@lowdefy/server 6.0.0 → 7.0.0

package/lib/server/log/createHandleError.test.mjs

@@ -0,0 +1,102 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { jest } from '@jest/globals';
+import { TenantIntegrityError } from '@lowdefy/errors';
+
+const secret = 'planted-handle-error-secret';
+
+process.env.LOWDEFY_SECRET_API_KEY = secret;
+
+const { default: createHandleError } = await import('./createHandleError.js');
+
+function createAxiosError() {
+  const error = new Error(`Request failed for key ${secret}`);
+  error.name = 'AxiosError';
+  error.code = 'ERR_BAD_REQUEST';
+  error.config = {
+    auth: { username: 'svc-user', password: 'planted-config-password' },
+    params: { api_key: 'planted-config-param' },
+    headers: { Authorization: 'Bearer planted-config-header' },
+  };
+  return error;
+}
+
+function testContext({ logger, headers } = {}) {
+  return {
+    headers,
+    logger: logger ?? { error: jest.fn() },
+    readConfigFile: jest.fn(async () => null),
+    req: { url: '/api/request/page/req', method: 'POST', hostname: 'app.example.com' },
+  };
+}
+
+beforeEach(() => {
+  console.error = jest.fn();
+});
+
+test('handleError logs the referer header with credential query parameters redacted', async () => {
+  const context = testContext({
+    headers: { referer: 'https://app.example.com/verify?token=planted-token&page=2' },
+  });
+  const handleError = createHandleError({ context });
+
+  await handleError(new Error('Failed.'));
+
+  const [fields] = context.logger.error.mock.calls[0];
+  expect(fields.headers.referer).toBe('https://app.example.com/verify?token=%5Bredacted%5D&page=2');
+});
+
+test('handleError fallback output carries no axios config auth and no planted secret when the log call throws', async () => {
+  const logError = new Error(`Log sink rejected ${secret}`);
+  const context = testContext({
+    logger: {
+      error: jest.fn(() => {
+        throw logError;
+      }),
+    },
+  });
+  const handleError = createHandleError({ context });
+
+  await handleError(createAxiosError());
+
+  expect(console.error).toHaveBeenCalledTimes(3);
+  const output = console.error.mock.calls.map(([line]) => line).join('\n');
+  expect(output).not.toContain('planted-config-password');
+  expect(output).not.toContain('planted-config-param');
+  expect(output).not.toContain('planted-config-header');
+  expect(output).not.toContain(secret);
+  const logged = JSON.parse(console.error.mock.calls[0][0]);
+  expect(logged.message).toBe('Request failed for key [REDACTED]');
+  expect(logged.code).toBe('ERR_BAD_REQUEST');
+  expect(JSON.parse(console.error.mock.calls[2][0]).message).toBe('Log sink rejected [REDACTED]');
+});
+
+test('handleError logs a TenantIntegrityError as tenant_integrity_error with endpoint and organization', async () => {
+  const context = testContext();
+  context.endpointId = 'save-contact';
+  context.user = { id: 'u1', organization_id: 'org_a' };
+  const handleError = createHandleError({ context });
+
+  await handleError(
+    new TenantIntegrityError('bad row', { collection: 'contacts', organizationId: 'org_a' })
+  );
+
+  const [fields] = context.logger.error.mock.calls[0];
+  expect(fields.event).toBe('tenant_integrity_error');
+  expect(fields.endpointId).toBe('save-contact');
+  expect(fields.organization_id).toBe('org_a');
+});

package/lib/server/log/createLogger.js

@@ -18,6 +18,8 @@ import { createNodeLogger } from '@lowdefy/logger/node';
 import { type } from '@lowdefy/helpers';
 
 import appMeta from '../../build/appMeta.js';
+import scrubSecrets from '../scrubSecrets.js';
+import serializeErrorForLog from './serializeErrorForLog.js';
 
