@logtape/redaction 1.2.0-dev.363 → 1.2.0-dev.367

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@logtape/redaction",
-  "version": "1.2.0-dev.363+b6095707",
+  "version": "1.2.0-dev.367+d4fd9984",
   "license": "MIT",
   "exports": "./src/mod.ts",
   "exclude": [

package/dist/field.cjs

@@ -78,7 +78,11 @@ function redactProperties(properties, options) {
 			continue;
 		}
 		const value = copy[field];
-		if (typeof value === "object" && value !== null && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null)) copy[field] = redactProperties(value, options);
+		if (Array.isArray(value)) copy[field] = value.map((item) => {
+			if (typeof item === "object" && item !== null && (Object.getPrototypeOf(item) === Object.prototype || Object.getPrototypeOf(item) === null)) return redactProperties(item, options);
+			return item;
+		});
+		else if (typeof value === "object" && value !== null && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null)) copy[field] = redactProperties(value, options);
 	}
 	return copy;
 }

package/dist/field.js

@@ -77,7 +77,11 @@ function redactProperties(properties, options) {
 			continue;
 		}
 		const value = copy[field];
-		if (typeof value === "object" && value !== null && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null)) copy[field] = redactProperties(value, options);
+		if (Array.isArray(value)) copy[field] = value.map((item) => {
+			if (typeof item === "object" && item !== null && (Object.getPrototypeOf(item) === Object.prototype || Object.getPrototypeOf(item) === null)) return redactProperties(item, options);
+			return item;
+		});
+		else if (typeof value === "object" && value !== null && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null)) copy[field] = redactProperties(value, options);
 	}
 	return copy;
 }

