@nxtedition/nxt-undici 7.4.0 → 7.4.2

package/lib/interceptor/log.js

@@ -1,10 +1,144 @@
-import { DecoratorHandler } from '../utils.js'
+import { DecoratorHandler, parseHeaders } from '../utils.js'
 
 const kGlobalIndex = Symbol.for('@nxtedition/nxt-undici#globalIndex')
 const kGlobalArray = Symbol.for('@nxtedition/nxt-undici#globalArray')
 
+const REDACTED = '[redacted]'
+
+// Header names (lowercase) whose values must never reach the logs.
+const SECRET_HEADERS = new Set(['authorization', 'proxy-authorization', 'cookie', 'set-cookie'])
+
+// Allocation-free pre-scan: true when `headers` is a plain object that the
+// parse + redact path would reproduce verbatim — every key already lowercase,
+// every value a string (or array of strings), no secret header present. In
+// that case the original object can be logged as-is: log bindings only read
+// it (pino serializes child bindings eagerly), nothing in the pipeline
+// mutates a caller's headers object in place. Uses a `for..in` + `Object.hasOwn`
+// guard rather than `Object.keys` so the scan itself allocates nothing while
+// still ignoring inherited props exactly as `Object.keys` would.
+function isCleanHeaderObject(headers) {
+  for (const key in headers) {
+    if (!Object.hasOwn(headers, key)) {
+      continue
+    }
+    if (SECRET_HEADERS.has(key) || key.toLowerCase() !== key) {
+      return false
+    }
+    const val = headers[key]
+    if (Array.isArray(val)) {
+      for (const item of val) {
+        if (typeof item !== 'string') {
+          return false
+        }
+      }
+    } else if (typeof val !== 'string') {
+      return false
+    }
+  }
+  return true
+}
+
+// Return a loggable view of `headers` with credential values replaced by a
+// redaction marker. Copy-on-write: the common case (already-lowercased plain
+// object, string values, nothing to redact) returns the original object as-is,
+// allocating no new headers object (the pre-scan itself is allocation-free
+// too). Only when something actually needs work — flat-array
+// form ([name, value, name, value, ...] with Buffer or string entries from
+// onHeaders/onUpgrade), a secret header, a non-lowercase name, or a
+// non-string value — do we build a sanitized copy via parseHeaders, which
+// lowercases names, stringifies values (Buffers included, so no
+// `{type:'Buffer',data:[...]}` blobs in bindings), skips null/undefined, and
+// merges duplicate names into arrays instead of overwriting earlier values.
+function sanitizeHeaders(headers) {
+  if (headers == null || typeof headers !== 'object') {
+    return undefined
+  }
+
+  if (!Array.isArray(headers) && isCleanHeaderObject(headers)) {
+    return headers
+  }
+
+  const sanitized = parseHeaders(headers)
+
+  for (const name of SECRET_HEADERS) {
+    if (name in sanitized) {
+      sanitized[name] = REDACTED
+    }
+  }
+
+  return sanitized
+}
+
+// Normalize the request origin for logging without leaking userinfo
+// credentials embedded as `http://user:pass@host`. Copy-on-write: userinfo
+// requires an '@', so a string without one is returned as-is — no URL
+// allocation. Real `URL` instances already expose a credential-free
+// `origin`; arbitrary URL-like objects do NOT get that fast path, since a
+// plain `{ origin: 'http://user:pass@host' }` would bypass the userinfo
+// check. Everything else is stringified, and only strings that could carry
+// userinfo are parsed and reduced to URL#origin (which never contains
+// userinfo); if such a string is not a parseable URL, prefer losing the
+// value over risking embedded credentials.
+function sanitizeOrigin(origin) {
+  if (origin == null) {
+    return undefined
+  }
+  if (origin instanceof URL) {
+    return origin.origin
+  }
+  const str = typeof origin === 'string' ? origin : String(origin)
+  if (!str.includes('@')) {
+    return str
+  }
+  try {
+    return new URL(str).origin
+  } catch {
+    return REDACTED
+  }
+}
+
+// Summarize the request body (type + size) instead of embedding its content.
+// Bodies may contain credentials or be arbitrarily large, and pino serializes
+// child bindings eagerly — never put the payload itself into the log record.
+function describeBody(body) {
+  if (body == null) {
+    return undefined
+  }
+  if (typeof body === 'string') {
+    return `string(${Buffer.byteLength(body)} bytes)`
+  }
+  if (Buffer.isBuffer(body)) {
+    return `Buffer(${body.byteLength} bytes)`
+  }
+  if (ArrayBuffer.isView(body)) {
+    return `${body.constructor?.name ?? 'TypedArray'}(${body.byteLength} bytes)`
+  }
+  if (typeof body === 'object' && typeof body.byteLength === 'number') {
+    return `${body.constructor?.name ?? 'ArrayBuffer'}(${body.byteLength} bytes)`
+  }
+  if (typeof body === 'function') {
+    return 'function'
+  }
+  return body.constructor?.name ?? typeof body
+}
+
+// Small, sanitized summary of the request opts used for all `ureq` log
+// bindings. Built once per request instead of binding the live opts object,
+// which both leaked credentials/bodies into logs and paid eager pino
+// serialization of the full opts (including the entire body) per request.
+function sanitizeRequest(opts) {
+  return {
+    id: opts.id,
+    origin: sanitizeOrigin(opts.origin),
+    path: opts.path,
+    method: opts.method,
+    headers: sanitizeHeaders(opts.headers),
+    body: describeBody(opts.body),
+  }
+}
+
 class Handler extends DecoratorHandler {
-  #opts
+  #ureq
   #logger
 
