@log-drop/web 1.0.0-alpha2 → 1.0.0-alpha4

package/dist/index.d.ts

@@ -26,7 +26,6 @@ export interface LogDropNetworkConfig {
 
 export interface LogDropConfig {
   appId: string;
-  apiKey: string;
   webSecretKey?: string | null;
   baseUrl?: string;
   env?: string;

package/dist/index.js

@@ -9,7 +9,7 @@ LogDropConstants.DEFAULT_BASE_URL = "https://server.logdrop.io";
 LogDropConstants.DEFAULT_WEB_SECRET_KEY = "xuM9w0BAQEFx";
 LogDropConstants.FILE_EXPORT_INTERVAL_MS = 3e5;
 LogDropConstants.DEVICE_INFO_INTERVAL_MS = 1e4;
-LogDropConstants.SDK_VERSION = true ? "1.0.0-alpha2" : "1.0.0";
+LogDropConstants.SDK_VERSION = true ? "1.0.0-alpha4" : "1.0.0";
 LogDropConstants.STORAGE_CHECK_INTERVAL_MS = 12e4;
 LogDropConstants.MAX_LOCAL_STORAGE_SIZE = 5242880;
 LogDropConstants.DATABASE_MAX_STORAGE_LIMIT = 16e6;
@@ -511,6 +511,168 @@ var NetworkInstrumentation = class {
   }
 };
 
+// src/instrumentation/httpCapturePolicy.js
+var ALWAYS_MASKED_HEADERS = /* @__PURE__ */ new Set([
+  "authorization",
+  "proxy-authorization",
+  "x-auth-token",
+  "x-api-key",
+  "x-session-token",
+  "cookie",
+  "set-cookie"
+]);
+var MASK = "***";
+var MAX_PATTERN_LENGTH = 500;
+var DANGEROUS_PATTERN = /(a\+)\+|\(\.\*\)\+|\(\.\+\)\+/;
+function normalizeHost(value) {
+  const host = String(value ?? "").trim().replace(/\.+$/, "").toLowerCase();
+  if (!host || /[/:?#@]/.test(host) || host.length > 253) return null;
+  return host;
+}
+function normalizePath(value) {
+  const trimmed = String(value ?? "").trim();
+  if (!trimmed) return "/";
+  const withSlash = trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
+  return withSlash.length > 1 ? withSlash.replace(/\/+$/, "") : withSlash;
+}
+function domainMatches(host, ruleHost) {
+  return host === ruleHost || host.endsWith(`.${ruleHost}`);
+}
+function pathMatches(path, rulePath, matchType) {
+  if (matchType === "EXACT") return path === rulePath;
+  if (matchType === "PREFIX") return rulePath === "/" || path === rulePath || path.startsWith(`${rulePath}/`);
+  return false;
+}
+function parseUrl(url) {
+  try {
+    const parsed = new URL(String(url ?? ""));
+    const host = normalizeHost(parsed.hostname);
+    return host ? { host, path: normalizePath(parsed.pathname) } : null;
+  } catch {
+    return null;
+  }
+}
+function compileSensitivePatterns(filters) {
+  const patterns = [];
+  for (const filter of Array.isArray(filters) ? filters : []) {
+    const source = String(filter ?? "");
+    if (!source || source.length > MAX_PATTERN_LENGTH) continue;
+    const parts = source.match(/^\/(.+)\/([gimsuy]*)$/);
+    const body = parts ? parts[1] : source;
+    if (DANGEROUS_PATTERN.test(body)) continue;
+    let flags = parts ? parts[2] : "";
+    if (!flags.includes("g")) flags += "g";
+    if (!flags.includes("i")) flags += "i";
+    try {
+      patterns.push(new RegExp(body, flags));
+    } catch {
+    }
+  }
+  return patterns;
+}
+function hashString(text) {
+  let hash = 2166136261;
+  for (let i = 0; i < text.length; i++) {
+    hash ^= text.charCodeAt(i);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(16);
+}
+function buildHttpCapturePolicy(config) {
+  const policy = {
+    domainBlacklist: (config?.httpDomainBlackList ?? []).map(normalizeHost).filter(Boolean),
+    pathBlacklist: Array.isArray(config?.httpPathBlackList) ? config.httpPathBlackList : [],
+    captureConfig: config?.httpPayloadCaptureConfig ?? null,
+    sensitivePatterns: compileSensitivePatterns(config?.sensitiveInfoFilter)
+  };
+  policy.fingerprint = hashString(JSON.stringify([
+    policy.domainBlacklist,
+    policy.pathBlacklist,
+    policy.captureConfig,
+    policy.sensitivePatterns.map((pattern) => `${pattern.source}/${pattern.flags}`)
+  ]));
+  return policy;
+}
+function shouldIgnoreHttpUrl(url, policy) {
