@onlineapps/service-common 2.0.1 → 3.0.1

package/src/errors/errorMiddleware.js

@@ -1,112 +0,0 @@
-'use strict';
-
-// See: docs/biz/70-contracts/error-handling.md
-const { BusinessError, isBusinessError } = require('./BusinessError');
-
-function businessErrorHandler(err, req, res, next) {
-  if (res.headersSent) {
-    return next(err);
-  }
-
-  const logger = req.app?.locals?.logger || console;
-
-  if (isBusinessError(err)) {
-    logger.warn(`[BusinessError] ${err.errorCode}: ${err.message}`, {
-      statusCode: err.statusCode,
-      errorCode: err.errorCode,
-      type: err.type,
-      details: err.details,
-      service: err.service,
-      operation: err.operation,
-      method: req.method,
-      url: req.originalUrl
-    });
-
-    return res.status(err.statusCode).json({
-      error: err.toJSON()
-    });
-  }
-
-  if (err.name === 'SequelizeUniqueConstraintError') {
-    const fields = err.errors?.map(e => e.path) || [];
-    logger.warn(`[BusinessError] DUPLICATE_RESOURCE: ${err.message}`, {
-      statusCode: 409,
-      fields,
-      method: req.method,
-      url: req.originalUrl
-    });
-
-    return res.status(409).json({
-      error: {
-        code: 'DUPLICATE_RESOURCE',
-        message: 'Resource already exists',
-        statusCode: 409,
-        details: fields.length > 0 ? [`Duplicate value for: ${fields.join(', ')}`] : undefined
-      }
-    });
-  }
-
-  if (err.name === 'SequelizeValidationError') {
-    const details = err.errors?.map(e => e.message) || [];
-    logger.warn(`[BusinessError] VALIDATION_FAILED: ${err.message}`, {
-      statusCode: 400,
-      details,
-      method: req.method,
-      url: req.originalUrl
-    });
-
-    return res.status(400).json({
-      error: {
-        code: 'VALIDATION_FAILED',
-        message: 'Validation failed',
-        statusCode: 400,
-        details
-      }
-    });
-  }
-
-  if (err.type === 'entity.parse.failed' || (err.message && err.message.includes('JSON'))) {
-    return res.status(400).json({
-      error: {
-        code: 'INVALID_JSON',
-        message: 'Invalid JSON in request body',
-        statusCode: 400
-      }
-    });
-  }
-
-  logger.error(`[UnhandledError] ${err.message}`, {
-    error: err.message,
-    stack: err.stack,
-    method: req.method,
-    url: req.originalUrl
-  });
-
-  const isProduction = process.env.NODE_ENV === 'production';
-
-  return res.status(500).json({
-    error: {
-      code: 'INTERNAL_ERROR',
-      message: isProduction ? 'Internal server error' : err.message,
-      statusCode: 500
-    }
-  });
-}
-
-function notFoundHandler(req, res) {
-  const logger = req.app?.locals?.logger || console;
-  logger.warn('Route not found', {
-    method: req.method,
-    url: req.originalUrl
-  });
-
-  res.status(404).json({
-    error: {
-      code: 'ROUTE_NOT_FOUND',
-      message: `Route ${req.method} ${req.originalUrl} not found`,
-      statusCode: 404
-    }
-  });
-}
-
-module.exports = { businessErrorHandler, notFoundHandler };

package/src/errors/index.js

@@ -1,29 +0,0 @@
-'use strict';
-
-const {
-  BusinessError,
-  NotFoundError,
-  ValidationError,
-  ConflictError,
-  BusinessRuleError,
-  AuthorizationError,
-  ServiceUnavailableError,
-  isBusinessError,
-  ERROR_TYPES
-} = require('./BusinessError');
-
-const { businessErrorHandler, notFoundHandler } = require('./errorMiddleware');
-
-module.exports = {
-  BusinessError,
-  NotFoundError,
-  ValidationError,
-  ConflictError,
-  BusinessRuleError,
-  AuthorizationError,
-  ServiceUnavailableError,
-  isBusinessError,
-  ERROR_TYPES,
-  businessErrorHandler,
-  notFoundHandler
-};