 // Deploy identity on every log line — pid/hostname are stripped, so these
 // fields are what correlates a line to an app build across replicas.
@@ -31,11 +33,19 @@ if (!type.isNone(appMeta.version)) {
 if (!type.isNone(appMeta.gitSha)) {
   base.git_sha = appMeta.gitSha;
 }
+// The deployment environment (LOWDEFY_ENVIRONMENT), so one log drain can hold every environment.
+if (!type.isNone(appMeta.environment)) {
+  base.environment = appMeta.environment;
+}
 
 const logger = createNodeLogger({
   name: 'lowdefy_server',
   level: process.env.LOWDEFY_LOG_LEVEL ?? 'info',
   base,
+  serializers: { err: serializeErrorForLog },
+  // Scrubbing the finished line rather than the logged object covers every field of every
+  // call - debug payloads and request results as well as `err` - with no walker to miss one.
+  hooks: { streamWrite: scrubSecrets },
 });
 
 function createLogger(metadata = {}) {

package/lib/server/log/createLogger.test.mjs

@@ -0,0 +1,117 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { jest } from '@jest/globals';
+import { createNodeLogger } from '@lowdefy/logger/node';
+import { markCredential, runInCredentialScope } from '@lowdefy/node-utils';
+
+const secret = 'planted/secret+value=1';
+const shortSecret = 'short77';
+
+const lines = [];
+const destination = {
+  write(line) {
+    lines.push(line);
+  },
+};
+
+// The prod logger writes to stdout; route the real logger to memory so each test reads the
+// exact line pino would emit, after the streamWrite hook.
+jest.unstable_mockModule('@lowdefy/logger/node', () => ({
+  createNodeLogger: (options) => createNodeLogger({ ...options, destination }),
+}));
+jest.unstable_mockModule('../../build/appMeta.js', () => ({ default: {} }));
+
+process.env.LOWDEFY_SECRET_API_KEY = secret;
+process.env.LOWDEFY_SECRET_SHORT = shortSecret;
+process.env.LOWDEFY_LOG_LEVEL = 'debug';
+
+const { default: createLogger } = await import('./createLogger.js');
+
+function createAxiosError() {
+  const error = new Error('Request failed with status code 401');
+  error.name = 'AxiosError';
+  error.code = 'ERR_BAD_REQUEST';
+  error.config = {
+    auth: { username: 'svc-user', password: 'planted-config-password' },
+    params: { api_key: 'planted-config-param' },
+    headers: { Authorization: 'Bearer planted-config-header' },
+    baseURL: 'https://api.example.com',
+  };
+  error.response = { status: 401, data: { detail: 'planted-response-body' } };
+  return error;
+}
+
+beforeEach(() => {
+  lines.length = 0;
+});
+
+test('prod logger drops an axios error config auth, params and headers', () => {
+  createLogger().error({ err: createAxiosError() }, 'Request failed');
+  expect(lines).toHaveLength(1);
+  const line = lines[0];
+  expect(line).not.toContain('planted-config-password');
+  expect(line).not.toContain('planted-config-param');
+  expect(line).not.toContain('planted-config-header');
+  expect(line).not.toContain('planted-response-body');
+  const { err } = JSON.parse(line);
+  expect(err.config).toBeUndefined();
+  expect(err.code).toBe('ERR_BAD_REQUEST');
+  expect(err.statusCode).toBe(401);
+});
+
+test('prod logger redacts a planted secret in a message raw, URL-encoded and base64', () => {
+  const basic = Buffer.from(`svc-user:${secret}`).toString('base64');
+  const error = new Error(`raw ${secret} encoded ${encodeURIComponent(secret)} basic ${basic}`);
+  createLogger().error({ err: error }, error.message);
+  expect(lines).toHaveLength(1);
+  const line = lines[0];
+  expect(line).not.toContain(secret);
+  expect(line).not.toContain(encodeURIComponent(secret));
+  expect(line).not.toContain(Buffer.from(secret).toString('base64').slice(0, 20));
+  const { msg, err } = JSON.parse(line);
+  expect(msg).toMatch(/^raw \[REDACTED\] encoded \[REDACTED\] basic \S*\[REDACTED\]/);
+  expect(err.message).toBe(msg);
+});
+
+test('prod logger redacts a planted secret in a debug payload that is not an error', () => {
+  createLogger({ rid: 'req-1' }).debug({ response: { token: secret } }, 'Request result');
+  expect(lines).toHaveLength(1);
+  expect(lines[0]).not.toContain(secret);
+  expect(JSON.parse(lines[0]).response.token).toBe('[REDACTED]');
+});
+
+test('prod logger leaves a secret shorter than 8 characters alone', () => {
+  createLogger().info({ detail: shortSecret }, `value ${shortSecret}`);
+  expect(lines).toHaveLength(1);
+  const { msg, detail } = JSON.parse(lines[0]);
+  expect(msg).toBe(`value ${shortSecret}`);
+  expect(detail).toBe(shortSecret);
+});
+
+test('prod logger redacts a value the request marked as a credential', () => {
+  runInCredentialScope(() => {
+    markCredential('runtime-made-app-key-0001');
+    createLogger({ rid: 'req-1' }).debug(
+      { event: 'debug_control_return', response: { key: 'runtime-made-app-key-0001' } },
+      'Returned'
+    );
+  });
+  createLogger({ rid: 'req-2' }).debug({ response: { key: 'runtime-made-app-key-0001' } });
+  expect(lines).toHaveLength(2);
+  expect(JSON.parse(lines[0]).response.key).toBe('[REDACTED]');
+  expect(JSON.parse(lines[1]).response.key).toBe('runtime-made-app-key-0001');
+});