+  const target = parseUrl(url);
+  if (!target || !policy) return false;
+  if (policy.domainBlacklist.some((domain) => domainMatches(target.host, domain))) return true;
+  return policy.pathBlacklist.some((rule) => {
+    const ruleHost = normalizeHost(rule?.host);
+    if (!ruleHost || !domainMatches(target.host, ruleHost)) return false;
+    return pathMatches(target.path, normalizePath(rule.path), rule.matchType);
+  });
+}
+function resolveDisabledPayloadFields(url, captureConfig) {
+  const disabled = {
+    requestHeaders: captureConfig?.disableRequestHeaders === true,
+    requestBody: captureConfig?.disableRequestBody === true,
+    responseHeaders: captureConfig?.disableResponseHeaders === true,
+    responseBody: captureConfig?.disableResponseBody === true
+  };
+  const target = parseUrl(url);
+  if (!captureConfig || !target) return disabled;
+  for (const rule of captureConfig.rules ?? []) {
+    const ruleHost = normalizeHost(rule?.host);
+    if (!ruleHost || !domainMatches(target.host, ruleHost)) continue;
+    if (rule.path && String(rule.path).trim() && !pathMatches(target.path, normalizePath(rule.path), rule.matchType)) {
+      continue;
+    }
+    disabled.requestHeaders || (disabled.requestHeaders = rule.disableRequestHeaders === true);
+    disabled.requestBody || (disabled.requestBody = rule.disableRequestBody === true);
+    disabled.responseHeaders || (disabled.responseHeaders = rule.disableResponseHeaders === true);
+    disabled.responseBody || (disabled.responseBody = rule.disableResponseBody === true);
+  }
+  return disabled;
+}
+function maskSensitive(text, patterns) {
+  if (typeof text !== "string" || !patterns?.length) return text;
+  let output = text;
+  for (const regex of patterns) {
+    regex.lastIndex = 0;
+    output = output.replace(regex, (...args) => {
+      const groups = args.slice(1, -2).filter((group) => typeof group === "string" || group === void 0);
+      const present = groups.filter((group) => group !== void 0 && group !== "");
+      if (present.length === 3) return `${groups[0]}${MASK}${groups[2]}`;
+      if (present.length === 2) return `${groups[0]}${MASK}`;
+      return MASK;
+    });
+  }
+  return output;
+}
+function maskStructured(value, patterns) {
+  if (value == null || !patterns.length) return value;
+  if (typeof value === "string") return maskSensitive(value, patterns);
+  try {
+    return JSON.parse(maskSensitive(JSON.stringify(value), patterns));
+  } catch {
+    return value;
+  }
+}
+function maskCredentialHeaders(headers) {
+  if (!headers || typeof headers !== "object") return {};
+  const out = {};
+  for (const [key, value] of Object.entries(headers)) {
+    out[key] = ALWAYS_MASKED_HEADERS.has(String(key).toLowerCase()) ? MASK : value;
+  }
+  return out;
+}
+function applyHttpCapturePolicy(payload, policy) {
+  if (!payload) return null;
+  const effective = policy ?? buildHttpCapturePolicy(null);
+  if (shouldIgnoreHttpUrl(payload.url, effective)) return null;
+  const disabled = resolveDisabledPayloadFields(payload.url, effective.captureConfig);
+  const patterns = effective.sensitivePatterns;
+  return {
+    ...payload,
+    url: maskSensitive(String(payload.url ?? ""), patterns),
+    requestHeaders: disabled.requestHeaders ? {} : maskStructured(maskCredentialHeaders(payload.requestHeaders), patterns),
+    requestBody: disabled.requestBody ? null : maskStructured(payload.requestBody ?? null, patterns),
+    responseHeaders: disabled.responseHeaders ? {} : maskStructured(maskCredentialHeaders(payload.responseHeaders), patterns),
+    responseBody: disabled.responseBody ? null : maskStructured(payload.responseBody ?? null, patterns)
+  };
+}
+
 // src/push/pushModule.js
 function hasWindow2() {
   return typeof window !== "undefined";
@@ -540,7 +702,7 @@ var PushModule = class {