   #abort
@@ -25,8 +159,8 @@ class Handler extends DecoratorHandler {
   constructor(logOpts, opts, { handler }) {
     super(handler)
 
-    this.#opts = opts
-    this.#logger = opts.logger.child({ ureq: opts })
+    this.#ureq = sanitizeRequest(opts)
+    this.#logger = opts.logger.child({ ureq: this.#ureq })
 
     if (logOpts?.bindings) {
       this.#logger = this.#logger.child(logOpts?.bindings)
@@ -59,7 +193,7 @@ class Handler extends DecoratorHandler {
 
     this.#logger.debug(
       {
-        ures: { statusCode, headers },
+        ures: { statusCode, headers: sanitizeHeaders(headers) },
         elapsedTime: this.#timing.headers,
       },
       'upstream request upgrade',
@@ -76,7 +210,9 @@ class Handler extends DecoratorHandler {
   onHeaders(statusCode, headers, resume) {
     this.#timing.headers = performance.now() - this.#created
     this.#statusCode = statusCode
-    this.#headers = headers
+    // Only used for log records; store the sanitized copy so set-cookie etc.
+    // never end up in retained (error-level) logs.
+    this.#headers = sanitizeHeaders(headers)
 
     return super.onHeaders(statusCode, headers, resume)
   }
@@ -95,7 +231,7 @@ class Handler extends DecoratorHandler {
     this.#timing.end = performance.now() - this.#created
 
     const data = {
-      ureq: this.#opts,
+      ureq: this.#ureq,
       ures: {
         statusCode: this.#statusCode,
         headers: this.#headers,
@@ -161,7 +297,46 @@ class Handler extends DecoratorHandler {
       this[kGlobalIndex] = -1
     }
   }
+
+  // Finalization for a request whose inner dispatch threw synchronously:
+  // undici never took ownership of the handler, so no terminal callback
+  // (onError/onComplete) will ever arrive. Log the failure and deregister
+  // from the in-flight registry. Deliberately does NOT forward onError —
+  // the dispatch entry below rethrows and an outer interceptor (lookup)
+  // delivers the error to the original handler chain, so forwarding here
+  // would double-deliver it.
+  onDispatchError(err) {
+    if (this[kGlobalIndex] === -1) {
+      // A terminal callback already ran before the error escaped dispatch
+      // (e.g. onError was delivered and the error was then rethrown):
+      // already logged and deregistered.
+      return
+    }
+
+    this.#timing.end = performance.now() - this.#created
+
+    this.#logger.error({ err, elapsedTime: this.#timing.end }, 'upstream request failed')
+
+    this.onDone()
+  }
 }
 
