@loggerjs/processors 0.1.0 → 0.3.1

package/README.md

@@ -50,7 +50,7 @@ const middleware = [
 ];
 
 const processors = [
-  redactProcessor({ keys: ["password", "token", /secret/i] }),
+  redactProcessor({ keys: ["password", "token", /secret/i], censor: "[hidden]" }),
   privacyGuardProcessor({ maxStringLength: 8192, allowKeys: ["publicToken"] }),
   schemaDevCheckProcessor({
     validators: { "order.created": (data) => (typeof data === "object" && data ? true : "bad payload") },
@@ -91,6 +91,7 @@ const processors = [
 - **Prefer middleware** for metadata and enrichment that can run before event projection — it's the cheapest place to drop or annotate a record.
 - **Use processors** for event-only behavior: routing, schema checks, sampling, buffering, and filtering on the resolved event shape.
 - **Configuring any processor disables the record fast path** for that logger, because every log must then be projected to an event. That is the correct trade when you need event-level behavior — see [PROCESSORS.md](../../docs/PROCESSORS.md) and [PERFORMANCE.md](../../docs/PERFORMANCE.md).
+- `redactProcessor()` supports exact `keys`/`paths`, regex/custom matchers, the Pino-compatible `censor` alias, and `remove: true` for omitting matched object fields. It does not compile user paths with `eval` or `new Function`.
 - `fingersCrossedProcessor` accepts a `flushTo` transport or sink to replay buffered pre-trigger events. `routeProcessor` targets **named** transports, so name the transports you route to. Expensive I/O and serialization belong in transports, not processors.
 
