@loadstrike/loadstrike-sdk 1.0.30401 → 1.0.31001

package/dist/cjs/sinks.js

@@ -10,7 +10,26 @@ const node_dgram_1 = require("node:dgram");
 const node_zlib_1 = require("node:zlib");
 const pg_1 = require("pg");
 const iteration_observations_js_1 = require("./iteration-observations.js");
+const iteration_observation_diagnostics_js_1 = require("./iteration-observation-diagnostics.js");
 const PORTAL_RUN_TOKEN_PROVIDER = Symbol.for("loadstrike.internal.portal-run-token-provider");
+const MAXIMUM_HTTP_RESPONSE_BODY_BYTES = 256 * 1024;
+const MAXIMUM_HTTP_METADATA_CHARACTERS = 256;
+const HTTP_METADATA_TRUNCATION_SUFFIX = " [truncated]";
+class ReportingSinkHttpError extends Error {
+    constructor(sinkName, status, statusText, requestId) {
+        const normalizedStatus = Number.isFinite(status) ? Math.max(Math.trunc(status), 0) : 0;
+        const normalizedStatusText = normalizeHttpMetadata(statusText);
+        const normalizedRequestId = normalizeHttpMetadata(requestId);
+        super(`${sinkName} write failed with HTTP status ${normalizedStatus}`
+            + (normalizedStatusText ? ` ${normalizedStatusText}` : "")
+            + (normalizedRequestId ? ` (requestId=${normalizedRequestId})` : "")
+            + ".");
+        this.name = "ReportingSinkHttpError";
+        this.status = normalizedStatus;
+        this.statusText = normalizedStatusText;
+        this.requestId = normalizedRequestId;
+    }
+}
 function gzipJsonAsync(value) {
     const json = Buffer.from(JSON.stringify(value), "utf8");
     return new Promise((resolve, reject) => {
@@ -2234,6 +2253,7 @@ function removeSdkPercentileFields(event) {
 }
 function createIterationObservationEvents(session, batch) {
     const events = [];
+    const occurredUtc = dateFromUtcNanoseconds(batch.createdUtcNs);
     for (const observation of batch.observations) {
         const tags = {
             run_id: batch.runId,
@@ -2246,7 +2266,7 @@ function createIterationObservationEvents(session, batch) {
         events.push({
             runId: batch.runId,
             eventType: "iteration.observation",
-            occurredUtc: new Date(),
+            occurredUtc,
             sessionId: batch.sessionId,
             testSuite: session.testSuite,
             testName: session.testName,
@@ -2281,7 +2301,7 @@ function createIterationObservationEvents(session, batch) {
             events.push({
                 runId: batch.runId,
                 eventType: "iteration.step",
-                occurredUtc: new Date(),
+                occurredUtc,
                 sessionId: batch.sessionId,
                 testSuite: session.testSuite,
                 testName: session.testName,
@@ -2312,10 +2332,11 @@ function createIterationObservationEvents(session, batch) {
     return events;
 }
 function createIterationCompletionEvents(session, completion) {
+    const occurredUtc = dateFromUtcNanoseconds(completion.completedUtcNs);
     return [{
             runId: completion.runId,
             eventType: "observation.stream.completed",
-            occurredUtc: new Date(),
+            occurredUtc,
             sessionId: completion.sessionId,
             testSuite: session.testSuite,
             testName: session.testName,
@@ -2374,6 +2395,22 @@ function portalEventId(event, index) {
     });
     return `lsr_${(0, node_crypto_1.createHash)("sha256").update(material).digest("hex").slice(0, 40)}`;
 }
+function dateFromUtcNanoseconds(value) {
+    try {
+        const nanoseconds = BigInt(value);
+        if (nanoseconds < 0n) {
+            return new Date(0);
+        }
+        const milliseconds = nanoseconds / 1000000n;
+        const numeric = Number(milliseconds);
+        return Number.isFinite(numeric) && numeric <= 8640000000000000
+            ? new Date(numeric)
+            : new Date(0);
+    }
+    catch {
+        return new Date(0);
+    }
+}
 function addMeasurementFields(fields, prefix, measurement) {
     const request = measurement?.request ?? { count: 0, percent: 0, rps: 0 };
     const latency = measurement?.latency ?? {
@@ -3565,22 +3602,85 @@ async function postWithTimeout(fetchImpl, url, init, timeoutMs, sinkName) {
     const timer = setTimeout(() => controller.abort(), Math.max(timeoutMs, 1));
     try {
         const response = await fetchImpl(url, { ...init, signal: controller.signal });
-        const body = await readResponseBodyText(response);
         if (!response.ok) {
-            throw new Error(`${sinkName} write failed with status ${response.status}: ${body}`);
+            throw new ReportingSinkHttpError(sinkName, response.status, readHttpResponseStatusText(response), readHttpResponseRequestId(response));
         }
-        return body;
+        return await readResponseBodyText(response);
     }
