@n8n/utils 1.20.0 → 1.20.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -0,0 +1,44 @@
|
|
|
1
|
+
|
|
2
|
+
//#region src/scrub-secrets.ts
|
|
3
|
+
/**
|
|
4
|
+
* Replace common credential patterns in free-form text with `[REDACTED]`.
|
|
5
|
+
*
|
|
6
|
+
* Used before persisting or transmitting user-supplied text (telemetry
|
|
7
|
+
* excerpts, eval report HTML, free-form feedback) where keys/tokens
|
|
8
|
+
* accidentally pasted into prompts or command lines could otherwise leak
|
|
9
|
+
* downstream.
|
|
10
|
+
*
|
|
11
|
+
* Conservative by design: matches well-known prefixed tokens, explicit
|
|
12
|
+
* `key=value` pairs, and quoted JSON/JS-object fields with sensitive
|
|
13
|
+
* names. We don't attempt to redact arbitrary long opaque strings — false
|
|
14
|
+
* positives on file paths, IDs, or base64 payloads would make the output
|
|
15
|
+
* unreadable.
|
|
16
|
+
*/
|
|
17
|
+
const SECRET_KEYS = "password|passwd|secret|credentials?|api[_-]?key|authorization|access[_-]?token|refresh[_-]?token|id[_-]?token|session[_-]?token|auth[_-]?token";
|
|
18
|
+
const SECRET_VALUE_PATTERNS = [
|
|
19
|
+
/-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/g,
|
|
20
|
+
/\beyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
|
|
21
|
+
/\b(?:Bearer|Basic|Token)\s+[A-Za-z0-9._~+/=-]{12,}/gi,
|
|
22
|
+
/\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{16,}/g,
|
|
23
|
+
/\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{16,}/g,
|
|
24
|
+
/\bAIza[0-9A-Za-z_-]{35}\b/g,
|
|
25
|
+
/\bxox[abprso]-[A-Za-z0-9-]{10,}/g,
|
|
26
|
+
/\bgh[psoru]_[A-Za-z0-9]{20,}/g,
|
|
27
|
+
/\bgithub_pat_[A-Za-z0-9_]{22,}/g,
|
|
28
|
+
/\bAKIA[0-9A-Z]{16}\b/g,
|
|
29
|
+
/(?<=:\/\/)[^\s:/@]+:[^\s:/@]+(?=@)/g,
|
|
30
|
+
new RegExp(`"(?:${SECRET_KEYS})"\\s*:\\s*"(?!\\[(?:redacted|REDACTED)\\]")(?:[^"\\\\\\r\\n]|\\\\.)*"`, "gi"),
|
|
31
|
+
new RegExp(`'(?:${SECRET_KEYS})'\\s*:\\s*'(?!\\[(?:redacted|REDACTED)\\]')(?:[^'\\\\\\r\\n]|\\\\.)*'`, "gi"),
|
|
32
|
+
new RegExp(`\\b(?:${SECRET_KEYS})\\s*[:=]\\s*\\S+`, "gi")
|
|
33
|
+
];
|
|
34
|
+
function scrubSecretsInText(input) {
|
|
35
|
+
let out = input;
|
|
36
|
+
for (const pattern of SECRET_VALUE_PATTERNS) out = out.replace(pattern, "[REDACTED]");
|
|
37
|
+
return out;
|
|
38
|
+
}
|
|
39
|
+
|
|
40
|
+
//#endregion
|
|
41
|
+
exports.SECRET_KEYS = SECRET_KEYS;
|
|
42
|
+
exports.SECRET_VALUE_PATTERNS = SECRET_VALUE_PATTERNS;
|
|
43
|
+
exports.scrubSecretsInText = scrubSecretsInText;
|
|
44
|
+
//# sourceMappingURL=scrub-secrets.cjs.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"scrub-secrets.cjs","names":["SECRET_VALUE_PATTERNS: readonly RegExp[]"],"sources":["../src/scrub-secrets.ts"],"sourcesContent":["/**\n * Replace common credential patterns in free-form text with `[REDACTED]`.\n *\n * Used before persisting or transmitting user-supplied text (telemetry\n * excerpts, eval report HTML, free-form feedback) where keys/tokens\n * accidentally pasted into prompts or command lines could otherwise leak\n * downstream.