    *   serviceWorkerRegistration?: ServiceWorkerRegistration | null,
    *   isPushEnabled?: boolean,
    *   onRemoteMessageReceived?: ((payload: any) => void) | null,
-   *   apiKey?: string,
+   *   appId?: string,
    *   apiBase?: string,
    *   deviceId?: string,
    *   getSessionToken?: (() => string | null) | null,
@@ -558,7 +720,7 @@ var PushModule = class {
     this.serviceWorkerRegistration = cfg.serviceWorkerRegistration ?? null;
     this.isPushEnabled = cfg.isPushEnabled !== false;
     this.onRemoteMessageReceived = typeof cfg.onRemoteMessageReceived === "function" ? cfg.onRemoteMessageReceived : null;
-    this.apiKey = cfg.apiKey ?? null;
+    this.appId = cfg.appId ?? null;
     this.apiBase = cfg.apiBase ?? "";
     this.deviceId = cfg.deviceId ?? null;
     this.getSessionToken = typeof cfg.getSessionToken === "function" ? cfg.getSessionToken : null;
@@ -880,7 +1042,7 @@ var PushModule = class {
       config: {
         vapidPublicKey: this.vapidPublicKey,
         apiBase: this.apiBase,
-        apiKey: this.apiKey,
+        appId: this.appId,
         sessionToken: this.getSessionToken ? this.getSessionToken() : null,
         deviceUuid: this.deviceId
       }
@@ -1696,6 +1858,105 @@ function decodeWebPushConfig(buf) {
   }
   return result;
 }
+var HTTP_PATH_MATCH_TYPES = ["EXACT", "PREFIX"];
+function decodeHttpPathMatchType(value) {
+  return HTTP_PATH_MATCH_TYPES[value] ?? null;
+}
+function decodeHttpPathBlacklistRule(buf) {
+  const r = new ProtoReader(buf);
+  const result = { host: "", path: "", matchType: "EXACT" };
+  while (r.hasMore()) {
+    const tag = r.readTag();
+    switch (tag.fieldNumber) {
+      case 1:
+        result.host = r.readString();
+        break;
+      case 2:
+        result.path = r.readString();
+        break;
+      case 3:
+        result.matchType = decodeHttpPathMatchType(r.readVarint());
+        break;
+      default:
+        r.skip(tag.wireType);
+    }
+  }
+  return result;
+}
+function decodeHttpPayloadCaptureRule(buf) {
+  const r = new ProtoReader(buf);
+  const result = {
+    host: "",
+    path: null,
+    matchType: "EXACT",
+    disableRequestHeaders: false,
+    disableRequestBody: false,
+    disableResponseHeaders: false,
+    disableResponseBody: false
+  };
+  while (r.hasMore()) {
+    const tag = r.readTag();
+    switch (tag.fieldNumber) {
+      case 1:
+        result.host = r.readString();
+        break;
+      case 2:
+        result.path = r.readString();
+        break;
+      case 3:
+        result.matchType = decodeHttpPathMatchType(r.readVarint());
+        break;
+      case 4:
+        result.disableRequestHeaders = r.readBool();
+        break;
+      case 5:
+        result.disableRequestBody = r.readBool();
+        break;
+      case 6:
+        result.disableResponseHeaders = r.readBool();
+        break;
+      case 7:
+        result.disableResponseBody = r.readBool();
+        break;
+      default:
+        r.skip(tag.wireType);
+    }
+  }
+  return result;
+}
+function decodeHttpPayloadCaptureConfig(buf) {
+  const r = new ProtoReader(buf);
+  const result = {
+    disableRequestHeaders: false,
+    disableRequestBody: false,
+    disableResponseHeaders: false,
+    disableResponseBody: false,
+    rules: []
+  };
+  while (r.hasMore()) {
+    const tag = r.readTag();
+    switch (tag.fieldNumber) {
+      case 1:
+        result.disableRequestHeaders = r.readBool();
+        break;
+      case 2:
+        result.disableRequestBody = r.readBool();
+        break;
+      case 3:
+        result.disableResponseHeaders = r.readBool();
+        break;
+      case 4:
+        result.disableResponseBody = r.readBool();
+        break;
+      case 5:
+        result.rules.push(decodeHttpPayloadCaptureRule(r.readBytes()));