package/dist/field.js.map

@@ -1 +1 @@
-{"version":3,"file":"field.js","names":["DEFAULT_REDACT_FIELDS: FieldPatterns","sink: Sink | Sink & Disposable | Sink & AsyncDisposable","options: FieldRedactionOptions | FieldPatterns","record: LogRecord","properties: Record<string, unknown>","options: FieldRedactionOptions","field: string","fieldPatterns: FieldPatterns"],"sources":["../src/field.ts"],"sourcesContent":["import type { LogRecord, Sink } from \"@logtape/logtape\";\n\n/**\n * The type for a field pattern used in redaction.  A string or a regular\n * expression that matches field names.\n * @since 0.10.0\n */\nexport type FieldPattern = string | RegExp;\n\n/**\n * An array of field patterns used for redaction.  Each pattern can be\n * a string or a regular expression that matches field names.\n * @since 0.10.0\n */\nexport type FieldPatterns = FieldPattern[];\n\n/**\n * Default field patterns for redaction.  These patterns will match\n * common sensitive fields such as passwords, tokens, and personal\n * information.\n * @since 0.10.0\n */\nexport const DEFAULT_REDACT_FIELDS: FieldPatterns = [\n  /pass(?:code|phrase|word)/i,\n  /secret/i,\n  /token/i,\n  /key/i,\n  /credential/i,\n  /auth/i,\n  /signature/i,\n  /sensitive/i,\n  /private/i,\n  /ssn/i,\n  /email/i,\n  /phone/i,\n  /address/i,\n];\n\n/**\n * Options for redacting fields in a {@link LogRecord}.  Used by\n * the {@link redactByField} function.\n * @since 0.10.0\n */\nexport interface FieldRedactionOptions {\n  /**\n   * The field patterns to match against.  This can be an array of\n   * strings or regular expressions.  If a field matches any of the\n   * patterns, it will be redacted.\n   * @defaultValue {@link DEFAULT_REDACT_FIELDS}\n   */\n  readonly fieldPatterns: FieldPatterns;\n\n  /**\n   * The action to perform on the matched fields.  If not provided,\n   * the default action is to delete the field from the properties.\n   * If a function is provided, it will be called with the\n   * value of the field, and the return value will be used to replace\n   * the field in the properties.\n   * If the action is `\"delete\"`, the field will be removed from the\n   * properties.\n   * @default `\"delete\"`\n   */\n  readonly action?: \"delete\" | ((value: unknown) => unknown);\n}\n\n/**\n * Redacts properties in a {@link LogRecord} based on the provided field\n * patterns and action.\n *\n * Note that it is a decorator which wraps the sink and redacts properties\n * before passing them to the sink.\n *\n * @example\n * ```ts\n * import { getConsoleSink } from \"@logtape/logtape\";\n * import { redactByField } from \"@logtape/redaction\";\n *\n * const sink = redactByField(getConsoleSink());\n * ```\n *\n * @param sink The sink to wrap.\n * @param options The redaction options.\n * @returns The wrapped sink.\n * @since 0.10.0\n */\nexport function redactByField(\n  sink: Sink | Sink & Disposable | Sink & AsyncDisposable,\n  options: FieldRedactionOptions | FieldPatterns = DEFAULT_REDACT_FIELDS,\n): Sink | Sink & Disposable | Sink & AsyncDisposable {\n  const opts = Array.isArray(options) ? { fieldPatterns: options } : options;\n  const wrapped = (record: LogRecord) => {\n    sink({ ...record, properties: redactProperties(record.properties, opts) });\n  };\n  if (Symbol.dispose in sink) wrapped[Symbol.dispose] = sink[Symbol.dispose];\n  if (Symbol.asyncDispose in sink) {\n    wrapped[Symbol.asyncDispose] = sink[Symbol.asyncDispose];\n  }\n  return wrapped;\n}\n\n/**\n * Redacts properties from an object based on specified field patterns.