\n *\n * Conservative by design: matches well-known prefixed tokens, explicit\n * `key=value` pairs, and quoted JSON/JS-object fields with sensitive\n * names. We don't attempt to redact arbitrary long opaque strings — false\n * positives on file paths, IDs, or base64 payloads would make the output\n * unreadable.\n */\nexport const SECRET_KEYS =\n\t'password|passwd|secret|credentials?|api[_-]?key|authorization|access[_-]?token|refresh[_-]?token|id[_-]?token|session[_-]?token|auth[_-]?token';\n\nexport const SECRET_VALUE_PATTERNS: readonly RegExp[] = [\n\t// PEM private-key blocks (RSA/EC/DSA/OpenSSH/PGP). Whole block, multiline.\n\t/-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----[\\s\\S]*?-----END (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/g,\n\t// JWTs: `eyJ<header>.eyJ<payload>.<signature>` (both leading segments are\n\t// base64url of a `{\"` object, which makes this highly distinctive).\n\t/\\beyJ[A-Za-z0-9_-]+\\.eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+/g,\n\t// Authorization-header substrings: `Bearer <token>`, `Basic <token>`, `Token <token>`\n\t/\\b(?:Bearer|Basic|Token)\\s+[A-Za-z0-9._~+/=-]{12,}/gi,\n\t// OpenAI / Anthropic API keys\n\t/\\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{16,}/g,\n\t// Stripe secret/restricted/publishable keys (`sk_live_…`, `rk_test_…`, …)\n\t/\\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{16,}/g,\n\t// Google API keys\n\t/\\bAIza[0-9A-Za-z_-]{35}\\b/g,\n\t// Slack tokens (xoxb, xoxp, xoxa, xoxr, xoxs, xoxo)\n\t/\\bxox[abprso]-[A-Za-z0-9-]{10,}/g,\n\t// GitHub tokens (ghp, ghs, gho, ghr, ghu)\n\t/\\bgh[psoru]_[A-Za-z0-9]{20,}/g,\n\t// GitHub fine-grained personal access tokens\n\t/\\bgithub_pat_[A-Za-z0-9_]{22,}/g,\n\t// AWS access key id\n\t/\\bAKIA[0-9A-Z]{16}\\b/g,\n\t// Credentials embedded in a URL: `scheme://user:password@` — redact the userinfo.\n\t/(?<=:\\/\\/)[^\\s:/@]+:[^\\s:/@]+(?=@)/g,\n\t// JSON-shaped `\"key\": \"value\"` — matches the quoted field as a whole.\n\t// Run before the loose pattern so nested objects like\n\t// `{\"credentials\": {\"apiKey\": \"...\"}}` don't have the outer key consume\n\t// the inner key on its way to a non-quoted (object) value. The value\n\t// body uses the unrolled JSON-string idiom `(?:[^\"\\\\\\r\\n]|\\\\.)*`: the\n\t// negated class excludes the backslash so a backslash can only be consumed\n\t// by the `\\\\.` escape branch. Keep the two alternatives disjoint (don't\n\t// fold `\\\\` back into the negated class) — that keeps every run of\n\t// backslashes to a single, unambiguous parse, so matching stays fast on any\n\t// input. An escaped quote inside the value (`\"abc\\\"def\"`) still doesn't end\n\t// the match early, via the escape branch. The negative lookahead skips\n\t// values that are already a `[redacted]` / `[REDACTED]` placeholder so this\n\t// stays idempotent when chained behind upstream object-walking redaction\n\t// (e.g. langsmith trace payloads).