@log-drop/web 1.0.0-alpha3 → 1.0.0-alpha4

package/dist/index.cjs

@@ -38,7 +38,7 @@ LogDropConstants.DEFAULT_BASE_URL = "https://server.logdrop.io";
 LogDropConstants.DEFAULT_WEB_SECRET_KEY = "xuM9w0BAQEFx";
 LogDropConstants.FILE_EXPORT_INTERVAL_MS = 3e5;
 LogDropConstants.DEVICE_INFO_INTERVAL_MS = 1e4;
-LogDropConstants.SDK_VERSION = true ? "1.0.0-alpha3" : "1.0.0";
+LogDropConstants.SDK_VERSION = true ? "1.0.0-alpha4" : "1.0.0";
 LogDropConstants.STORAGE_CHECK_INTERVAL_MS = 12e4;
 LogDropConstants.MAX_LOCAL_STORAGE_SIZE = 5242880;
 LogDropConstants.DATABASE_MAX_STORAGE_LIMIT = 16e6;
@@ -540,6 +540,168 @@ var NetworkInstrumentation = class {
   }
 };
 
+// src/instrumentation/httpCapturePolicy.js
+var ALWAYS_MASKED_HEADERS = /* @__PURE__ */ new Set([
+  "authorization",
+  "proxy-authorization",
+  "x-auth-token",
+  "x-api-key",
+  "x-session-token",
+  "cookie",
+  "set-cookie"
+]);
+var MASK = "***";
+var MAX_PATTERN_LENGTH = 500;
+var DANGEROUS_PATTERN = /(a\+)\+|\(\.\*\)\+|\(\.\+\)\+/;
+function normalizeHost(value) {
+  const host = String(value ?? "").trim().replace(/\.+$/, "").toLowerCase();
+  if (!host || /[/:?#@]/.test(host) || host.length > 253) return null;
+  return host;
+}
+function normalizePath(value) {
+  const trimmed = String(value ?? "").trim();
+  if (!trimmed) return "/";
+  const withSlash = trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
+  return withSlash.length > 1 ? withSlash.replace(/\/+$/, "") : withSlash;
+}
+function domainMatches(host, ruleHost) {
+  return host === ruleHost || host.endsWith(`.${ruleHost}`);
+}
+function pathMatches(path, rulePath, matchType) {
+  if (matchType === "EXACT") return path === rulePath;
+  if (matchType === "PREFIX") return rulePath === "/" || path === rulePath || path.startsWith(`${rulePath}/`);
+  return false;
+}
+function parseUrl(url) {
+  try {
+    const parsed = new URL(String(url ?? ""));
+    const host = normalizeHost(parsed.hostname);
+    return host ? { host, path: normalizePath(parsed.pathname) } : null;
+  } catch {
+    return null;
+  }
+}
+function compileSensitivePatterns(filters) {
+  const patterns = [];
+  for (const filter of Array.isArray(filters) ? filters : []) {
+    const source = String(filter ?? "");
+    if (!source || source.length > MAX_PATTERN_LENGTH) continue;
+    const parts = source.match(/^\/(.+)\/([gimsuy]*)$/);
+    const body = parts ? parts[1] : source;
+    if (DANGEROUS_PATTERN.test(body)) continue;
+    let flags = parts ? parts[2] : "";
+    if (!flags.includes("g")) flags += "g";
+    if (!flags.includes("i")) flags += "i";
+    try {
+      patterns.push(new RegExp(body, flags));
+    } catch {
+    }
+  }
+  return patterns;
+}
+function hashString(text) {
+  let hash = 2166136261;
+  for (let i = 0; i < text.length; i++) {
+    hash ^= text.charCodeAt(i);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(16);
+}
+function buildHttpCapturePolicy(config) {
+  const policy = {
+    domainBlacklist: (config?.httpDomainBlackList ?? []).map(normalizeHost).filter(Boolean),
+    pathBlacklist: Array.isArray(config?.httpPathBlackList) ? config.httpPathBlackList : [],
+    captureConfig: config?.httpPayloadCaptureConfig ?? null,
+    sensitivePatterns: compileSensitivePatterns(config?.sensitiveInfoFilter)
+  };
+  policy.fingerprint = hashString(JSON.stringify([
+    policy.domainBlacklist,
+    policy.pathBlacklist,
+    policy.captureConfig,
+    policy.sensitivePatterns.map((pattern) => `${pattern.source}/${pattern.flags}`)
+  ]));
+  return policy;
+}
+function shouldIgnoreHttpUrl(url, policy) {
+  const target = parseUrl(url);
+  if (!target || !policy) return false;
+  if (policy.domainBlacklist.some((domain) => domainMatches(target.host, domain))) return true;
+  return policy.pathBlacklist.some((rule) => {
+    const ruleHost = normalizeHost(rule?.host);
+    if (!ruleHost || !domainMatches(target.host, ruleHost)) return false;
+    return pathMatches(target.path, normalizePath(rule.path), rule.matchType);
+  });
+}
