would corrupt many
+// error strings). 8 chars is safely above any plausible short substring.
+const MIN_VALUE_REDACT_LENGTH = 8;
+
+// Cached configured semanticSearchApiKey to avoid hitting DB on every redact call.
+// TTL ensures we pick up rotations within 5 min. Cached as the raw string value
+// (or '' when no key configured) so we can distinguish "cached empty" from "not cached".
+let _cachedApiKey = null;
+let _cachedAt = 0;
+const CACHE_TTL_MS = 5 * 60 * 1000;
+
+async function getCachedApiKey(plugin) {
+	const now = Date.now();
+	if (_cachedApiKey !== null && now - _cachedAt < CACHE_TTL_MS) {
+		return _cachedApiKey;
+	}
+	try {
+		// A1 fix: trim the cached value to match the on-wire key (embedder.js get() trims
+		// before sending to Meilisearch, so any echo in errors is the trimmed form).
+		// Without this, a padded stored key (" sk-abc ") would defeat value-based redaction
+		// when Meilisearch echoes the trimmed key ("sk-abc") in a 401 error.
+		_cachedApiKey = ((await settings.getOne(plugin.id, 'semanticSearchApiKey')) || '').trim();
+		_cachedAt = now;
+	} catch (e) {
+		// A2 fix: don't set _cachedAt on the failure path — let the next call retry immediately
+		// instead of cycling through the full 5-min TTL with a stale empty cache. Pattern-based
+		// redaction still runs, so sk-* and Bearer-shaped keys stay protected during the blip.
+		_cachedApiKey = '';
+	}
+	return _cachedApiKey;
+}
+
+// Test-only hooks (exported for the test sandbox; not consumed by production code paths).
+function _resetCache() {
+	_cachedApiKey = null;
+	_cachedAt = 0;
+}
+
+function _setCachedApiKey(value) {
+	_cachedApiKey = (value || '').trim();
+	_cachedAt = Date.now();
+}
+
+// Redact known secret patterns + the configured apiKey value from a free-form string.
+// Used by winston log calls and notifyAdmins payloads so credentials don't leak
+// when Meilisearch echoes them in error messages.
+//
+// Returns the redacted string. If `plugin` is omitted, only pattern-based redaction
+// runs (used in early-init paths before plugin object is fully wired).
+async function redactSecrets(message, plugin) {
+	if (typeof message !== 'string' || !message) return message;
+	let redacted = message;
+
+	// Layer 1: pattern-based — catches known formats even without DB access
+	for (const pattern of KEY_PATTERNS) {
+		redacted = redacted.replace(pattern, REDACTION_PLACEHOLDER);
+	}
+
+	// Layer 2: value-based — catches the exact configured apiKey regardless of format
+	if (plugin) {
+		const configuredKey = await getCachedApiKey(plugin);
+		if (configuredKey && configuredKey.length >= MIN_VALUE_REDACT_LENGTH) {
+			// Escape regex special chars in the key (keys can contain +, /, = for base64)
+			const escapedKey = configuredKey.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+			redacted = redacted.replace(new RegExp(escapedKey, 'g'), REDACTION_PLACEHOLDER);
+		}
+	}
+
+	return redacted;
+}
+
+// Whole-value redaction for winston diff logs (lib/settings.js isBreaking).
+// Returns '<redacted>' for credential-bearing fields, JSON.stringify for others.
+// Preserves the "did it change?" audit signal without leaking the credential value.
+function redactSettingForLog(setting, value) {
+	if (SECRET_SETTINGS.has(setting)) return REDACTION_PLACEHOLDER;
+	return JSON.stringify(value);
+}
+
+module.exports = {
+	redactSecrets,
+	redactSettingForLog,
+	SECRET_SETTINGS,
+	REDACTION_PLACEHOLDER,
+	// Test-only exports (not consumed by production code paths):
+	_resetCache,
+	_setCachedApiKey,
+};

package/lib/search.js

@@ -5,6 +5,7 @@ const settings = nodebb.require('./src/meta/settings');
 const plugins = nodebb.require('./src/plugins');
 const { resolveMinTermLength } = require('./settings-helpers');
 const { EMBEDDER_NAME, isSemanticSearchEnabled, getSemanticRatio, getSemanticScoreThreshold } = require('./embedder');
+const { redactSecrets } = require('./redact');
 