\n\tnew RegExp(\n\t\t`\"(?:${SECRET_KEYS})\"\\\\s*:\\\\s*\"(?!\\\\[(?:redacted|REDACTED)\\\\]\")(?:[^\"\\\\\\\\\\\\r\\\\n]|\\\\\\\\.)*\"`,\n\t\t'gi',\n\t),\n\t// JS-object-shaped `'key': 'value'`\n\tnew RegExp(\n\t\t`'(?:${SECRET_KEYS})'\\\\s*:\\\\s*'(?!\\\\[(?:redacted|REDACTED)\\\\]')(?:[^'\\\\\\\\\\\\r\\\\n]|\\\\\\\\.)*'`,\n\t\t'gi',\n\t),\n\t// Generic `password=...` / `api_key=...` / `secret=...` style assignments\n\tnew RegExp(`\\\\b(?:${SECRET_KEYS})\\\\s*[:=]\\\\s*\\\\S+`, 'gi'),\n];\n\nexport function scrubSecretsInText(input: string): string {\n\tlet out = input;\n\tfor (const pattern of SECRET_VALUE_PATTERNS) {\n\t\tout = out.replace(pattern, '[REDACTED]');\n\t}\n\treturn out;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAcA,MAAa,cACZ;AAED,MAAaA,wBAA2C;CAEvD;CAGA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAeA,IAAI,OACH,OAAO,YAAY,yEACnB,KACA;CAED,IAAI,OACH,OAAO,YAAY,yEACnB,KACA;CAED,IAAI,OAAO,SAAS,YAAY,oBAAoB,KAAK;CACzD;AAED,SAAgB,mBAAmB,OAAuB;CACzD,IAAI,MAAM;AACV,MAAK,MAAM,WAAW,sBACrB,OAAM,IAAI,QAAQ,SAAS,aAAa;AAEzC,QAAO"}
|
|
@@ -0,0 +1,7 @@
|
|
|
1
|
+
//#region src/scrub-secrets.d.ts
|
|
2
|
+
declare const SECRET_KEYS = "password|passwd|secret|credentials?|api[_-]?key|authorization|access[_-]?token|refresh[_-]?token|id[_-]?token|session[_-]?token|auth[_-]?token";
|
|
3
|
+
declare const SECRET_VALUE_PATTERNS: readonly RegExp[];
|
|
4
|
+
declare function scrubSecretsInText(input: string): string;
|
|
5
|
+
//#endregion
|
|
6
|
+
export { SECRET_KEYS, SECRET_VALUE_PATTERNS, scrubSecretsInText };
|
|
7
|
+
//# sourceMappingURL=scrub-secrets.d.cts.map
|
|
@@ -0,0 +1,7 @@
|
|
|
1
|
+
//#region src/scrub-secrets.d.ts
|
|
2
|
+
declare const SECRET_KEYS = "password|passwd|secret|credentials?|api[_-]?key|authorization|access[_-]?token|refresh[_-]?token|id[_-]?token|session[_-]?token|auth[_-]?token";
|
|
3
|
+
declare const SECRET_VALUE_PATTERNS: readonly RegExp[];
|
|
4
|
+
declare function scrubSecretsInText(input: string): string;
|
|
5
|
+
//#endregion
|
|
6
|
+
export { SECRET_KEYS, SECRET_VALUE_PATTERNS, scrubSecretsInText };
|
|
7
|
+
//# sourceMappingURL=scrub-secrets.d.mts.map
|
|
@@ -0,0 +1,41 @@
|
|
|
1
|
+
//#region src/scrub-secrets.ts
|
|
2
|
+
/**
|
|
3
|
+
* Replace common credential patterns in free-form text with `[REDACTED]`.
|
|
4
|
+
*
|
|
5
|
+
* Used before persisting or transmitting user-supplied text (telemetry
|
|
6
|
+
* excerpts, eval report HTML, free-form feedback) where keys/tokens
|
|
7
|
+
* accidentally pasted into prompts or command lines could otherwise leak
|
|
8
|
+
* downstream.
|
|
9
|
+
*
|
|
10
|
+
* Conservative by design: matches well-known prefixed tokens, explicit
|
|
11
|
+
* `key=value` pairs, and quoted JSON/JS-object fields with sensitive
|
|
12
|
+
* names. We don't attempt to redact arbitrary long opaque strings — false
|
|
13
|
+
* positives on file paths, IDs, or base64 payloads would make the output
|
|
14
|
+
* unreadable.