+        break;
+      default:
+        r.skip(tag.wireType);
+    }
+  }
+  return result;
+}
 function decodeSdkRiskConfig(buf) {
   const r = new ProtoReader(buf);
   const result = {
@@ -1732,6 +1993,8 @@ function decodeConfigResponse(buf) {
     isCrashTrackingEnabled: false,
     isEventTrackingEnabled: false,
     httpDomainBlackList: [],
+    httpPathBlackList: [],
+    httpPayloadCaptureConfig: null,
     sensitiveInfoFilter: [],
     sslPinning: null,
     accessToken: "",
@@ -1792,6 +2055,12 @@ function decodeConfigResponse(buf) {
       case 15:
         result.isEventTrackingEnabled = r.readBool();
         break;
+      case 16:
+        result.httpPathBlackList.push(decodeHttpPathBlacklistRule(r.readBytes()));
+        break;
+      case 17:
+        result.httpPayloadCaptureConfig = decodeHttpPayloadCaptureConfig(r.readBytes());
+        break;
       case 18:
         result.webPushConfig = decodeWebPushConfig(r.readBytes());
         break;
@@ -1961,7 +2230,7 @@ var EventModule = class {
    *   getSessionId: () => string,
    *   getUserUuid: () => string|null,
    *   release: string|undefined,
-   *   apiKey: string,
+   *   appId: string,
    *   apiBase: string,
    *   isEventTrackingEnabled: boolean,
    *   isFirstVisit: boolean,
@@ -1978,7 +2247,7 @@ var EventModule = class {
     this._logEvent = typeof cfg.logEvent === "function" ? cfg.logEvent : null;
     this._getSessionToken = typeof cfg.getSessionToken === "function" ? cfg.getSessionToken : null;
     this._release = cfg.release ?? void 0;
-    this._apiKey = cfg.apiKey ?? "";
+    this._appId = cfg.appId ?? "";
     this._apiBase = cfg.apiBase ?? "";
     this._isEventTrackingEnabled = cfg.isEventTrackingEnabled === true;
     this._isFirstVisit = cfg.isFirstVisit === true;
@@ -2282,7 +2551,7 @@ var EventModule = class {
         headers: {
           "Content-Type": "application/x-protobuf",
           "Accept": "application/x-protobuf",
-          "x-api-key": this._apiKey,
+          "x-api-key": this._appId,
           "x-session-token": sessionToken
         },
         body: new Blob([protoBytes], { type: "application/x-protobuf" })
@@ -3475,6 +3744,7 @@ var LogDropClient = class {
     };
     this._activeIpReputationAction = this._loadStoredIpReputationAction();
     this._ipReputationExpiryTimer = null;
+    this._httpCapturePolicy = null;
     this._loadCachedServerConfig();
     this._user = this._loadPersistedExternalUser();
     this._errorHandlersInstalled = false;
@@ -4031,9 +4301,9 @@ var LogDropClient = class {
     const fetchFn = hasWindow5() ? window.fetch : typeof fetch !== "undefined" ? fetch : null;
     if (typeof fetchFn !== "function") return false;
     const osInfo = this._getOsInfo();
-    const last = this._lastSentUserUpdate?.apiKey === config.apiKey ? this._lastSentUserUpdate : null;
+    const last = this._lastSentUserUpdate?.appId === config.appId ? this._lastSentUserUpdate : null;
     const runtime = {
-      apiKey: config.apiKey,
+      appId: config.appId,
       userUuid: task.userUuid,
       osName: osInfo.osName,
       osVersion: osInfo.osVersion,
@@ -4063,7 +4333,7 @@ var LogDropClient = class {
     const headers = {
       "content-type": "application/x-protobuf",
       "accept": "application/x-protobuf",
-      "x-api-key": config.apiKey
+      "x-api-key": config.appId
     };
     let usedSignatureAuth = false;
     if (sessionToken) {
@@ -4301,6 +4571,7 @@ var LogDropClient = class {
           if (typeof parsed.data.isSDKDisabled === "boolean") {
             this._serverConfig.isSDKDisabled = parsed.data.isSDKDisabled;
           }
+          this._httpCapturePolicy = buildHttpCapturePolicy(parsed.data);
         }
       }
     } catch {
@@ -4322,6 +4593,9 @@ var LogDropClient = class {