-export default (logOpts) => (dispatch) => (opts, handler) =>
-  opts.logger ? dispatch(opts, new Handler(logOpts, opts, { handler })) : dispatch(opts, handler)
+export default (logOpts) => (dispatch) => (opts, handler) => {
+  if (!opts.logger) {
+    return dispatch(opts, handler)
+  }
+
+  const logHandler = new Handler(logOpts, opts, { handler })
+
+  try {
+    return dispatch(opts, logHandler)
+  } catch (err) {
+    // An inner interceptor threw synchronously at dispatch time (e.g. proxy
+    // loop detection). The error escapes past the already-registered handler,
+    // which would otherwise stay in the global in-flight registry forever.
+    // Finalize it and rethrow so outer interceptors observe the same error
+    // as before.
+    logHandler.onDispatchError(err)
+    throw err
+  }
+}

package/lib/interceptor/pressure.js

@@ -26,9 +26,29 @@ import { DecoratorHandler } from '../utils.js'
 // flaps": the predicate filters healthy saturation before it enters the signal,
 // and the EWMA window + Schmitt-trigger dead-band (engage high, release low) is
 // the oomd-style sustained-duration requirement.
+//
+// PSI measures *stall* (latency) pressure; an HTTP origin has a second failure
+// mode the latency signal is blind to: responding *fast* but *failing*. A flood
+// of 503/429 drains `pending` and ticks `completed`, so neither `some` nor
+// `full` fires — yet it is exactly when you should back off. So we add a third,
+// HTTP-specific tier alongside the two PSI levels:
+//
+//  - errorRate (EWMA of the fraction of completions that were overload errors:
+//    429/420 or 5xx, plus transport failures) -> `degraded` -> shed
+//    discretionary work, same tier as `some`. (A *rate*, not a per-tick bool, so
+//    a trickle of errors under heavy traffic doesn't latch.) The `peer.dns`
+//    interceptor already tracks 5xx per resolved IP for load balancing; this is
+//    the same insight applied at the logical-origin level for backoff.
 
 const EPS = 1e-3
 
+// Overload-shaped response statuses: explicit rate limits (429/420) and server
+// errors (5xx). 4xx client errors (404, 400, 401, …) are NOT origin pressure —
+// they don't mean the origin is struggling — so they don't count.
+function isErrorStatus(statusCode) {
+  return statusCode === 429 || statusCode === 420 || statusCode >= 500
+}
+
 // Smallest priority that is still "discretionary" — sheddable under `some`
 // pressure. low/lower/lowest (<= -1); normal and above are never shed.
 function isDiscretionary(priority) {
@@ -53,6 +73,8 @@ class PressureMonitor {
   #someLo
   #fullHi
   #fullLo
+  #errHi
+  #errLo
 
   constructor({
     sampleInterval = 200,
@@ -61,6 +83,8 @@ class PressureMonitor {
     someLo = 0.2,
     fullHi = 0.3,
     fullLo = 0.1,
+    errHi = 0.5,
+    errLo = 0.2,
   } = {}) {
     this.#sampleInterval = sampleInterval
     this.#tau = tau
@@ -68,6 +92,8 @@ class PressureMonitor {
     this.#someLo = someLo
     this.#fullHi = fullHi
     this.#fullLo = fullLo
+    this.#errHi = errHi
+    this.#errLo = errLo
   }
 
   // Called from the interceptor on each dispatch to get (or lazily create) the
@@ -85,11 +111,15 @@ class PressureMonitor {
         pending: 0, // gauge: dispatched, awaiting onConnect (waiting for a slot)
         running: 0, // gauge: connected and in-flight
         completed: 0, // counter: cumulative settled (onComplete + onError)
+        errored: 0, // counter: cumulative settled with an overload error
         prevCompleted: 0, // snapshot of `completed` at the previous sample
+        prevErrored: 0, // snapshot of `errored` at the previous sample
         some: 0, // EWMA: fraction of recent time `someNow` held
         full: 0, // EWMA: fraction of recent time `fullNow` held
+        errorRate: 0, // EWMA: smoothed fraction of completions that errored
         shed: false, // latched: shed discretionary work
         paused: false, // latched: pause the producer
+        degraded: false, // latched: error rate too high
         lastSample: performance.now(),
       }
       this.#origins.set(key, rec)
@@ -109,14 +139,21 @@ class PressureMonitor {
     }
     rec.lastSample = now
 