 ## Documentation

package/dist/index.cjs

@@ -4,7 +4,12 @@ let _loggerjs_core = require("@loggerjs/core");
 function matchesKey(key, path, value, matchers) {
 	return matchers.some((matcher) => {
 		if (typeof matcher === "string") return matcher.toLowerCase() === key.toLowerCase();
-		if (matcher instanceof RegExp) return matcher.test(key) || matcher.test(path);
+		if (matcher instanceof RegExp) {
+			matcher.lastIndex = 0;
+			const keyMatches = matcher.test(key);
+			matcher.lastIndex = 0;
+			return keyMatches || matcher.test(path);
+		}
 		return matcher(key, path, value);
 	});
 }
@@ -29,8 +34,10 @@ function redactValue(value, options, path = "", depth = 0, seen = /* @__PURE__ *
 	seen.set(value, out);
 	for (const [key, child] of Object.entries(input)) {
 		const childPath = path ? `${path}.${key}` : key;
-		if (matchesKey(key, childPath, child, options.keys ?? []) || pathMatches(childPath, options.paths ?? [])) out[key] = options.replacement;
-		else out[key] = redactValue(child, options, childPath, depth + 1, seen);
+		if (matchesKey(key, childPath, child, options.keys ?? []) || pathMatches(childPath, options.paths ?? [])) {
+			if (options.remove) continue;
+			out[key] = options.replacement;
+		} else out[key] = redactValue(child, options, childPath, depth + 1, seen);
 	}
 	return out;
 }
@@ -48,7 +55,8 @@ function redactProcessor(options = {}) {
 			"api_key"
 		],
 		paths: options.paths ?? [],
-		replacement: options.replacement ?? "[REDACTED]",
+		replacement: options.replacement ?? options.censor ?? "[REDACTED]",
+		remove: options.remove ?? false,
 		maxDepth: options.maxDepth ?? 8
 	};
 	return (event) => ({
@@ -999,21 +1007,87 @@ function passesLuhn(input) {
 	}
 	return sum % 10 === 0;
 }
-const DEFAULT_PATTERNS = [
-	{
-		name: "email",
-		pattern: /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi
-	},
-	{
-		name: "bearer-token",
-		pattern: /\bBearer\s+[A-Za-z0-9._~+/=-]+\b/g
-	},
-	{
-		name: "credit-card",
-		pattern: /\b(?:\d[ -]*?){13,19}\b/g,
-		validate: passesLuhn
+const DEFAULT_PATTERNS = [{
+	name: "bearer-token",
+	pattern: /\bBearer\s+[A-Za-z0-9._~+/=-]+\b/g
+}, {
+	name: "credit-card",
+	pattern: /\b(?:\d[ -]*?){13,19}\b/g,
+	validate: passesLuhn
+}];
+function isAsciiAlpha(code) {
+	return code >= 65 && code <= 90 || code >= 97 && code <= 122;
+}
+function isAsciiAlphaNumeric(code) {
+	return isAsciiAlpha(code) || code >= 48 && code <= 57;
+}
+function hasChar(code, chars) {
+	return chars.includes(String.fromCharCode(code));
+}
+function isEmailLocalChar(code) {
+	return isAsciiAlphaNumeric(code) || hasChar(code, "._%+-");
+}
+function isEmailDomainChar(code) {
+	return isAsciiAlphaNumeric(code) || hasChar(code, "-.");
+}
+function hasValidEmailDomain(input, start, end) {
+	let labelLength = 0;
+	let dotCount = 0;
+	let tldStart = -1;
+	for (let index = start; index < end; index += 1) {
+		if (input.charCodeAt(index) === 46) {
+			if (labelLength === 0) return false;
+			dotCount += 1;
+			labelLength = 0;
+			tldStart = index + 1;
+			continue;
+		}
+		labelLength += 1;
 	}
-];
+	if (dotCount === 0 || labelLength === 0 || tldStart < 0 || end - tldStart < 2) return false;
+	for (let index = tldStart; index < end; index += 1) if (!isAsciiAlpha(input.charCodeAt(index))) return false;
+	return true;
+}
+function redactEmailAddresses(input, path, options) {
+	let output = "";
+	let last = 0;
+	let changed = false;
+	let index = 0;
+	while (index < input.length) {
+		if (!isAsciiAlphaNumeric(input.charCodeAt(index))) {
+			index += 1;
+			continue;
+		}
+		const localStart = index;
+		let cursor = index + 1;
+		while (cursor < input.length && isEmailLocalChar(input.charCodeAt(cursor))) cursor += 1;
+		if (input.charCodeAt(cursor) !== 64) {
+			index = cursor + 1;
+			continue;
+		}
+		const domainStart = cursor + 1;
+		cursor = domainStart;
+		while (cursor < input.length && isEmailDomainChar(input.charCodeAt(cursor))) cursor += 1;
+		if (domainStart < cursor && hasValidEmailDomain(input, domainStart, cursor) && (cursor >= input.length || !isEmailLocalChar(input.charCodeAt(cursor)))) {
+			output += input.slice(last, localStart);
+			output += options.replacement;
+			options.onRedact?.(path, "email");
+			last = cursor;
+			changed = true;
+			index = cursor;
+			continue;
+		}
+		index = domainStart;
+	}
+	if (!changed) return {
+		value: input,
+		changed: false
+	};
+	return {
+		value: output + input.slice(last),
+		changed: true
+	};
+}
 function matcherMatches(matcher, key, path, value) {
 	if (typeof matcher === "string") return matcher.toLowerCase() === key.toLowerCase();
 	if (matcher instanceof RegExp) {
@@ -1031,21 +1105,34 @@ function redact(path, reason, options) {
 }
 function guardString(input, path, options) {
 	let value = input;
+	let changed = false;
+	if (value.length > options.maxStringLength) {
+		options.onRedact?.(path, "max-string-length");
+		value = `${value.slice(0, options.maxStringLength)}${options.truncateSuffix}`;
+		changed = true;
+	}
+	if (options.redactDefaultEmailPattern) {
+		const emailResult = redactEmailAddresses(value, path, options);
+		value = emailResult.value;
+		changed ||= emailResult.changed;
+	}
 	for (const item of options.patterns) {
 		item.pattern.lastIndex = 0;
 		value = value.replace(item.pattern, (match) => {
 			if (item.validate && !item.validate(match)) return match;
 			options.onRedact?.(path, item.name);
+			changed = true;
 			return item.replacement ?? options.replacement;
 		});
 	}
 	if (value.length > options.maxStringLength) {
 		options.onRedact?.(path, "max-string-length");
 		value = `${value.slice(0, options.maxStringLength)}${options.truncateSuffix}`;
+		changed = true;
 	}
 	return {
 		value,
-		changed: value !== input
+		changed: changed || value !== input
 	};
 }
 function guardValue(value, path, key, depth, options, seen) {
@@ -1124,6 +1211,7 @@ function privacyGuardProcessor(options = {}) {
 		denyKeys: options.denyKeys ?? DEFAULT_DENY_KEYS,
 		allowKeys: options.allowKeys ?? [],
 		patterns: options.patterns ?? DEFAULT_PATTERNS,
+		redactDefaultEmailPattern: options.patterns === void 0,
 		replacement: options.replacement ?? "[REDACTED]",
 		maxDepth: Math.max(0, Math.floor(options.maxDepth ?? 8)),
 		maxStringLength: Math.max(1, Math.floor(options.maxStringLength ?? 8192)),