     if (typeof data.isHttpLoggingEnabled === "boolean") {
       this._serverConfig.isHttpLoggingEnabled = data.isHttpLoggingEnabled;
     }
+    if ("httpDomainBlackList" in data || "httpPayloadCaptureConfig" in data || "sensitiveInfoFilter" in data) {
+      this._httpCapturePolicy = buildHttpCapturePolicy(data);
+    }
     if (typeof data.isCrashTrackingEnabled === "boolean" && this._crashTrackingOverride === null) {
       this._serverConfig.isCrashTrackingEnabled = data.isCrashTrackingEnabled;
     }
@@ -4381,7 +4655,7 @@ var LogDropClient = class {
       onEvent: (eventName, payload) => {
         if (eventName !== "network_activity") return;
         if (!this._serverConfig.isHttpLoggingEnabled || !this._config?.network?.enabled) return;
-        this._enqueue(LogLevel.NETWORK_ACTIVITY, payload, new LogFlow("NetworkActivity", payload.uuid));
+        this._recordNetworkActivity(payload);
       },
       getBaseHref,
       excludeUrls: this._config.network.excludeUrls,
@@ -4400,6 +4674,31 @@ var LogDropClient = class {
     });
     this._net.install();
   }
+  _recordNetworkActivity(payload) {
+    const recorded = applyHttpCapturePolicy(payload, this._httpCapturePolicy);
+    if (!recorded) return;
+    this._enqueue(LogLevel.NETWORK_ACTIVITY, recorded, new LogFlow("NetworkActivity", recorded.uuid));
+  }
+  // Logs captured before the init response, or under rules that have changed
+  // since, are filtered again with the current policy before upload; logs
+  // stored under the same rules are sent as they are. Returns null when the
+  // log must be dropped.
+  _applyHttpCapturePolicyToStoredLog(log) {
+    const policy = this._httpCapturePolicy;
+    if (!policy || log.level === LogLevel.DEVICEINFO) return log.message;
+    if (log.httpPolicyFingerprint === policy.fingerprint) return log.message;
+    if (log.level !== LogLevel.NETWORK_ACTIVITY) {
+      return maskSensitive(log.message, policy.sensitivePatterns);
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(log.message);
+    } catch {
+      return maskSensitive(log.message, policy.sensitivePatterns);
+    }
+    const recorded = applyHttpCapturePolicy(parsed, policy);
+    return recorded ? safeStringify(recorded) : null;
+  }
   _uninstallNetworkInstrumentation() {
     if (this._net) {
       this._net.uninstall();
@@ -4614,9 +4913,8 @@ var LogDropClient = class {
       this._warnInternal("[LogDrop] SDK is disabled by server configuration");
       return;
     }
-    if (!config || !config.appId) throw new Error("LogDrop.init requires config.appId");
-    const apiKey = String(config.apiKey || "").trim();
-    if (!apiKey) throw new Error("LogDrop.init requires config.apiKey");
+    const appId = String(config?.appId || "").trim();
+    if (!appId) throw new Error("LogDrop.init requires config.appId");
     const defaultWebSecretKey = config.webSecretKey == null ? LogDropConstants.DEFAULT_WEB_SECRET_KEY : config.webSecretKey;
     const webSecretKey = String(defaultWebSecretKey || "").trim() || null;
     const baseUrl = normalizeBaseUrl(config.baseUrl);
@@ -4643,8 +4941,7 @@ var LogDropClient = class {
       ]
     };
     this._config = {
-      appId: String(config.appId),
-      apiKey,
+      appId,
       webSecretKey,
       baseUrl,
       endpoint,
@@ -4687,7 +4984,7 @@ var LogDropClient = class {
       isPushEnabled: true,
       // default; overridden by server config in _applyServerConfig
       onRemoteMessageReceived: this._config.onRemoteMessageReceived,
-      apiKey: this._config.apiKey,
+      appId: this._config.appId,
       apiBase: this._config.baseUrl,
       deviceId: this._deviceId,
       getSessionToken: () => this._getAccessToken(),
@@ -4721,7 +5018,7 @@ var LogDropClient = class {
       // Mirror every successfully sent event into the log stream at EVENT level.