package/lib/server/log/logRequest.js

@@ -14,20 +14,28 @@
   limitations under the License.
 */
 
+import redactUrlQuery from './redactUrlQuery.js';
+
 // Emits one access-log line per request, after the response is finalized.
+// `url` is the route path only (c.req.path). The referer keeps its query but
+// with credential parameters redacted, because the browser sends the page's
+// full URL there and that URL can carry a sign-in token or a signed OAuth
+// query (see redactUrlQuery).
 function logRequest({ context, status, durationMs }) {
-  const { headers = {}, user = {} } = context;
+  const { headers = {} } = context;
+  const user = context.user ?? {};
   context.logger.info(
     {
       user: {
         id: user.id,
         roles: user.roles,
-        sub: user.sub,
-        session_id: user.session_id, // TODO: Implement session id
       },
       url: context.req.url,
       method: context.req.method,
       hostname: context.req.hostname,
+      // The address the server resolved (see getClientAddress). The forwarding
+      // headers below are logged as the client sent them, and are not it.
+      client_address: context.clientAddress,
       status,
       duration_ms: durationMs,
       headers: {
@@ -37,7 +45,7 @@ function logRequest({ context, status, durationMs }) {
         'sec-ch-ua': headers['sec-ch-ua'],
         'user-agent': headers['user-agent'],
         host: headers.host,
-        referer: headers.referer,
+        referer: redactUrlQuery(headers.referer),
         'x-forwarded-for': headers['x-forwarded-for'],
         // Vercel headers
         'x-vercel-id': headers['x-vercel-id'],

package/lib/server/log/maskCredentialKeys.js

@@ -0,0 +1,37 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { mapPlainValues } from '@lowdefy/helpers';
+
+// `received` is the one kept log field holding values fetched at runtime (a token
+// from an earlier step sent as a header), which the by-value secret scrub
+// cannot recognise, so credential-looking keys are masked by name instead.
+const credentialKeyParts = ['authorization', 'token', 'secret', 'password', 'apikey', 'cookie'];
+
+function isCredentialKey(key) {
+  const normalized = key.toLowerCase().replace(/[-_]/g, '');
+  return credentialKeyParts.some((part) => normalized.includes(part));
+}
+
+// Shared references and cycles are copied as such, so the serializer walk still
+// marks them '[Circular]'.
+function maskCredentialKeys(value) {
+  return mapPlainValues(value, (item, key) =>
+    key !== undefined && isCredentialKey(key) ? '[REDACTED]' : item
+  );
+}
+
+export default maskCredentialKeys;