     finally {
         clearTimeout(timer);
     }
 }
 async function readResponseBodyText(response) {
-    const candidate = response;
-    if (typeof candidate.text !== "function") {
+    const body = response.body;
+    if (body && typeof body.getReader === "function") {
+        const reader = body.getReader();
+        const chunks = [];
+        let bytes = 0;
+        try {
+            while (true) {
+                const next = await reader.read();
+                if (next.done)
+                    break;
+                if (!next.value)
+                    continue;
+                if (bytes + next.value.byteLength > MAXIMUM_HTTP_RESPONSE_BODY_BYTES) {
+                    await reader.cancel();
+                    throw new Error("Reporting sink response exceeded the bounded response limit.");
+                }
+                chunks.push(next.value);
+                bytes += next.value.byteLength;
+            }
+        }
+        finally {
+            reader.releaseLock();
+        }
+        return Buffer.concat(chunks.map((chunk) => Buffer.from(chunk))).toString("utf8");
+    }
+    return "";
+}
+function readHttpResponseStatusText(response) {
+    try {
+        return normalizeHttpMetadata(response.statusText);
+    }
+    catch {
+        return "";
+    }
+}
+function readHttpResponseRequestId(response) {
+    for (const name of [
+        "x-request-id",
+        "x-correlation-id",
+        "request-id",
+        "traceparent"
+    ]) {
+        try {
+            const value = response.headers?.get(name);
+            if (value) {
+                return normalizeHttpMetadata(value);
+            }
+        }
+        catch {
+            return "";
+        }
+    }
+    return "";
+}
+function normalizeHttpMetadata(value) {
+    let text;
+    try {
+        const source = String(value ?? "");
+        text = source.length <= MAXIMUM_HTTP_METADATA_CHARACTERS
+            ? source
+            : source.slice(0, MAXIMUM_HTTP_METADATA_CHARACTERS - HTTP_METADATA_TRUNCATION_SUFFIX.length) + HTTP_METADATA_TRUNCATION_SUFFIX;
+    }
+    catch {
         return "";
     }
-    return String(await candidate.text());
+    return (0, iteration_observation_diagnostics_js_1.redactIterationObservationSecrets)(Buffer.from(text, "utf8").toString("utf8")
+        .replace(/[\u0000-\u001F\u007F-\u009F]/gu, " ")
+        .replace(/\s{2,}/gu, " ")
+        .trim());
 }
 function validatePortalIngestResponse(responseBody) {
     const text = String(responseBody ?? "").trim();
@@ -3633,6 +3733,8 @@ exports.__loadstrikeTestExports = {
     cloneScenarioStats,
     cloneSessionStartInfo,
     createFinalStatsEvents,
+    createIterationCompletionEvents,
+    createIterationObservationEvents,
     createRealtimeStatsEvents,
     createRunResultEvents,
     createReportingEvent,
@@ -3649,6 +3751,7 @@ exports.__loadstrikeTestExports = {
     normalizeStringMap,
     optionNumber,
     optionString,
+    portalEventPayload,
     pickBooleanValue,
     pickRecordValue,
     postWithTimeout,

package/dist/cjs/transports.js

@@ -638,14 +638,10 @@ class WebSocketEndpointDefinitionModel extends TrafficEndpointDefinitionModel {
             parsed = new URL(url);
         }
         catch {
-            // Diagnostic text only; no connection is opened here.
-            // nosemgrep: vulnerability-tools.semgrep-rules.javascript.lang.security.detect-insecure-websocket
-            throw new Error("Url must be an absolute ws:// or wss:// URI.");
+            throw new Error("Url must be an absolute WebSocket URI using the ws or wss scheme.");
         }
         if (parsed.protocol !== "ws:" && parsed.protocol !== "wss:") {
-            // Diagnostic text only; no connection is opened here.
-            // nosemgrep: vulnerability-tools.semgrep-rules.javascript.lang.security.detect-insecure-websocket
-            throw new Error("Url must be an absolute ws:// or wss:// URI.");
+            throw new Error("Url must be an absolute WebSocket URI using the ws or wss scheme.");
         }
         if (this.ConnectTimeoutSeconds <= 0) {
             throw new RangeError("ConnectTimeout must be greater than zero.");
@@ -3175,14 +3171,10 @@ function validateWebSocketEndpoint(endpoint, mode) {
         parsed = new URL(url);
     }
     catch {
-        // Diagnostic text only; no connection is opened here.
-        // nosemgrep: vulnerability-tools.semgrep-rules.javascript.lang.security.detect-insecure-websocket
-        throw new Error("Url must be an absolute ws:// or wss:// URI.");
+        throw new Error("Url must be an absolute WebSocket URI using the ws or wss scheme.");
     }
     if (parsed.protocol !== "ws:" && parsed.protocol !== "wss:") {
-        // Diagnostic text only; no connection is opened here.