       logEvent: (eventLog) => this._enqueue(LogLevel.EVENT, eventLog),
       release: this._config.release,
-      apiKey: this._config.apiKey,
+      appId: this._config.appId,
       apiBase: this._config.baseUrl,
       isEventTrackingEnabled: this._serverConfig.isEventTrackingEnabled,
       isFirstVisit: this._isNewDevice,
@@ -5017,6 +5314,13 @@ var LogDropClient = class {
       // IMPORTANT: if message object convert => JSON string
       message: typeof message === "string" ? message : safeStringify(message)
     };
+    const policy = this._httpCapturePolicy;
+    if (policy && level !== LogLevel.DEVICEINFO) {
+      if (level !== LogLevel.NETWORK_ACTIVITY) {
+        entry.message = maskSensitive(entry.message, policy.sensitivePatterns);
+      }
+      entry.httpPolicyFingerprint = policy.fingerprint;
+    }
     if (tag) {
       entry.tag = tag;
     }
@@ -5102,6 +5406,7 @@ var LogDropClient = class {
         message: entry.message
       };
       if (entry.tag) logRecord.tag = entry.tag;
+      if (entry.httpPolicyFingerprint) logRecord.httpPolicyFingerprint = entry.httpPolicyFingerprint;
       if (logFlow && logFlow instanceof LogFlow) {
         logRecord.flowId = logFlow.id;
         logRecord.flowName = logFlow.name;
@@ -5403,11 +5708,16 @@ var LogDropClient = class {
     for (const [sessionId, logs] of Object.entries(sessionGroups)) {
       const sessionLogs = [];
       for (const log of logs) {
+        const message = this._applyHttpCapturePolicyToStoredLog(log);
+        if (message === null) {
+          chunk.droppedLogIds.push(log.id);
+          continue;
+        }
         const logEntry = {
           id: log.id,
           ts: log.ts,
           level: log.level,
-          message: log.message,
+          message,
           flowId: log.flowId,
           flowName: log.flowName,
           flowAttributes: log.flowAttributes
@@ -5480,7 +5790,7 @@ var LogDropClient = class {
         headers: {
           "content-type": "application/x-protobuf",
           "accept": "application/x-protobuf",
-          "x-api-key": this._config.apiKey,
+          "x-api-key": this._config.appId,
           "x-session-token": sessionToken
         },
         body: new Blob([protoBytes], { type: "application/x-protobuf" })
@@ -5526,7 +5836,7 @@ var LogDropClient = class {
         headers: {
           "content-type": "application/x-protobuf",
           "accept": "application/x-protobuf",
-          "x-api-key": this._config.apiKey,
+          "x-api-key": this._config.appId,
           "x-session-token": sessionToken
         },
         body: new Blob([protoBytes], { type: "application/x-protobuf" })
@@ -5625,7 +5935,8 @@ var LogDropClient = class {
     if (!this._dbPromise) return false;
     this._fileFlushInProgress = true;
     try {
-      const allLogs = await this._readAllLogs();
+      const storedLogs = await this._readAllLogs();
+      const allLogs = this._httpCapturePolicy ? storedLogs : storedLogs.filter((log) => log.level !== LogLevel.NETWORK_ACTIVITY);
       if (this._isInternalLoggingEnabled()) {
         this._logInternal(`[LogDrop DEBUG] _flushLogs called. DB log count: ${allLogs.length}`);
       }
@@ -5751,7 +6062,7 @@ var LogDropClient = class {
       const headers = {
         "content-type": "application/x-protobuf",
         "accept": "application/x-protobuf",
-        "x-api-key": this._config.apiKey
+        "x-api-key": this._config.appId
       };
       const sessionToken = this._getAccessToken();
       const refreshToken = this._getRefreshToken();