+function resolveDisabledPayloadFields(url, captureConfig) {
+  const disabled = {
+    requestHeaders: captureConfig?.disableRequestHeaders === true,
+    requestBody: captureConfig?.disableRequestBody === true,
+    responseHeaders: captureConfig?.disableResponseHeaders === true,
+    responseBody: captureConfig?.disableResponseBody === true
+  };
+  const target = parseUrl(url);
+  if (!captureConfig || !target) return disabled;
+  for (const rule of captureConfig.rules ?? []) {
+    const ruleHost = normalizeHost(rule?.host);
+    if (!ruleHost || !domainMatches(target.host, ruleHost)) continue;
+    if (rule.path && String(rule.path).trim() && !pathMatches(target.path, normalizePath(rule.path), rule.matchType)) {
+      continue;
+    }
+    disabled.requestHeaders || (disabled.requestHeaders = rule.disableRequestHeaders === true);
+    disabled.requestBody || (disabled.requestBody = rule.disableRequestBody === true);
+    disabled.responseHeaders || (disabled.responseHeaders = rule.disableResponseHeaders === true);
+    disabled.responseBody || (disabled.responseBody = rule.disableResponseBody === true);
+  }
+  return disabled;
+}
+function maskSensitive(text, patterns) {
+  if (typeof text !== "string" || !patterns?.length) return text;
+  let output = text;
+  for (const regex of patterns) {
+    regex.lastIndex = 0;
+    output = output.replace(regex, (...args) => {
+      const groups = args.slice(1, -2).filter((group) => typeof group === "string" || group === void 0);
+      const present = groups.filter((group) => group !== void 0 && group !== "");
+      if (present.length === 3) return `${groups[0]}${MASK}${groups[2]}`;
+      if (present.length === 2) return `${groups[0]}${MASK}`;
+      return MASK;
+    });
+  }
+  return output;
+}
+function maskStructured(value, patterns) {
+  if (value == null || !patterns.length) return value;
+  if (typeof value === "string") return maskSensitive(value, patterns);
+  try {
+    return JSON.parse(maskSensitive(JSON.stringify(value), patterns));
+  } catch {
+    return value;
+  }
+}
+function maskCredentialHeaders(headers) {
+  if (!headers || typeof headers !== "object") return {};
+  const out = {};
+  for (const [key, value] of Object.entries(headers)) {
+    out[key] = ALWAYS_MASKED_HEADERS.has(String(key).toLowerCase()) ? MASK : value;
+  }
+  return out;
+}
+function applyHttpCapturePolicy(payload, policy) {
+  if (!payload) return null;
+  const effective = policy ?? buildHttpCapturePolicy(null);
+  if (shouldIgnoreHttpUrl(payload.url, effective)) return null;
+  const disabled = resolveDisabledPayloadFields(payload.url, effective.captureConfig);
+  const patterns = effective.sensitivePatterns;
+  return {
+    ...payload,
+    url: maskSensitive(String(payload.url ?? ""), patterns),
+    requestHeaders: disabled.requestHeaders ? {} : maskStructured(maskCredentialHeaders(payload.requestHeaders), patterns),
+    requestBody: disabled.requestBody ? null : maskStructured(payload.requestBody ?? null, patterns),
+    responseHeaders: disabled.responseHeaders ? {} : maskStructured(maskCredentialHeaders(payload.responseHeaders), patterns),
+    responseBody: disabled.responseBody ? null : maskStructured(payload.responseBody ?? null, patterns)
+  };
+}
+
 // src/push/pushModule.js
 function hasWindow2() {
   return typeof window !== "undefined";
@@ -1725,6 +1887,105 @@ function decodeWebPushConfig(buf) {
   }
   return result;
 }
+var HTTP_PATH_MATCH_TYPES = ["EXACT", "PREFIX"];
+function decodeHttpPathMatchType(value) {
+  return HTTP_PATH_MATCH_TYPES[value] ?? null;
+}
+function decodeHttpPathBlacklistRule(buf) {
+  const r = new ProtoReader(buf);
+  const result = { host: "", path: "", matchType: "EXACT" };
+  while (r.hasMore()) {
+    const tag = r.readTag();
+    switch (tag.fieldNumber) {
+      case 1:
+        result.host = r.readString();
+        break;
+      case 2:
+        result.path = r.readString();
+        break;
+      case 3:
+        result.matchType = decodeHttpPathMatchType(r.readVarint());