package/lib/server/log/projectErrorForLog.js

@@ -0,0 +1,61 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { lowdefyErrorNames, readErrorCodes } from '@lowdefy/errors';
+
+import maskCredentialKeys from './maskCredentialKeys.js';
+
+// Kept only on nodes named as a Lowdefy error class: libraries reuse some of
+// these names for their own data - axios's `config` carries auth, params and
+// headers - so keying on the field alone would let a library's copy through.
+const lowdefyErrorFields = [
+  'configKey',
+  'source',
+  'config',
+  'handled',
+  'isLowdefyError',
+  'received',
+  'typeName',
+  'location',
+  'service',
+  'hint',
+  'retryAfter',
+  'methodName',
+  'metaData',
+  'blockId',
+  'pageId',
+  'isReject',
+  'collection',
+  'connectionId',
+  'organizationId',
+  'field',
+  'endpointId',
+];
+
+function projectErrorForLog(err) {
+  const { code, statusCode } = readErrorCodes(err);
+  const props = { name: err.name, message: err.message, stack: err.stack, code, statusCode };
+  if (lowdefyErrorNames.has(err.name)) {
+    lowdefyErrorFields.forEach((field) => {
+      props[field] = err[field];
+    });
+    props.received = maskCredentialKeys(err.received);
+  }
+  props.cause = err.cause;
+  return props;
+}
+
+export default projectErrorForLog;

package/lib/server/log/redactUrlQuery.js

@@ -0,0 +1,75 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// Query parameters that carry a credential rather than a filter: the
+// magic-link and reset tokens, the OAuth authorization code and signed state,
+// signed-URL signatures, one-time passcodes. Matched case-insensitively.
+const secretParamNames = new Set([
+  'code',
+  'state',
+  'sig',
+  'otp',
+  'nonce',
+  'auth',
+  'apikey',
+  'api_key',
+  'api-key',
+  'session',
+  'sessionid',
+  'session_id',
+]);
+
+// Names that contain one of these are credentials whatever the prefix or
+// suffix - access_token, X-Amz-Signature, client_secret, X-Amz-Credential.
+const secretParamFragments = ['token', 'secret', 'password', 'signature', 'credential'];
+
+function isSecretParam(name) {
+  const lower = name.toLowerCase();
+  if (secretParamNames.has(lower)) {
+    return true;
+  }
+  return secretParamFragments.some((fragment) => lower.includes(fragment));
+}
+
+// A URL fit for an access log. The query string stays - it is often what
+// distinguishes one page view from the next - but the value of every
+// credential-like parameter is replaced with "[redacted]". The browser echoes
+// the page's full URL back as the Referer of every fetch that page makes, so
+// the magic-link verify page or the OAuth consent page would otherwise write
+// its token or signed state into the log store on each request. The fragment
+// is dropped: a browser never sends it in a Referer, and implicit-flow tokens
+// travel there. Returns undefined for a missing value. Works on relative URLs
+// too, so a malformed or path-only header is still visible.
+function redactUrlQuery(url) {
+  if (typeof url !== 'string' || url === '') {
+    return undefined;
+  }
+  const withoutFragment = url.split('#')[0];
+  const queryStart = withoutFragment.indexOf('?');
+  if (queryStart === -1) {
+    return withoutFragment;
+  }
+  const base = withoutFragment.slice(0, queryStart);
+  const params = new URLSearchParams(withoutFragment.slice(queryStart + 1));
+  for (const name of params.keys()) {
+    if (isSecretParam(name)) {
+      params.set(name, '[redacted]');
+    }
+  }
+  return `${base}?${params.toString()}`;
+}
+
+export default redactUrlQuery;