 // rankingScoreThreshold is a top-level search parameter (a sibling of "hybrid", not nested
 // inside it) - Meilisearch defaults it to 0 (no filtering) when omitted, which is why
@@ -29,12 +30,23 @@ async function safeSearch(plugin, indexName, term, opts) {
 		return await plugin.client.index(indexName).search(term, opts);
 	} catch (err) {
 		const reason = err?.message || String(err);
+		// B1 fix: redact any apiKey Meilisearch may echo in search error responses.
+		// Search errors typically return code+message rather than echoing credentials,
+		// but uniform posture with the embedder-task paths is cheap defense-in-depth.
+		// A3-style inner try/catch preserves safeSearch's "never throw" contract: if
+		// redaction itself fails, fall back to the raw reason rather than rejecting.
+		let safeReason;
+		try {
+			safeReason = await redactSecrets(reason, plugin);
+		} catch {
+			safeReason = reason;
+		}
 		if (opts.hybrid) {
-			winston.error(`[plugin/meilisearch] Hybrid search on "${indexName}" failed (${reason}); falling back to keyword-only search`);
+			winston.error(`[plugin/meilisearch] Hybrid search on "${indexName}" failed (${safeReason}); falling back to keyword-only search`);
 			plugin.notifyAdmins(`search:${indexName}`, {
 				type: 'danger',
 				titleKey: '[[meilisearch:admin.semanticSearchDegraded]]',
-				message: `${indexName}: ${reason}`,
+				message: `${indexName}: ${safeReason}`,
 			});
 			// rankingScoreThreshold is tuned for hybrid/vector scores - drop it too, or a
 			// keyword-only fallback could wrongly filter out valid BM25-style matches.
@@ -42,15 +54,22 @@ async function safeSearch(plugin, indexName, term, opts) {
 			try {
 				return await plugin.client.index(indexName).search(term, keywordOnly);
 			} catch (fallbackErr) {
-				winston.error(`[plugin/meilisearch] Keyword-only fallback search on "${indexName}" also failed: ${fallbackErr.message}`);
+				const fallbackReason = fallbackErr?.message || String(fallbackErr);
+				let safeFallbackReason;
+				try {
+					safeFallbackReason = await redactSecrets(fallbackReason, plugin);
+				} catch {
+					safeFallbackReason = fallbackReason;
+				}
+				winston.error(`[plugin/meilisearch] Keyword-only fallback search on "${indexName}" also failed: ${safeFallbackReason}`);
 				return null;
 			}
 		}
-		winston.error(`[plugin/meilisearch] Search on "${indexName}" failed: ${reason}`);
+		winston.error(`[plugin/meilisearch] Search on "${indexName}" failed: ${safeReason}`);
 		plugin.notifyAdmins(`search:${indexName}`, {
 			type: 'danger',
 			titleKey: '[[meilisearch:admin.semanticSearchDegraded]]',
-			message: `${indexName}: ${reason}`,
+			message: `${indexName}: ${safeReason}`,
 		});
 		return null;
 	}

package/lib/settings.js

@@ -4,6 +4,7 @@ const winston = nodebb.require('winston');
 const settings = nodebb.require('./src/meta/settings');
 const { clampMinTermLength } = require('./settings-helpers');
 const { SEMANTIC_SETTING_KEYS, resetAppliedConfigs } = require('./embedder');
+const { redactSettingForLog, redactSecrets } = require('./redact');
 
 function deepCompare(a, b) {
 	if (a === null || b === null) return a === b;
@@ -47,7 +48,10 @@ module.exports = function attachSettings(plugin) {
 		const stored = await settings.getOne(plugin.id, setting);
 		const changed = !deepCompare(stored, value);
 		if (changed) {
-			winston.info(`[plugin/meilisearch] ${setting} changed: ${JSON.stringify(stored)} -> ${JSON.stringify(value)}`);
+			// M5 fix: redact credential-bearing fields (apiKey, REST templates) from winston diff log
+			// so admin key rotation doesn't leak old+new paid OpenAI keys to output.log/aggregators
+			// via the ACP Logs page and any streaming log aggregator (Loki/ELK/Datadog).
+			winston.info(`[plugin/meilisearch] ${setting} changed: ${redactSettingForLog(setting, stored)} -> ${redactSettingForLog(setting, value)}`);
 		}
 		return changed;
 	}
@@ -100,17 +104,30 @@ module.exports = function attachSettings(plugin) {
 				}
 			} catch (err) {
 				// #7: Don't throw — let settings persist to DB even when Meili is unreachable.
-				winston.error(`[plugin/meilisearch] Error while saving settings: ${err.message}`);
+				// C1 fix: redact any apiKey that Meilisearch may echo in its error message before
+				// logging. Falls back to pattern-only redaction if settings DB is unreachable.
+				// A3-style inner try/catch: fall back to raw err.message if redaction itself fails,
+				// so the error still surfaces (just unredacted) rather than silently swallowing it.
+				const rawReason = err.message;
+				let safeReason;
+				try {
+					safeReason = await redactSecrets(rawReason, plugin);
+				} catch {
+					safeReason = rawReason;
+				}
+				winston.error(`[plugin/meilisearch] Error while saving settings: ${safeReason}`);
 				plugin.healthy = false;
 				// Surface the failure to admins in the ACP — without this, the client sees the
 				// "Settings Saved" success toast even when Meilisearch silently rejected the
 				// settings/embedder update. Client-side validation (admin.js) is the primary
 				// UX path for invalid configs; this catches connection-level failures (e.g.
 				// Meilisearch host unreachable after Fix B's 30s HTTP timeout fires).
+				// C1 fix: surface the failure to admins without leaking credentials. The error
+				// message may contain the apiKey if Meilisearch echoes it in 401 responses.
 				plugin.notifyAdmins('settings:save', {
 					type: 'danger',
 					titleKey: '[[meilisearch:admin.meilisearchError]]',
-					message: err.message,
+					message: safeReason,
 				});
 			}
 		}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@jasonwch/nodebb-plugin-meilisearch-r",
-	"version": "1.2.0",
+	"version": "1.2.1",
 	"description": "Enhanced plugin for integrating MeiliSearch with NodeBB",
 	"author": {
 		"name": "JasonCH",