+        break;
+      default:
+        r.skip(tag.wireType);
+    }
+  }
+  return result;
+}
+function decodeHttpPayloadCaptureRule(buf) {
+  const r = new ProtoReader(buf);
+  const result = {
+    host: "",
+    path: null,
+    matchType: "EXACT",
+    disableRequestHeaders: false,
+    disableRequestBody: false,
+    disableResponseHeaders: false,
+    disableResponseBody: false
+  };
+  while (r.hasMore()) {
+    const tag = r.readTag();
+    switch (tag.fieldNumber) {
+      case 1:
+        result.host = r.readString();
+        break;
+      case 2:
+        result.path = r.readString();
+        break;
+      case 3:
+        result.matchType = decodeHttpPathMatchType(r.readVarint());
+        break;
+      case 4:
+        result.disableRequestHeaders = r.readBool();
+        break;
+      case 5:
+        result.disableRequestBody = r.readBool();
+        break;
+      case 6:
+        result.disableResponseHeaders = r.readBool();
+        break;
+      case 7:
+        result.disableResponseBody = r.readBool();
+        break;
+      default:
+        r.skip(tag.wireType);
+    }
+  }
+  return result;
+}
+function decodeHttpPayloadCaptureConfig(buf) {
+  const r = new ProtoReader(buf);
+  const result = {
+    disableRequestHeaders: false,
+    disableRequestBody: false,
+    disableResponseHeaders: false,
+    disableResponseBody: false,
+    rules: []
+  };
+  while (r.hasMore()) {
+    const tag = r.readTag();
+    switch (tag.fieldNumber) {
+      case 1:
+        result.disableRequestHeaders = r.readBool();
+        break;
+      case 2:
+        result.disableRequestBody = r.readBool();
+        break;
+      case 3:
+        result.disableResponseHeaders = r.readBool();
+        break;
+      case 4:
+        result.disableResponseBody = r.readBool();
+        break;
+      case 5:
+        result.rules.push(decodeHttpPayloadCaptureRule(r.readBytes()));
+        break;
+      default:
+        r.skip(tag.wireType);
+    }
+  }
+  return result;
+}
 function decodeSdkRiskConfig(buf) {
   const r = new ProtoReader(buf);
   const result = {
@@ -1761,6 +2022,8 @@ function decodeConfigResponse(buf) {
     isCrashTrackingEnabled: false,
     isEventTrackingEnabled: false,
     httpDomainBlackList: [],
+    httpPathBlackList: [],
+    httpPayloadCaptureConfig: null,
     sensitiveInfoFilter: [],
     sslPinning: null,
     accessToken: "",
@@ -1821,6 +2084,12 @@ function decodeConfigResponse(buf) {
       case 15:
         result.isEventTrackingEnabled = r.readBool();
         break;
+      case 16:
+        result.httpPathBlackList.push(decodeHttpPathBlacklistRule(r.readBytes()));
+        break;
+      case 17:
+        result.httpPayloadCaptureConfig = decodeHttpPayloadCaptureConfig(r.readBytes());
+        break;
       case 18:
         result.webPushConfig = decodeWebPushConfig(r.readBytes());
         break;
@@ -3504,6 +3773,7 @@ var LogDropClient = class {
     };
     this._activeIpReputationAction = this._loadStoredIpReputationAction();
     this._ipReputationExpiryTimer = null;
+    this._httpCapturePolicy = null;
     this._loadCachedServerConfig();
     this._user = this._loadPersistedExternalUser();
     this._errorHandlersInstalled = false;
@@ -4330,6 +4600,7 @@ var LogDropClient = class {
           if (typeof parsed.data.isSDKDisabled === "boolean") {
             this._serverConfig.isSDKDisabled = parsed.data.isSDKDisabled;
           }
+          this._httpCapturePolicy = buildHttpCapturePolicy(parsed.data);
         }
       }
     } catch {
@@ -4351,6 +4622,9 @@ var LogDropClient = class {
     if (typeof data.isHttpLoggingEnabled === "boolean") {
       this._serverConfig.isHttpLoggingEnabled = data.isHttpLoggingEnabled;
     }
+    if ("httpDomainBlackList" in data || "httpPayloadCaptureConfig" in data || "sensitiveInfoFilter" in data) {
+      this._httpCapturePolicy = buildHttpCapturePolicy(data);
+    }
     if (typeof data.isCrashTrackingEnabled === "boolean" && this._crashTrackingOverride === null) {