+    const dCompleted = rec.completed - rec.prevCompleted
+    const dErrored = rec.errored - rec.prevErrored
     const someNow = rec.pending > 0
-    const progressed = rec.completed - rec.prevCompleted > 0
-    const fullNow = someNow && !progressed
+    const fullNow = someNow && dCompleted === 0
+    // Error *fraction* this window — a rate, so volume doesn't matter. No
+    // completions this window (idle, or hung — `full` covers that) means no new
+    // error evidence, so the signal relaxes toward 0.
+    const errNow = dCompleted > 0 ? dErrored / dCompleted : 0
     rec.prevCompleted = rec.completed
+    rec.prevErrored = rec.errored
 
     const a = 1 - Math.exp(-dt / this.#tau)
     rec.some += a * ((someNow ? 1 : 0) - rec.some)
     rec.full += a * ((fullNow ? 1 : 0) - rec.full)
+    rec.errorRate += a * (errNow - rec.errorRate)
 
     // Hysteresis: engage high, release low.
     if (!rec.shed && rec.some > this.#someHi) {
@@ -129,6 +166,11 @@ class PressureMonitor {
     } else if (rec.paused && rec.full < this.#fullLo) {
       rec.paused = false
     }
+    if (!rec.degraded && rec.errorRate > this.#errHi) {
+      rec.degraded = true
+    } else if (rec.degraded && rec.errorRate < this.#errLo) {
+      rec.degraded = false
+    }
   }
 
   // Tick every tracked origin, then evict any that is fully idle and has decayed
@@ -138,7 +180,13 @@ class PressureMonitor {
     const now = performance.now()
     for (const [key, rec] of this.#origins) {
       this.#sample(rec, now)
-      if (rec.pending === 0 && rec.running === 0 && rec.some < EPS && rec.full < EPS) {
+      if (
+        rec.pending === 0 &&
+        rec.running === 0 &&
+        rec.some < EPS &&
+        rec.full < EPS &&
+        rec.errorRate < EPS
+      ) {
         this.#origins.delete(key)
       }
     }
@@ -169,10 +217,13 @@ class PressureMonitor {
       pending: rec.pending,
       running: rec.running,
       completed: rec.completed,
+      errored: rec.errored,
       some: rec.some,
       full: rec.full,
+      errorRate: rec.errorRate,
       shed: rec.shed,
       paused: rec.paused,
+      degraded: rec.degraded,
     }
   }
 
@@ -196,12 +247,20 @@ class PressureMonitor {
   pressure(origin) {
     const rec = this.#origins.get(origin)
     return rec
-      ? { some: rec.some, full: rec.full, shed: rec.shed, paused: rec.paused }
-      : { some: 0, full: 0, shed: false, paused: false }
+      ? {
+          some: rec.some,
+          full: rec.full,
+          errorRate: rec.errorRate,
+          shed: rec.shed,
+          paused: rec.paused,
+          degraded: rec.degraded,
+        }
+      : { some: 0, full: 0, errorRate: 0, shed: false, paused: false, degraded: false }
   }
 
   // Producer-side gate mirroring the README's `submit` recipe: `full` pauses
-  // everything; `some` sheds only discretionary (low-priority) work.
+  // everything; `some` (backlog) or `degraded` (error rate) sheds only
+  // discretionary (low-priority) work.
   shouldBackoff(origin, priority) {
     const rec = this.#origins.get(origin)
     if (rec == null) {
@@ -210,7 +269,7 @@ class PressureMonitor {
     if (rec.paused) {
       return true
     }
-    if (rec.shed) {
+    if (rec.shed || rec.degraded) {
       return isDiscretionary(priority)
     }
     return false
@@ -236,6 +295,7 @@ class Handler extends DecoratorHandler {
   // times onConnect is invoked (e.g. a retry handler upstream) or which
   // terminal callback fires.
   #state = 'pending'
+  #statusCode = 0
 
