@jaypie/express 1.2.14 → 1.2.16

package/dist/cjs/summarizeRequest.helper.d.ts

@@ -2,7 +2,7 @@ import type { Request } from "express";
 export interface RequestSummary {
     baseUrl: string;
     body: unknown;
-    headers: Request["headers"];
+    headers: Record<string, string | string[] | undefined>;
     method: string;
     query: Request["query"];
     url: string;

package/dist/esm/index.js

@@ -4,7 +4,7 @@ import { CorsError, BadRequestError, UnhandledError, GatewayTimeoutError, Unavai
 import { force, envBoolean, JAYPIE, HTTP, getHeaderFrom, jaypieHandler } from '@jaypie/kit';
 import expressCors from 'cors';
 import { loadEnvSecrets, getContentTypeForFormat, formatStreamError } from '@jaypie/aws';
-import { log } from '@jaypie/logger';
+import { log, redactAuth } from '@jaypie/logger';
 import { hasDatadogEnv, submitMetric, DATADOG } from '@jaypie/datadog';
 
 //
@@ -1510,6 +1510,11 @@ const decorateResponse = (res, { handler = "", version = process.env.PROJECT_VER
 // about the environment's secret parameters, the special adapter,
 // HTTP, etc.  There must be a better way to organize this
 
+//
+//
+// Constants
+//
+const SENSITIVE_HEADERS = new Set(["authorization", "cookie", "set-cookie"]);
 //
 //
 // Function Definition
@@ -1520,10 +1525,19 @@ function summarizeRequest(req) {
     if (Buffer.isBuffer(body)) {
         body = body.toString();
     }
+    // Redact sensitive headers
+    const headers = {
+        ...req.headers,
+    };
+    for (const key of Object.keys(headers)) {
+        if (SENSITIVE_HEADERS.has(key.toLowerCase())) {
+            headers[key] = redactAuth(headers[key]);
+        }
+    }
     return {
         baseUrl: req.baseUrl,
         body,
-        headers: req.headers,
+        headers,
         method: req.method,
         query: req.query,
         url: req.url,
@@ -1793,14 +1807,18 @@ function expressHandler(handlerOrOptions, optionsOrHandler) {
         //
         // Preprocess
         //
+        // Build a request-local setup list to avoid mutating the shared array
+        const requestSetup = [];
         // Load secrets into process.env if configured
         if (secrets && secrets.length > 0) {
             const secretsToLoad = secrets;
             const secretsSetup = async () => {
                 await loadEnvSecrets(...secretsToLoad);
             };
-            setup.unshift(secretsSetup);
+            requestSetup.push(secretsSetup);
         }
+        // Add shared setup functions
+        requestSetup.push(...setup);
         if (locals) {
             // Locals
             const keys = Object.keys(locals);
@@ -1819,7 +1837,7 @@ function expressHandler(handlerOrOptions, optionsOrHandler) {
                         }
                     }
                 };
-                setup.push(localsSetup);
+                requestSetup.push(localsSetup);
             }
         }
         let response;
@@ -1830,7 +1848,7 @@ function expressHandler(handlerOrOptions, optionsOrHandler) {
             jaypieFunction = jaypieHandler(handler, {
                 chaos,
                 name,
-                setup,
+                setup: requestSetup,
                 teardown,
                 unavailable,
                 validate,
@@ -2141,14 +2159,18 @@ function expressStreamHandler(handlerOrOptions, optionsOrHandler) {
         //
         // Preprocess
         //
+        // Build a request-local setup list to avoid mutating the shared array
+        const requestSetup = [];
         // Load secrets into process.env if configured
         if (secrets && secrets.length > 0) {
             const secretsToLoad = secrets;
             const secretsSetup = async () => {
                 await loadEnvSecrets(...secretsToLoad);
             };
-            setup.unshift(secretsSetup);
+            requestSetup.push(secretsSetup);
         }
+        // Add shared setup functions
+        requestSetup.push(...setup);
         if (locals) {
             const keys = Object.keys(locals);
             if (keys.length > 0) {
@@ -2166,7 +2188,7 @@ function expressStreamHandler(handlerOrOptions, optionsOrHandler) {
                         }
                     }
                 };
-                setup.push(localsSetup);
+                requestSetup.push(localsSetup);
             }
         }
         try {
@@ -2174,7 +2196,7 @@ function expressStreamHandler(handlerOrOptions, optionsOrHandler) {
             jaypieFunction = jaypieHandler(handler, {
                 chaos,
                 name,
-                setup,
+                setup: requestSetup,
                 teardown,
                 unavailable,
                 validate,