@optimizely-opal/opal-tool-ocp-sdk 1.0.0-OCP-1441.3 → 1.0.0-OCP-1442.1

package/src/logging/ToolLogger.ts

@@ -0,0 +1,146 @@
+import { logger, LogVisibility } from '@zaiusinc/app-sdk';
+import * as App from '@zaiusinc/app-sdk';
+
+/**
+ * Utility class for logging Opal tool requests and responses with security considerations
+ */
+export class ToolLogger {
+  private static readonly SENSITIVE_FIELDS = [
+    'password',
+    'secret',
+    'key',
+    'token',
+    'auth',
+    'credentials',
+    'access_token',
+    'refresh_token',
+    'api_key',
+    'private_key',
+    'client_secret'
+  ];
+
+  private static readonly MAX_PARAM_LENGTH = 100;
+  private static readonly MAX_ARRAY_ITEMS = 10;
+
+  /**
+   * Redacts sensitive data from an object
+   */
+  private static redactSensitiveData(data: any, maxDepth = 5): any {
+    if (maxDepth <= 0 || data === null || data === undefined) {
+      return data;
+    }
+
+    if (typeof data === 'string') {
+      return data.length > this.MAX_PARAM_LENGTH
+        ? `${data.substring(0, this.MAX_PARAM_LENGTH)}... (truncated, ${data.length} chars total)`
+        : data;
+    }
+
+    if (typeof data === 'number' || typeof data === 'boolean') {
+      return data;
+    }
+
+    if (Array.isArray(data)) {
+      const truncated = data.slice(0, this.MAX_ARRAY_ITEMS);
+      const result = truncated.map((item) => this.redactSensitiveData(item, maxDepth - 1));
+      if (data.length > this.MAX_ARRAY_ITEMS) {
+        result.push(`... (${data.length - this.MAX_ARRAY_ITEMS} more items truncated)`);
+      }
+      return result;
+    }
+
+    if (typeof data === 'object') {
+      const result: any = {};
+      for (const [key, value] of Object.entries(data)) {
+        // Check if this field contains sensitive data
+        const isSensitive = this.isSensitiveField(key);
+
+        if (isSensitive) {
+          result[key] = '[REDACTED]';
+        } else {
+          result[key] = this.redactSensitiveData(value, maxDepth - 1);
+        }
+      }
+      return result;
+    }
+
+    return data;
+  }
+
+  /**
+   * Checks if a field name is considered sensitive
+   */
+  private static isSensitiveField(fieldName: string): boolean {
+    const lowerKey = fieldName.toLowerCase();
+    return this.SENSITIVE_FIELDS.some((sensitiveField) =>
+      lowerKey.includes(sensitiveField)
+    );
+  }
+
+  /**
+   * Creates a summary of request parameters
+   */
+  private static createParameterSummary(params: any): any {
+    if (!params) {
+      return null;
+    }
+
+    return this.redactSensitiveData(params);
+  }
+
+  /**
+   * Calculates content length of response data
+   */
+  private static calculateContentLength(responseData?: any): number | string {
+    if (!responseData) {
+      return 0;
+    }
+
+    try {
+      const serialized = JSON.stringify(responseData);
+      return serialized.length;
+    } catch {
+      return 'unknown';
+    }
+  }
+
+  /**
+   * Logs an incoming request
+   */
+  public static logRequest(
+    req: App.Request,
+  ): void {
+    const params = req.bodyJSON && req.bodyJSON.parameters ? req.bodyJSON.parameters : req.bodyJSON;
+    const requestLog = {
+      event: 'opal_tool_request',
+      path: req.path,
+      parameters: this.createParameterSummary(params)
+    };
+
+    // Log with Zaius audience so developers only see requests for accounts they have access to
+    logger.info(LogVisibility.Zaius, requestLog);
+  }
+
+  /**
+   * Logs a successful response
+   */
+  public static logResponse(
+    req: App.Request,
+    response: App.Response,
+    processingTimeMs?: number
+  ): void {
+
+    const responseLog = {
+      event: 'opal_tool_response',
+      path: req.path,
+      duration: processingTimeMs ? `${processingTimeMs}ms` : undefined,
+      status: response.status,
+      contentType: response.headers?.get('content-type') || 'unknown',
+      contentLength: this.calculateContentLength(response.bodyJSON),
+      success: response.status >= 200 && response.status < 300
+    };
+
+    // Log with Zaius audience so developers only see requests for accounts they have access to
+    logger.info(LogVisibility.Zaius, responseLog);
+  }
+}

package/src/service/Service.test.ts

@@ -11,11 +11,30 @@ jest.mock('@zaiusinc/app-sdk', () => ({
   Function: class {
     public constructor(public request: any) {}
   },
-  Response: jest.fn().mockImplementation((status, data) => ({
+  Headers: class {
+    public constructor(headers: string[][] = []) {
+      this.headers = {};
+      headers.forEach(([name, value]) => {
+        this.headers[name.toLowerCase()] = value;
+      });
+    }
+    public headers: { [key: string]: string };
+    public set(name: string, value: string) {
+      this.headers[name.toLowerCase()] = value;
+    }
+    public get(name: string) {
+      return this.headers[name.toLowerCase()];
+    }
+    public has(name: string) {
+      return name.toLowerCase() in this.headers;
+    }
+  },
+  Response: jest.fn().mockImplementation((status, data, headers) => ({
     status,
     data,
     bodyJSON: data,
-    bodyAsU8Array: new Uint8Array()
+    bodyAsU8Array: new Uint8Array(),
+    headers: headers || { get: jest.fn(), has: jest.fn(), set: jest.fn() }
   }))
 }));
 
@@ -734,6 +753,10 @@ describe('ToolsService', () => {
         expect(errors[0]).toHaveProperty('field', 'name');
         expect(errors[0]).toHaveProperty('message', "Parameter 'name' must be a string, but received number");
 
+        // Check that the content type is set to application/problem+json for RFC 9457 compliance
+        expect(response.headers).toBeDefined();
+        expect(response.headers.get('content-type')).toBe('application/problem+json');
+
         // Verify the handler was not called
         expect(toolWithTypedParams.handler).not.toHaveBeenCalled();
       });

package/src/service/Service.ts

@@ -1,7 +1,7 @@
 /* eslint-disable max-classes-per-file */
 import { AuthRequirement, Parameter } from '../types/Models';
 import * as App from '@zaiusinc/app-sdk';
-import { logger } from '@zaiusinc/app-sdk';
+import { logger, Headers } from '@zaiusinc/app-sdk';
 import { ToolFunction } from '../function/ToolFunction';
 import { GlobalToolFunction } from '../function/GlobalToolFunction';
 import { ParameterValidator } from '../validation/ParameterValidator';
@@ -187,7 +187,7 @@ export class ToolsService {
                   field: error.field,
                   message: error.message
                 }))
-              });
+              }, new Headers([['content-type', 'application/problem+json']]));
             }
           }