   constructor(handler, rec) {
     // super() validates the handler and throws on a non-object before we touch
@@ -246,6 +306,11 @@ class Handler extends DecoratorHandler {
   }
 
   onConnect(abort) {
+    // A (re)connect begins a fresh attempt: clear the captured status so a prior
+    // attempt's status can't leak into a later transport failure's
+    // classification. A handler upstream (e.g. response-retry) may reconnect
+    // this same handler across retries, and response-retry itself resets here.
+    this.#statusCode = 0
     if (this.#state === 'pending') {
       this.#state = 'running'
       this.#rec.pending -= 1
@@ -254,17 +319,42 @@ class Handler extends DecoratorHandler {
     super.onConnect(abort)
   }
 
+  onHeaders(statusCode, headers, resume) {
+    // Latest status wins, so an informational 1xx is superseded by the final
+    // response. Read at onComplete to classify the outcome.
+    this.#statusCode = statusCode
+    return super.onHeaders(statusCode, headers, resume)
+  }
+
+  onUpgrade(statusCode, headers, socket) {
+    // A successful upgrade (HTTP 101) is its own terminal branch — neither
+    // onComplete nor onError follows it (see the dns interceptor's Handler for
+    // the same fix). Settle as a success here, otherwise `running` stays >= 1
+    // forever: the per-origin record can never satisfy the eviction condition
+    // and the sampling timer keeps firing for the process lifetime. An upgrade
+    // is a success, not an overload error.
+    this.#settle(false)
+    super.onUpgrade(statusCode, headers, socket)
+  }
+
   onComplete(trailers) {
-    this.#settle()
+    this.#settle(isErrorStatus(this.#statusCode))
     super.onComplete(trailers)
   }
 
   onError(err) {
-    this.#settle()
+    // A status-bearing error is `responseError`'s decorated 4xx/5xx (when this
+    // interceptor sits outside it); classify by that status. A status-less
+    // error is a transport/connection failure (ECONNREFUSED, timeout, a sync
+    // dispatch throw) — count it, unless it's a client-initiated abort.
+    const statusCode = err?.statusCode ?? this.#statusCode
+    const isError =
+      err?.name === 'AbortError' ? false : statusCode >= 200 ? isErrorStatus(statusCode) : true
+    this.#settle(isError)
     super.onError(err)
   }
 
-  #settle() {
+  #settle(isError) {
     if (this.#state === 'done') {
       return
     }
@@ -274,6 +364,9 @@ class Handler extends DecoratorHandler {
       this.#rec.running -= 1
     }
     this.#rec.completed += 1
+    if (isError) {
+      this.#rec.errored += 1
+    }
     this.#state = 'done'
   }
 }

package/lib/interceptor/proxy.js

@@ -2,13 +2,15 @@ import net from 'node:net'
 import createError from 'http-errors'
 import { DecoratorHandler } from '../utils.js'
 
+function noop() {}
+
 // Accumulator used by reduceHeaders on the response path. Hoisted to module
 // scope so it is allocated once rather than on every onHeaders/onUpgrade call.
 /**
- * @param {Record<string, string>} acc
+ * @param {Record<string, string | string[]>} acc
  * @param {string} key
- * @param {string} val
- * @returns {Record<string, string>}
+ * @param {string | string[]} val
+ * @returns {Record<string, string | string[]>}
  */
 const copyHeader = (acc, key, val) => {
   acc[key] = val
@@ -25,9 +27,9 @@ class Handler extends DecoratorHandler {
   }
 
   onUpgrade(statusCode, headers, socket) {
-    super.onUpgrade(
-      statusCode,
-      reduceHeaders(
+    let reduced
+    try {
+      reduced = reduceHeaders(
         {
           headers,
           httpVersion: this.#opts.httpVersion ?? this.#opts.req?.httpVersion,
@@ -39,9 +41,21 @@ class Handler extends DecoratorHandler {
         },
         copyHeader,
         {},
-      ),
-      socket,
-    )
+      )
+    } catch (err) {
+      // reduceHeaders throws on protocol errors (inbound Forwarded on a
+      // response → BadGateway, looping Via → LoopDetected). A throw must not
+      // escape onUpgrade: undici's H1 upgrade path nulls the request's queue
+      // slot before invoking onUpgrade and its catch only destroys the socket
+      // — no onError ever reaches the handler chain, leaving the caller
+      // waiting forever. Deliver the terminal error downstream ourselves
+      // (super.onError is once-guarded) and destroy the socket so it is not
+      // leaked; noop error listener since nothing downstream ever receives it.
+      socket.on('error', noop).destroy(err)
+      super.onError(err)
+      return
+    }
+    super.onUpgrade(statusCode, reduced, socket)
   }
 