package/lib/server/log/redactUrlQuery.test.mjs

@@ -0,0 +1,73 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import redactUrlQuery from './redactUrlQuery.js';
+
+test('redactUrlQuery redacts the magic-link token and keeps the other parameters', () => {
+  expect(
+    redactUrlQuery(
+      'https://app.example.com/api/auth/magic-link/verify?token=abc123&callbackURL=%2Fhome'
+    )
+  ).toEqual(
+    'https://app.example.com/api/auth/magic-link/verify?token=%5Bredacted%5D&callbackURL=%2Fhome'
+  );
+});
+
+test('redactUrlQuery redacts the signed OAuth state, sig and code', () => {
+  expect(
+    redactUrlQuery('https://app.example.com/oauth-consent?client_id=app&state=xyz&sig=abc&code=q')
+  ).toEqual(
+    'https://app.example.com/oauth-consent?client_id=app&state=%5Bredacted%5D&sig=%5Bredacted%5D&code=%5Bredacted%5D'
+  );
+});
+
+test('redactUrlQuery matches credential names case-insensitively and by fragment', () => {
+  expect(
+    redactUrlQuery(
+      'https://bucket.s3.amazonaws.com/uploads/file.pdf?X-Amz-Credential=AKIA&X-Amz-Signature=deadbeef&X-Amz-Expires=300&access_token=t&client_secret=s'
+    )
+  ).toEqual(
+    'https://bucket.s3.amazonaws.com/uploads/file.pdf?X-Amz-Credential=%5Bredacted%5D&X-Amz-Signature=%5Bredacted%5D&X-Amz-Expires=300&access_token=%5Bredacted%5D&client_secret=%5Bredacted%5D'
+  );
+});
+
+test('redactUrlQuery leaves an ordinary page query untouched', () => {
+  expect(redactUrlQuery('https://app.example.com/orders?status=open&page=2')).toEqual(
+    'https://app.example.com/orders?status=open&page=2'
+  );
+  expect(redactUrlQuery('https://app.example.com/orders')).toEqual(
+    'https://app.example.com/orders'
+  );
+});
+
+test('redactUrlQuery drops the fragment', () => {
+  expect(redactUrlQuery('https://app.example.com/callback?page=1#access_token=abc')).toEqual(
+    'https://app.example.com/callback?page=1'
+  );
+});
+
+test('redactUrlQuery returns undefined for a missing header', () => {
+  expect(redactUrlQuery(undefined)).toBeUndefined();
+  expect(redactUrlQuery(null)).toBeUndefined();
+  expect(redactUrlQuery('')).toBeUndefined();
+});
+
+test('redactUrlQuery redacts a value that is not an absolute URL', () => {
+  expect(redactUrlQuery('/oauth-select-organization?state=xyz&sig=abc&org=acme')).toEqual(
+    '/oauth-select-organization?state=%5Bredacted%5D&sig=%5Bredacted%5D&org=acme'
+  );
+  expect(redactUrlQuery('not a url')).toEqual('not a url');
+});

package/lib/server/{auth/session.js → log/serializeErrorForLog.js}

@@ -14,18 +14,12 @@
   limitations under the License.
 */
 
-import { getAuthUser } from '@hono/auth-js';
+import { serializer } from '@lowdefy/helpers';
 
-import authJson from '../../build/auth.js';
+import projectErrorForLog from './projectErrorForLog.js';
 
-// Replaces getServerSession.js — reads the session from the Hono context
-// populated by the initAuthConfig middleware.
-async function getSession(c) {
-  if (authJson.configured !== true) {
-    return undefined;
-  }
-  const authUser = await getAuthUser(c);
-  return authUser?.session ?? undefined;
+function serializeErrorForLog(error) {
+  return serializer.serialize(error, { projectError: projectErrorForLog })?.['~e'] ?? error;
 }
 
-export default getSession;
+export default serializeErrorForLog;