package/src/redactSensitive.js

@@ -1,87 +0,0 @@
-'use strict';
-
-/**
- * Sensitive-input redaction (SecretBox F1.5).
- * Contract: api/docs/architecture/secretbox.md §8.
- *
- * Pure, dependency-free helpers used by every layer that logs, traces, or
- * otherwise persists workflow/operation inputs (gateway, orchestrator, monitoring
- * consumer). Single implementation — no duplication across layers.
- *
- * Operations declare sensitive input fields at operation level in operations.json:
- *   "sensitive_input_fields": ["value", ...]
- * (NOT inside the JSON Schema — service-wrapper compiles input schemas with AJV
- * strict:true, which throws on unknown keywords.)
- *
- * `redactSensitiveDeep` deep-clones the value and replaces any object key whose
- * name is in `fieldNames` with the REDACTED placeholder, at any depth. It never
- * mutates the input. Over-redaction (a sensitive field name matching elsewhere in
- * the same payload) is acceptable and safe for observability sinks.
- *
- * IMPORTANT: this is for observability/log/trace copies only. The execution message
- * that carries the value to its owning handler MUST NOT be redacted.
- */
-
-const REDACTED_PLACEHOLDER = '[REDACTED]';
-const CIRCULAR_PLACEHOLDER = '[Circular]';
-
-/**
- * Extract the sensitive input field names for one operation from a service spec
- * (the `registry:service:<name>:spec` shape, or a local operations.json object).
- * @param {object} serviceSpec - object with `.operations[<op>]`.
- * @param {string} operationName
- * @returns {string[]} field names (empty array when none / not found).
- */
-function sensitiveFieldsForOperation(serviceSpec, operationName) {
-  const op =
-    serviceSpec &&
-    serviceSpec.operations &&
-    typeof serviceSpec.operations === 'object'
-      ? serviceSpec.operations[operationName]
-      : undefined;
-  const list = op && op.sensitive_input_fields;
-  return Array.isArray(list) ? list.filter((f) => typeof f === 'string' && f.length > 0) : [];
-}
-
-function _walk(node, fields, seen) {
-  if (node === null || typeof node !== 'object') return node;
-  // Do not recurse into non-plain objects; return a shallow copy where safe.
-  if (node instanceof Date) return new Date(node.getTime());
-  if (typeof Buffer !== 'undefined' && Buffer.isBuffer(node)) return node;
-  if (seen.has(node)) return CIRCULAR_PLACEHOLDER;
-  seen.add(node);
-
-  if (Array.isArray(node)) {
-    return node.map((el) => _walk(el, fields, seen));
-  }
-
-  const out = {};
-  for (const key of Object.keys(node)) {
-    if (fields.has(key)) {
-      out[key] = REDACTED_PLACEHOLDER;
-    } else {
-      out[key] = _walk(node[key], fields, seen);
-    }
-  }
-  return out;
-}
-
-/**
- * Deep-clone `value`, replacing any object property named in `fieldNames` with
- * the REDACTED placeholder. Does not mutate the input.
- * @param {*} value - any JSON-ish value (object/array/primitive).
- * @param {string[]|Set<string>} fieldNames - sensitive field names to redact.
- * @returns {*} redacted deep clone (or the original value when there is nothing
- *   to redact — no sensitive fields means no mutation risk).
- */
-function redactSensitiveDeep(value, fieldNames) {
-  const fields = fieldNames instanceof Set ? fieldNames : new Set(fieldNames || []);
-  if (fields.size === 0) return value;
-  return _walk(value, fields, new WeakSet());
-}
-
-module.exports = {
-  REDACTED_PLACEHOLDER,
-  sensitiveFieldsForOperation,
-  redactSensitiveDeep
-};