   onHeaders(statusCode, headers, resume) {
@@ -104,8 +118,13 @@ function isHopByHop(key) {
     case 4:
       return eqiLower(key, 'host')
     case 7:
-      return eqiLower(key, 'upgrade')
+      // `trailer` (RFC 7230 §4.4) is hop-by-hop and must not be relayed; it was
+      // previously missed here (only `upgrade` shares this length), leaking the
+      // upstream's Trailer announcement to the next hop after transfer-encoding
+      // was already stripped.
+      return eqiLower(key, 'upgrade') || eqiLower(key, 'trailer')
     case 8:
+      // 'trailers' is the RFC 2616 §13.5.1 spelling kept for compatibility.
       return eqiLower(key, 'trailers')
     case 10:
       return eqiLower(key, 'connection') || eqiLower(key, 'keep-alive')
@@ -143,8 +162,10 @@ function isHopByHop(key) {
  * @param {boolean} [options.isResponse] Response path marker. When set,
  *   Forwarded is never synthesised regardless of `socket` (it would leak the
  *   proxy's own addresses downstream); an inbound Forwarded is still rejected.
- * @param {(acc: T, key: string, value: string) => T} fn Accumulator invoked
- *   once per retained header.
+ * @param {(acc: T, key: string, value: string | string[]) => T} fn Accumulator
+ *   invoked once per retained header. The value is an array when the field
+ *   appeared more than once (parseHeaders shape) — never pre-joined, because
+ *   fields like set-cookie (RFC 6265) must keep distinct field lines.
  * @param {T} acc Initial accumulator value.
  * @returns {T}
  */
@@ -257,7 +278,16 @@ function reduceHeaders({ headers, proxyName, httpVersion, socket, isResponse },
       (remove === null || !remove.includes(key.toLowerCase())) &&
       !isHopByHop(key)
     ) {
-      acc = fn(acc, key, headers[key].toString())
+      // A repeated field-line arrives as an array (parseHeaders collects
+      // them). Pass it through as-is — .toString() would comma-join with no
+      // space, corrupting fields whose values legally contain commas and must
+      // never be combined: set-cookie (RFC 9110 §5.3 / RFC 6265, e.g. an
+      // Expires date) and multi-challenge www-authenticate. Array values are
+      // exactly the shape parseHeaders delivers without this interceptor, and
+      // both the request path (undici accepts array header values) and the
+      // response handler chain already relay it.
+      const value = headers[key]
+      acc = fn(acc, key, Array.isArray(value) ? value : value.toString())
     }
   }
 
@@ -353,7 +383,10 @@ export default () => (dispatch) => (opts, handler) => {
       proxyName: opts.proxy.name,
     },
     (obj, key, val) => {
-      if (key === 'content-length' && !expectsPayload) {
+      // Case-insensitive (eqiLower) like reduceHeaders' capture above: the
+      // standalone interceptors.proxy() composition may pass mixed-case keys
+      // (the production path lowercases via parseHeaders first).
+      if (!expectsPayload && key.length === 14 && eqiLower(key, 'content-length')) {
         // https://tools.ietf.org/html/rfc7230#section-3.3.2
         // A user agent SHOULD NOT send a Content-Length header field when
         // the request message does not contain a payload body and the method
@@ -361,7 +394,7 @@ export default () => (dispatch) => (opts, handler) => {
         // undici will error if provided an unexpected content-length: 0 header.
       } else if (key[0] === ':') {
         // strip pseudo headers
-      } else if (key === 'expect') {
+      } else if (key.length === 6 && eqiLower(key, 'expect')) {
         // undici doesn't support expect header.
       } else {
         obj[key] = val