\n *\n * This function creates a shallow copy of the input object and applies\n * redaction rules to its properties. For properties that match the redaction\n * patterns, the function either removes them or transforms their values based\n * on the provided action.\n *\n * The redaction process is recursive and will be applied to nested objects\n * as well, allowing for deep redaction of sensitive data in complex object\n * structures.\n * @param properties The properties to redact.\n * @param options The redaction options.\n * @returns The redacted properties.\n * @since 0.10.0\n */\nexport function redactProperties(\n  properties: Record<string, unknown>,\n  options: FieldRedactionOptions,\n): Record<string, unknown> {\n  const copy = { ...properties };\n  for (const field in copy) {\n    if (shouldFieldRedacted(field, options.fieldPatterns)) {\n      if (options.action == null || options.action === \"delete\") {\n        delete copy[field];\n      } else {\n        copy[field] = options.action(copy[field]);\n      }\n      continue;\n    }\n    const value = copy[field];\n    // Check if value is a vanilla object:\n    if (\n      typeof value === \"object\" && value !== null &&\n      (Object.getPrototypeOf(value) === Object.prototype ||\n        Object.getPrototypeOf(value) === null)\n    ) {\n      // @ts-ignore: value is always Record<string, unknown>\n      copy[field] = redactProperties(value, options);\n    }\n  }\n  return copy;\n}\n\n/**\n * Checks if a field should be redacted based on the provided field patterns.\n * @param field The field name to check.\n * @param fieldPatterns The field patterns to match against.\n * @returns `true` if the field should be redacted, `false` otherwise.\n * @since 0.10.0\n */\nexport function shouldFieldRedacted(\n  field: string,\n  fieldPatterns: FieldPatterns,\n): boolean {\n  for (const fieldPattern of fieldPatterns) {\n    if (typeof fieldPattern === \"string\") {\n      if (fieldPattern === field) return true;\n    } else {\n      if (fieldPattern.test(field)) return true;\n    }\n  }\n  return false;\n}\n"],"mappings":";;;;;;;AAsBA,MAAaA,wBAAuC;CAClD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD;;;;;;;;;;;;;;;;;;;;;AAiDD,SAAgB,cACdC,MACAC,UAAiD,uBACE;CACnD,MAAM,OAAO,MAAM,QAAQ,QAAQ,GAAG,EAAE,eAAe,QAAS,IAAG;CACnE,MAAM,UAAU,CAACC,WAAsB;AACrC,OAAK;GAAE,GAAG;GAAQ,YAAY,iBAAiB,OAAO,YAAY,KAAK;EAAE,EAAC;CAC3E;AACD,KAAI,OAAO,WAAW,KAAM,SAAQ,OAAO,WAAW,KAAK,OAAO;AAClE,KAAI,OAAO,gBAAgB,KACzB,SAAQ,OAAO,gBAAgB,KAAK,OAAO;AAE7C,QAAO;AACR;;;;;;;;;;;;;;;;;AAkBD,SAAgB,iBACdC,YACAC,SACyB;CACzB,MAAM,OAAO,EAAE,GAAG,WAAY;AAC9B,MAAK,MAAM,SAAS,MAAM;AACxB,MAAI,oBAAoB,OAAO,QAAQ,cAAc,EAAE;AACrD,OAAI,QAAQ,UAAU,QAAQ,QAAQ,WAAW,SAC/C,QAAO,KAAK;OAEZ,MAAK,SAAS,QAAQ,OAAO,KAAK,OAAO;AAE3C;EACD;EACD,MAAM,QAAQ,KAAK;AAEnB,aACS,UAAU,YAAY,UAAU,SACtC,OAAO,eAAe,MAAM,KAAK,OAAO,aACvC,OAAO,eAAe,MAAM,KAAK,MAGnC,MAAK,SAAS,iBAAiB,OAAO,QAAQ;CAEjD;AACD,QAAO;AACR;;;;;;;;AASD,SAAgB,oBACdC,OACAC,eACS;AACT,MAAK,MAAM,gBAAgB,cACzB,YAAW,iBAAiB,UAC1B;MAAI,iBAAiB,MAAO,QAAO;CAAK,WAEpC,aAAa,KAAK,MAAM,CAAE,QAAO;AAGzC,QAAO;AACR"}
+{"version":3,"file":"field.js","names":["DEFAULT_REDACT_FIELDS: FieldPatterns","sink: Sink | Sink & Disposable | Sink & AsyncDisposable","options: FieldRedactionOptions | FieldPatterns","record: LogRecord","properties: Record<string, unknown>","options: FieldRedactionOptions","field: string","fieldPatterns: FieldPatterns"],"sources":["../src/field.ts"],"sourcesContent":["import type { LogRecord, Sink } from \"@logtape/logtape\";\n\n/**\n * The type for a field pattern used in redaction.  A string or a regular\n * expression that matches field names.