|
|
15
|
+
*/
|
|
16
|
+
const SECRET_KEYS = "password|passwd|secret|credentials?|api[_-]?key|authorization|access[_-]?token|refresh[_-]?token|id[_-]?token|session[_-]?token|auth[_-]?token";
|
|
17
|
+
const SECRET_VALUE_PATTERNS = [
|
|
18
|
+
/-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/g,
|
|
19
|
+
/\beyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
|
|
20
|
+
/\b(?:Bearer|Basic|Token)\s+[A-Za-z0-9._~+/=-]{12,}/gi,
|
|
21
|
+
/\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{16,}/g,
|
|
22
|
+
/\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{16,}/g,
|
|
23
|
+
/\bAIza[0-9A-Za-z_-]{35}\b/g,
|
|
24
|
+
/\bxox[abprso]-[A-Za-z0-9-]{10,}/g,
|
|
25
|
+
/\bgh[psoru]_[A-Za-z0-9]{20,}/g,
|
|
26
|
+
/\bgithub_pat_[A-Za-z0-9_]{22,}/g,
|
|
27
|
+
/\bAKIA[0-9A-Z]{16}\b/g,
|
|
28
|
+
/(?<=:\/\/)[^\s:/@]+:[^\s:/@]+(?=@)/g,
|
|
29
|
+
new RegExp(`"(?:${SECRET_KEYS})"\\s*:\\s*"(?!\\[(?:redacted|REDACTED)\\]")(?:[^"\\\\\\r\\n]|\\\\.)*"`, "gi"),
|
|
30
|
+
new RegExp(`'(?:${SECRET_KEYS})'\\s*:\\s*'(?!\\[(?:redacted|REDACTED)\\]')(?:[^'\\\\\\r\\n]|\\\\.)*'`, "gi"),
|
|
31
|
+
new RegExp(`\\b(?:${SECRET_KEYS})\\s*[:=]\\s*\\S+`, "gi")
|
|
32
|
+
];
|
|
33
|
+
function scrubSecretsInText(input) {
|
|
34
|
+
let out = input;
|
|
35
|
+
for (const pattern of SECRET_VALUE_PATTERNS) out = out.replace(pattern, "[REDACTED]");
|
|
36
|
+
return out;
|
|
37
|
+
}
|
|
38
|
+
|
|
39
|
+
//#endregion
|
|
40
|
+
export { SECRET_KEYS, SECRET_VALUE_PATTERNS, scrubSecretsInText };
|
|
41
|
+
//# sourceMappingURL=scrub-secrets.mjs.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"scrub-secrets.mjs","names":["SECRET_VALUE_PATTERNS: readonly RegExp[]"],"sources":["../src/scrub-secrets.ts"],"sourcesContent":["/**\n * Replace common credential patterns in free-form text with `[REDACTED]`.\n *\n * Used before persisting or transmitting user-supplied text (telemetry\n * excerpts, eval report HTML, free-form feedback) where keys/tokens\n * accidentally pasted into prompts or command lines could otherwise leak\n * downstream.\n *\n * Conservative by design: matches well-known prefixed tokens, explicit\n * `key=value` pairs, and quoted JSON/JS-object fields with sensitive\n * names. We don't attempt to redact arbitrary long opaque strings — false\n * positives on file paths, IDs, or base64 payloads would make the output\n * unreadable.\n */\nexport const SECRET_KEYS =\n\t'password|passwd|secret|credentials?|api[_-]?key|authorization|access[_-]?token|refresh[_-]?token|id[_-]?token|session[_-]?token|auth[_-]?token';\n\nexport const SECRET_VALUE_PATTERNS: readonly RegExp[] = [\n\t// PEM private-key blocks (RSA/EC/DSA/OpenSSH/PGP). Whole block, multiline.\n\t/-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----[\\s\\S]*?-----END (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/g,\n\t// JWTs: `eyJ<header>.eyJ<payload>.<signature>` (both leading segments are\n\t// base64url of a `{\"` object, which makes this highly distinctive).