       this._serverConfig.isCrashTrackingEnabled = data.isCrashTrackingEnabled;
     }
@@ -4410,7 +4684,7 @@ var LogDropClient = class {
       onEvent: (eventName, payload) => {
         if (eventName !== "network_activity") return;
         if (!this._serverConfig.isHttpLoggingEnabled || !this._config?.network?.enabled) return;
-        this._enqueue(LogLevel.NETWORK_ACTIVITY, payload, new LogFlow("NetworkActivity", payload.uuid));
+        this._recordNetworkActivity(payload);
       },
       getBaseHref,
       excludeUrls: this._config.network.excludeUrls,
@@ -4429,6 +4703,31 @@ var LogDropClient = class {
     });
     this._net.install();
   }
+  _recordNetworkActivity(payload) {
+    const recorded = applyHttpCapturePolicy(payload, this._httpCapturePolicy);
+    if (!recorded) return;
+    this._enqueue(LogLevel.NETWORK_ACTIVITY, recorded, new LogFlow("NetworkActivity", recorded.uuid));
+  }
+  // Logs captured before the init response, or under rules that have changed
+  // since, are filtered again with the current policy before upload; logs
+  // stored under the same rules are sent as they are. Returns null when the
+  // log must be dropped.
+  _applyHttpCapturePolicyToStoredLog(log) {
+    const policy = this._httpCapturePolicy;
+    if (!policy || log.level === LogLevel.DEVICEINFO) return log.message;
+    if (log.httpPolicyFingerprint === policy.fingerprint) return log.message;
+    if (log.level !== LogLevel.NETWORK_ACTIVITY) {
+      return maskSensitive(log.message, policy.sensitivePatterns);
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(log.message);
+    } catch {
+      return maskSensitive(log.message, policy.sensitivePatterns);
+    }
+    const recorded = applyHttpCapturePolicy(parsed, policy);
+    return recorded ? safeStringify(recorded) : null;
+  }
   _uninstallNetworkInstrumentation() {
     if (this._net) {
       this._net.uninstall();
@@ -5044,6 +5343,13 @@ var LogDropClient = class {
       // IMPORTANT: if message object convert => JSON string
       message: typeof message === "string" ? message : safeStringify(message)
     };
+    const policy = this._httpCapturePolicy;
+    if (policy && level !== LogLevel.DEVICEINFO) {
+      if (level !== LogLevel.NETWORK_ACTIVITY) {
+        entry.message = maskSensitive(entry.message, policy.sensitivePatterns);
+      }
+      entry.httpPolicyFingerprint = policy.fingerprint;
+    }
     if (tag) {
       entry.tag = tag;
     }
@@ -5129,6 +5435,7 @@ var LogDropClient = class {
         message: entry.message
       };
       if (entry.tag) logRecord.tag = entry.tag;
+      if (entry.httpPolicyFingerprint) logRecord.httpPolicyFingerprint = entry.httpPolicyFingerprint;
       if (logFlow && logFlow instanceof LogFlow) {
         logRecord.flowId = logFlow.id;
         logRecord.flowName = logFlow.name;
@@ -5430,11 +5737,16 @@ var LogDropClient = class {
     for (const [sessionId, logs] of Object.entries(sessionGroups)) {
       const sessionLogs = [];
       for (const log of logs) {
+        const message = this._applyHttpCapturePolicyToStoredLog(log);
+        if (message === null) {
+          chunk.droppedLogIds.push(log.id);
+          continue;
+        }
         const logEntry = {
           id: log.id,
           ts: log.ts,
           level: log.level,
-          message: log.message,
+          message,
           flowId: log.flowId,
           flowName: log.flowName,
           flowAttributes: log.flowAttributes
@@ -5652,7 +5964,8 @@ var LogDropClient = class {
     if (!this._dbPromise) return false;
     this._fileFlushInProgress = true;
     try {
-      const allLogs = await this._readAllLogs();
+      const storedLogs = await this._readAllLogs();
+      const allLogs = this._httpCapturePolicy ? storedLogs : storedLogs.filter((log) => log.level !== LogLevel.NETWORK_ACTIVITY);
       if (this._isInternalLoggingEnabled()) {
         this._logInternal(`[LogDrop DEBUG] _flushLogs called. DB log count: ${allLogs.length}`);
       }