\n * @since 0.10.0\n */\nexport type FieldPattern = string | RegExp;\n\n/**\n * An array of field patterns used for redaction.  Each pattern can be\n * a string or a regular expression that matches field names.\n * @since 0.10.0\n */\nexport type FieldPatterns = FieldPattern[];\n\n/**\n * Default field patterns for redaction.  These patterns will match\n * common sensitive fields such as passwords, tokens, and personal\n * information.\n * @since 0.10.0\n */\nexport const DEFAULT_REDACT_FIELDS: FieldPatterns = [\n  /pass(?:code|phrase|word)/i,\n  /secret/i,\n  /token/i,\n  /key/i,\n  /credential/i,\n  /auth/i,\n  /signature/i,\n  /sensitive/i,\n  /private/i,\n  /ssn/i,\n  /email/i,\n  /phone/i,\n  /address/i,\n];\n\n/**\n * Options for redacting fields in a {@link LogRecord}.  Used by\n * the {@link redactByField} function.\n * @since 0.10.0\n */\nexport interface FieldRedactionOptions {\n  /**\n   * The field patterns to match against.  This can be an array of\n   * strings or regular expressions.  If a field matches any of the\n   * patterns, it will be redacted.\n   * @defaultValue {@link DEFAULT_REDACT_FIELDS}\n   */\n  readonly fieldPatterns: FieldPatterns;\n\n  /**\n   * The action to perform on the matched fields.  If not provided,\n   * the default action is to delete the field from the properties.\n   * If a function is provided, it will be called with the\n   * value of the field, and the return value will be used to replace\n   * the field in the properties.\n   * If the action is `\"delete\"`, the field will be removed from the\n   * properties.\n   * @default `\"delete\"`\n   */\n  readonly action?: \"delete\" | ((value: unknown) => unknown);\n}\n\n/**\n * Redacts properties in a {@link LogRecord} based on the provided field\n * patterns and action.\n *\n * Note that it is a decorator which wraps the sink and redacts properties\n * before passing them to the sink.\n *\n * @example\n * ```ts\n * import { getConsoleSink } from \"@logtape/logtape\";\n * import { redactByField } from \"@logtape/redaction\";\n *\n * const sink = redactByField(getConsoleSink());\n * ```\n *\n * @param sink The sink to wrap.\n * @param options The redaction options.\n * @returns The wrapped sink.\n * @since 0.10.0\n */\nexport function redactByField(\n  sink: Sink | Sink & Disposable | Sink & AsyncDisposable,\n  options: FieldRedactionOptions | FieldPatterns = DEFAULT_REDACT_FIELDS,\n): Sink | Sink & Disposable | Sink & AsyncDisposable {\n  const opts = Array.isArray(options) ? { fieldPatterns: options } : options;\n  const wrapped = (record: LogRecord) => {\n    sink({ ...record, properties: redactProperties(record.properties, opts) });\n  };\n  if (Symbol.dispose in sink) wrapped[Symbol.dispose] = sink[Symbol.dispose];\n  if (Symbol.asyncDispose in sink) {\n    wrapped[Symbol.asyncDispose] = sink[Symbol.asyncDispose];\n  }\n  return wrapped;\n}\n\n/**\n * Redacts properties from an object based on specified field patterns.\n *\n * This function creates a shallow copy of the input object and applies\n * redaction rules to its properties. For properties that match the redaction\n * patterns, the function either removes them or transforms their values based\n * on the provided action.\n *\n * The redaction process is recursive and will be applied to nested objects\n * as well, allowing for deep redaction of sensitive data in complex object\n * structures.\n * @param properties The properties to redact.\n * @param options The redaction options.\n * @returns The redacted properties.