\n\t/\\beyJ[A-Za-z0-9_-]+\\.eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+/g,\n\t// Authorization-header substrings: `Bearer <token>`, `Basic <token>`, `Token <token>`\n\t/\\b(?:Bearer|Basic|Token)\\s+[A-Za-z0-9._~+/=-]{12,}/gi,\n\t// OpenAI / Anthropic API keys\n\t/\\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{16,}/g,\n\t// Stripe secret/restricted/publishable keys (`sk_live_…`, `rk_test_…`, …)\n\t/\\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{16,}/g,\n\t// Google API keys\n\t/\\bAIza[0-9A-Za-z_-]{35}\\b/g,\n\t// Slack tokens (xoxb, xoxp, xoxa, xoxr, xoxs, xoxo)\n\t/\\bxox[abprso]-[A-Za-z0-9-]{10,}/g,\n\t// GitHub tokens (ghp, ghs, gho, ghr, ghu)\n\t/\\bgh[psoru]_[A-Za-z0-9]{20,}/g,\n\t// GitHub fine-grained personal access tokens\n\t/\\bgithub_pat_[A-Za-z0-9_]{22,}/g,\n\t// AWS access key id\n\t/\\bAKIA[0-9A-Z]{16}\\b/g,\n\t// Credentials embedded in a URL: `scheme://user:password@` — redact the userinfo.\n\t/(?<=:\\/\\/)[^\\s:/@]+:[^\\s:/@]+(?=@)/g,\n\t// JSON-shaped `\"key\": \"value\"` — matches the quoted field as a whole.\n\t// Run before the loose pattern so nested objects like\n\t// `{\"credentials\": {\"apiKey\": \"...\"}}` don't have the outer key consume\n\t// the inner key on its way to a non-quoted (object) value. The value\n\t// body uses the unrolled JSON-string idiom `(?:[^\"\\\\\\r\\n]|\\\\.)*`: the\n\t// negated class excludes the backslash so a backslash can only be consumed\n\t// by the `\\\\.` escape branch. Keep the two alternatives disjoint (don't\n\t// fold `\\\\` back into the negated class) — that keeps every run of\n\t// backslashes to a single, unambiguous parse, so matching stays fast on any\n\t// input. An escaped quote inside the value (`\"abc\\\"def\"`) still doesn't end\n\t// the match early, via the escape branch. The negative lookahead skips\n\t// values that are already a `[redacted]` / `[REDACTED]` placeholder so this\n\t// stays idempotent when chained behind upstream object-walking redaction\n\t// (e.g. langsmith trace payloads).\n\tnew RegExp(\n\t\t`\"(?:${SECRET_KEYS})\"\\\\s*:\\\\s*\"(?!\\\\[(?:redacted|REDACTED)\\\\]\")(?:[^\"\\\\\\\\\\\\r\\\\n]|\\\\\\\\.)*\"`,\n\t\t'gi',\n\t),\n\t// JS-object-shaped `'key': 'value'`\n\tnew RegExp(\n\t\t`'(?:${SECRET_KEYS})'\\\\s*:\\\\s*'(?!\\\\[(?:redacted|REDACTED)\\\\]')(?:[^'\\\\\\\\\\\\r\\\\n]|\\\\\\\\.)*'`,\n\t\t'gi',\n\t),\n\t// Generic `password=...` / `api_key=...` / `secret=...` style assignments\n\tnew RegExp(`\\\\b(?:${SECRET_KEYS})\\\\s*[:=]\\\\s*\\\\S+`, 'gi'),\n];\n\nexport function scrubSecretsInText(input: string): string {\n\tlet out = input;\n\tfor (const pattern of SECRET_VALUE_PATTERNS) {\n\t\tout = out.replace(pattern, '[REDACTED]');\n\t}\n\treturn out;\n}\n"],"mappings":";;;;;;;;;;;;;;;AAcA,MAAa,cACZ;AAED,MAAaA,wBAA2C;CAEvD;CAGA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAeA,IAAI,OACH,OAAO,YAAY,yEACnB,KACA;CAED,IAAI,OACH,OAAO,YAAY,yEACnB,KACA;CAED,IAAI,OAAO,SAAS,YAAY,oBAAoB,KAAK;CACzD;AAED,SAAgB,mBAAmB,OAAuB;CACzD,IAAI,MAAM;AACV,MAAK,MAAM,WAAW,sBACrB,OAAM,IAAI,QAAQ,SAAS,aAAa;AAEzC,QAAO"}
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@n8n/utils",
|
|
3
3
|
"type": "module",
|
|
4
|
-
"version": "1.20.
|
|
4
|
+
"version": "1.20.1",
|
|
5
5
|
"files": [
|
|
6
6
|
"dist",
|
|
7
7
|
"LICENSE.md",
|
|
@@ -32,11 +32,11 @@
|
|
|
32
32
|
"@testing-library/user-event": "^14.6.1",
|
|
33
33
|
"tsdown": "^0.16.5",
|
|
34
34
|
"typescript": "5.9.2",
|
|
35
|
-
"vite": "npm:rolldown-vite@
|
|
35
|
+
"vite": "npm:rolldown-vite@7.1.16",
|
|
36
36
|
"vitest": "^3.1.3",
|
|
37
|
-
"@n8n/typescript-config": "1.3.0",
|
|
38
37
|
"@n8n/eslint-config": "0.0.1",
|
|
39
|
-
"@n8n/vitest-config": "1.5.
|
|
38
|
+
"@n8n/vitest-config": "1.5.1",
|
|
39
|
+
"@n8n/typescript-config": "1.3.1"
|
|
40
40
|
},
|
|
41
41
|
"license": "SEE LICENSE IN LICENSE.md",
|
|
42
42
|
"homepage": "https://n8n.io",
|