-        // nosemgrep: vulnerability-tools.semgrep-rules.javascript.lang.security.detect-insecure-websocket
-        throw new Error("Url must be an absolute ws:// or wss:// URI.");
+        throw new Error("Url must be an absolute WebSocket URI using the ws or wss scheme.");
     }
     const connectMs = optionNumber(options, "ConnectTimeoutMs", "connectTimeoutMs");
     const connectSeconds = optionNumber(options, "ConnectTimeoutSeconds", "connectTimeoutSeconds", "ConnectTimeout", "connectTimeout");
@@ -3612,7 +3604,13 @@ function extractJsonPath(value, arrayPath) {
     if (!normalized) {
         return value;
     }
-    const tokens = normalized.replace(/\[(\d+)\]/g, ".$1").split(".").filter((x) => x.length > 0);
+    let tokens;
+    try {
+        tokens = safeJsonPathSegments(normalized.replace(/\[(\d+)\]/g, ".$1"));
+    }
+    catch {
+        return null;
+    }
     for (const token of tokens) {
         if (current == null) {
             return null;
@@ -3622,13 +3620,17 @@ function extractJsonPath(value, arrayPath) {
             if (!Number.isInteger(index) || index < 0 || index >= current.length) {
                 return null;
             }
-            current = current[index];
+            current = current.at(index);
             continue;
         }
-        if (!isRecord(current) || !(token in current)) {
+        if (!isRecord(current)) {
             return null;
         }
-        current = current[token];
+        const descriptor = Object.getOwnPropertyDescriptor(current, token);
+        if (!descriptor || !("value" in descriptor)) {
+            return null;
+        }
+        current = descriptor.value;
     }
     return current;
 }
@@ -3645,7 +3647,7 @@ function parseMaybeJson(value) {
     }
 }
 function headersToRecord(value) {
-    const headers = {};
+    const headers = Object.create(null);
     value.forEach((headerValue, key) => {
         headers[key] = headerValue;
     });
@@ -3999,11 +4001,22 @@ function extractTrackingValue(payload, selector) {
             return null;
         }
         let current = body;
-        for (const segment of selector.slice("json:".length).trim().replace(/^\$\./, "").split(".").filter(Boolean)) {
+        const path = selector.slice("json:".length).trim().replace(/^\$\./, "");
+        let segments;
+        try {
+            segments = safeJsonPathSegments(path);
+        }
+        catch {
+            return null;
+        }
+        for (const segment of segments) {
             if (!isRecord(current)) {
                 return null;
             }
-            current = current[segment];
+            if (!Object.prototype.hasOwnProperty.call(current, segment)) {
+                return null;
+            }
+            current = readOwnJsonProperty(current, segment);
         }
         return current == null ? null : String(current);
     }
@@ -4034,23 +4047,61 @@ function injectTrackingValue(payload, selector, value) {
 }
 function setJsonBodyValue(body, path, value) {
     const target = parseBodyObject(body) ?? {};
-    const clone = cloneBody(target);
-    const segments = path.split(".").filter(Boolean);
+    const clone = cloneJsonRecord(target);
+    const segments = safeJsonPathSegments(path);
     if (!segments.length) {
         return clone;
     }
     let current = clone;
     for (let i = 0; i < segments.length - 1; i += 1) {
         const segment = segments[i];
-        const next = current[segment];
+        let next = readOwnJsonProperty(current, segment);
         if (!isRecord(next)) {
-            current[segment] = {};
+            next = {};
+            defineJsonProperty(current, segment, next);
         }
-        current = current[segment];
+        current = next;
     }
-    current[segments[segments.length - 1]] = value;
+    defineJsonProperty(current, segments[segments.length - 1], value);
     return clone;
 }
+const FORBIDDEN_JSON_PATH_SEGMENTS = new Set(["__proto__", "prototype", "constructor"]);
+function safeJsonPathSegments(path) {
+    const segments = path.split(".").filter(Boolean);
+    const forbidden = segments.find((segment) => FORBIDDEN_JSON_PATH_SEGMENTS.has(segment));
+    if (forbidden) {
+        throw new Error(`Tracking selector contains forbidden JSON path segment '${forbidden}'.`);
+    }
+    return segments;
+}
+function defineJsonProperty(target, key, value) {
+    Object.defineProperty(target, key, {
+        configurable: true,
+        enumerable: true,
+        value,
+        writable: true
+    });
+}
+function readOwnJsonProperty(target, key) {
+    const descriptor = Object.getOwnPropertyDescriptor(target, key);
+    return descriptor && "value" in descriptor ? descriptor.value : undefined;
+}
+function cloneJsonRecord(source) {
+    const target = {};
+    for (const [key, value] of Object.entries(source)) {
+        defineJsonProperty(target, key, cloneJsonValue(value));
+    }
+    return target;
+}
+function cloneJsonValue(value) {
+    if (Array.isArray(value)) {
+        return value.map((entry) => cloneJsonValue(entry));
+    }
+    if (isRecord(value)) {
+        return cloneJsonRecord(value);
+    }
+    return value;
+}
 function parseBodyObject(body) {
     if (body instanceof Uint8Array) {
         return parseBodyObject(new TextDecoder().decode(body));
@@ -4659,8 +4710,10 @@ exports.__loadstrikeTestExports = {
     createNatsHeaders,
     createRedisStreamPayload,
     deserializeBrokerPayloadBody,
+    extractJsonPath,
     extractTrackingValue,
     fromKafkaHeaders,
+    headersToRecord,
     headerValue,
     attachDotNetTrackingPayloadAliases,
     attachPayloadHelpers,