\n * @since 0.10.0\n */\nexport function redactProperties(\n  properties: Record<string, unknown>,\n  options: FieldRedactionOptions,\n): Record<string, unknown> {\n  const copy = { ...properties };\n  for (const field in copy) {\n    if (shouldFieldRedacted(field, options.fieldPatterns)) {\n      if (options.action == null || options.action === \"delete\") {\n        delete copy[field];\n      } else {\n        copy[field] = options.action(copy[field]);\n      }\n      continue;\n    }\n    const value = copy[field];\n    // Check if value is an array:\n    if (Array.isArray(value)) {\n      copy[field] = value.map((item) => {\n        if (\n          typeof item === \"object\" && item !== null &&\n          (Object.getPrototypeOf(item) === Object.prototype ||\n            Object.getPrototypeOf(item) === null)\n        ) {\n          // @ts-ignore: item is always Record<string, unknown>\n          return redactProperties(item, options);\n        }\n        return item;\n      });\n      // Check if value is a vanilla object:\n    } else if (\n      typeof value === \"object\" && value !== null &&\n      (Object.getPrototypeOf(value) === Object.prototype ||\n        Object.getPrototypeOf(value) === null)\n    ) {\n      // @ts-ignore: value is always Record<string, unknown>\n      copy[field] = redactProperties(value, options);\n    }\n  }\n  return copy;\n}\n\n/**\n * Checks if a field should be redacted based on the provided field patterns.\n * @param field The field name to check.\n * @param fieldPatterns The field patterns to match against.\n * @returns `true` if the field should be redacted, `false` otherwise.\n * @since 0.10.0\n */\nexport function shouldFieldRedacted(\n  field: string,\n  fieldPatterns: FieldPatterns,\n): boolean {\n  for (const fieldPattern of fieldPatterns) {\n    if (typeof fieldPattern === \"string\") {\n      if (fieldPattern === field) return true;\n    } else {\n      if (fieldPattern.test(field)) return true;\n    }\n  }\n  return false;\n}\n"],"mappings":";;;;;;;AAsBA,MAAaA,wBAAuC;CAClD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD;;;;;;;;;;;;;;;;;;;;;AAiDD,SAAgB,cACdC,MACAC,UAAiD,uBACE;CACnD,MAAM,OAAO,MAAM,QAAQ,QAAQ,GAAG,EAAE,eAAe,QAAS,IAAG;CACnE,MAAM,UAAU,CAACC,WAAsB;AACrC,OAAK;GAAE,GAAG;GAAQ,YAAY,iBAAiB,OAAO,YAAY,KAAK;EAAE,EAAC;CAC3E;AACD,KAAI,OAAO,WAAW,KAAM,SAAQ,OAAO,WAAW,KAAK,OAAO;AAClE,KAAI,OAAO,gBAAgB,KACzB,SAAQ,OAAO,gBAAgB,KAAK,OAAO;AAE7C,QAAO;AACR;;;;;;;;;;;;;;;;;AAkBD,SAAgB,iBACdC,YACAC,SACyB;CACzB,MAAM,OAAO,EAAE,GAAG,WAAY;AAC9B,MAAK,MAAM,SAAS,MAAM;AACxB,MAAI,oBAAoB,OAAO,QAAQ,cAAc,EAAE;AACrD,OAAI,QAAQ,UAAU,QAAQ,QAAQ,WAAW,SAC/C,QAAO,KAAK;OAEZ,MAAK,SAAS,QAAQ,OAAO,KAAK,OAAO;AAE3C;EACD;EACD,MAAM,QAAQ,KAAK;AAEnB,MAAI,MAAM,QAAQ,MAAM,CACtB,MAAK,SAAS,MAAM,IAAI,CAAC,SAAS;AAChC,cACS,SAAS,YAAY,SAAS,SACpC,OAAO,eAAe,KAAK,KAAK,OAAO,aACtC,OAAO,eAAe,KAAK,KAAK,MAGlC,QAAO,iBAAiB,MAAM,QAAQ;AAExC,UAAO;EACR,EAAC;kBAGK,UAAU,YAAY,UAAU,SACtC,OAAO,eAAe,MAAM,KAAK,OAAO,aACvC,OAAO,eAAe,MAAM,KAAK,MAGnC,MAAK,SAAS,iBAAiB,OAAO,QAAQ;CAEjD;AACD,QAAO;AACR;;;;;;;;AASD,SAAgB,oBACdC,OACAC,eACS;AACT,MAAK,MAAM,gBAAgB,cACzB,YAAW,iBAAiB,UAC1B;MAAI,iBAAiB,MAAO,QAAO;CAAK,WAEpC,aAAa,KAAK,MAAM,CAAE,QAAO;AAGzC,QAAO;AACR"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logtape/redaction",
-  "version": "1.2.0-dev.363+b6095707",
+  "version": "1.2.0-dev.367+d4fd9984",
   "description": "Redact sensitive data from log messages",
   "keywords": [
     "logging",
@@ -46,7 +46,7 @@
   },
   "sideEffects": false,
   "peerDependencies": {
-    "@logtape/logtape": "^1.2.0-dev.363+b6095707"
+    "@logtape/logtape": "^1.2.0-dev.367+d4fd9984"
   },
   "devDependencies": {
     "@alinea/suite": "^0.6.3",

package/src/field.test.ts

@@ -117,6 +117,106 @@ test("redactProperties()", () => {
     assertEquals(result.data, { nested: "value" });
     assertFalse("sensitive" in result);
   }
+
+  { // redacts fields in objects within arrays
+    const properties = {
+      configs: [
+        { password: "secret", username: "user1" },
+        { token: "abc", email: "user2@example.com" },
+      ],
+    };
+
+    const result = redactProperties(properties, {
+      fieldPatterns: ["password", "token"],
+    });
+
+    // deno-lint-ignore no-explicit-any
+    const configs = result.configs as any;
+    assertEquals(configs.length, 2);
+    assertEquals(configs[0], { username: "user1" });
+    assertEquals(configs[1], { email: "user2@example.com" });
+  }
+
+  { // preserves non-object items in arrays
+    const properties = {
+      data: [
+        { password: "secret" },
+        "plain string",
+        42,
+        { token: "abc" },
+      ],
+    };
+
+    const result = redactProperties(properties, {
+      fieldPatterns: ["password", "token"],
+    });
+
+    // deno-lint-ignore no-explicit-any
+    const data = result.data as any;
+    assertEquals(data.length, 4);
+    assertEquals(data[0], {});
+    assertEquals(data[1], "plain string");
+    assertEquals(data[2], 42);
+    assertEquals(data[3], {});
+  }
+
+  { // redacts nested arrays within objects in arrays
+    const properties = {
+      items: [
+        {
+          config: {
+            password: "secret",
+            nestedArray: [
+              { token: "abc", value: 1 },
+              { key: "xyz", value: 2 },
+            ],
+          },
+        },
+      ],
+    };
+
+    const result = redactProperties(properties, {
+      fieldPatterns: ["password", "token", "key"],
+    });
+
+    // deno-lint-ignore no-explicit-any
+    const items = result.items as any;
+    // deno-lint-ignore no-explicit-any
+    const first = items[0] as any;
+    // deno-lint-ignore no-explicit-any
+    const nestedArray = first.config.nestedArray as any;
+    assertEquals(items.length, 1);
+    assertEquals(first.config.password, undefined);
+    assertEquals(nestedArray.length, 2);
+    assertEquals(nestedArray[0], { value: 1 });
+    assertEquals(nestedArray[1], { value: 2 });
+  }
+
+  { // uses custom action in arrays
+    const properties = {
+      users: [
+        { password: "secret1", name: "user1" },
+        { password: "secret2", name: "user2" },
+      ],
+    };
+
+    const result = redactProperties(properties, {
+      fieldPatterns: ["password"],
+      action: () => "[REDACTED]",
+    });
+
+    // deno-lint-ignore no-explicit-any
+    const users = result.users as any;
+    assertEquals(users.length, 2);
+    assertEquals(users[0], {
+      password: "[REDACTED]",
+      name: "user1",
+    });
+    assertEquals(users[1], {
+      password: "[REDACTED]",
+      name: "user2",
+    });
+  }
 });
 
 test("redactByField()", async () => {
@@ -214,4 +314,31 @@ test("redactByField()", async () => {
     await wrappedSink[Symbol.asyncDispose]();
     assert(disposed);
   }
+
+  { // redacts fields in arrays from issue #94
+    const records: LogRecord[] = [];
+    const originalSink: Sink = (record) => records.push(record);
+
+    const wrappedSink = redactByField(originalSink, {
+      fieldPatterns: ["password"],
+    });
+
+    const record: LogRecord = {
+      level: "info",
+      category: ["test"],
+      message: ["Loaded config"],
+      rawMessage: "Loaded config",
+      timestamp: Date.now(),
+      properties: {
+        configs: [{ password: "secret", username: "user" }],
+      },
+    };
+
+    wrappedSink(record);
+
+    assertEquals(records.length, 1);
+    // deno-lint-ignore no-explicit-any
+    const configs = records[0].properties.configs as any;
+    assertEquals(configs[0], { username: "user" });
+  }
 });

package/src/field.ts

@@ -129,8 +129,21 @@ export function redactProperties(
       continue;
     }
     const value = copy[field];
-    // Check if value is a vanilla object:
-    if (
+    // Check if value is an array:
+    if (Array.isArray(value)) {
+      copy[field] = value.map((item) => {
+        if (
+          typeof item === "object" && item !== null &&
+          (Object.getPrototypeOf(item) === Object.prototype ||
+            Object.getPrototypeOf(item) === null)
+        ) {
+          // @ts-ignore: item is always Record<string, unknown>
+          return redactProperties(item, options);
+        }
+        return item;
+      });
+      // Check if value is a vanilla object:
+    } else if (
       typeof value === "object" && value !== null &&
       (Object.getPrototypeOf(value) === Object.prototype ||
         Object.getPrototypeOf(value) === null)