@optimizely-opal/opal-tool-ocp-sdk 1.0.0-OCP-1441.4 → 1.0.0-OCP-1442.2

package/src/logging/ToolLogger.ts

@@ -0,0 +1,175 @@
+import { logger, LogVisibility } from '@zaiusinc/app-sdk';
+import * as App from '@zaiusinc/app-sdk';
+
+/**
+ * Utility class for logging Opal tool requests and responses with security considerations
+ */
+export class ToolLogger {
+  private static readonly SENSITIVE_FIELDS = [
+    // Authentication / secrets
+    'password',
+    'pass',
+    'secret',
+    'key',
+    'token',
+    'auth',
+    'credentials',
+    'access_token',
+    'refresh_token',
+    'api_key',
+    'private_key',
+    'client_secret',
+    'session_token',
+    'authorization',
+
+    // Payment-related
+    'card_number',
+    'credit_card',
+    'cvv',
+    'expiry_date',
+
+    // Personal info
+    'ssn', // social security number
+    'nid', // national ID
+    'passport',
+    'dob', // date of birth
+    'email',
+    'phone',
+    'address',
+
+    // Misc / environment
+    'otp',
+    'pin',
+    'security_answer',
+    'security_question',
+    'signing_key',
+    'encryption_key',
+    'jwt',
+    'bearer_token'
+  ];
+
+  private static readonly MAX_PARAM_LENGTH = 100;
+  private static readonly MAX_ARRAY_ITEMS = 10;
+
+  /**
+   * Redacts sensitive data from an object
+   */
+  private static redactSensitiveData(data: any, maxDepth = 5): any {
+    if (maxDepth <= 0 || data === null || data === undefined) {
+      return data;
+    }
+
+    if (typeof data === 'string') {
+      return data.length > this.MAX_PARAM_LENGTH
+        ? `${data.substring(0, this.MAX_PARAM_LENGTH)}... (truncated, ${data.length} chars total)`
+        : data;
+    }
+
+    if (typeof data === 'number' || typeof data === 'boolean') {
+      return data;
+    }
+
+    if (Array.isArray(data)) {
+      const truncated = data.slice(0, this.MAX_ARRAY_ITEMS);
+      const result = truncated.map((item) => this.redactSensitiveData(item, maxDepth - 1));
+      if (data.length > this.MAX_ARRAY_ITEMS) {
+        result.push(`... (${data.length - this.MAX_ARRAY_ITEMS} more items truncated)`);
+      }
+      return result;
+    }
+
+    if (typeof data === 'object') {
+      const result: any = {};
+      for (const [key, value] of Object.entries(data)) {
+        // Check if this field contains sensitive data
+        const isSensitive = this.isSensitiveField(key);
+
+        if (isSensitive) {
+          result[key] = '[REDACTED]';
+        } else {
+          result[key] = this.redactSensitiveData(value, maxDepth - 1);
+        }
+      }
+      return result;
+    }
+
+    return data;
+  }
+
+  /**
+   * Checks if a field name is considered sensitive
+   */
+  private static isSensitiveField(fieldName: string): boolean {
+    const lowerKey = fieldName.toLowerCase();
+    return this.SENSITIVE_FIELDS.some((sensitiveField) =>
+      lowerKey.includes(sensitiveField)
+    );
+  }
+
+  /**
+   * Creates a summary of request parameters
+   */
+  private static createParameterSummary(params: any): any {
+    if (!params) {
+      return null;
+    }
+
+    return this.redactSensitiveData(params);
+  }
+
+  /**
+   * Calculates content length of response data
+   */
+  private static calculateContentLength(responseData?: any): number | string {
+    if (!responseData) {
+      return 0;
+    }
+
+    try {
+      const serialized = JSON.stringify(responseData);
+      return serialized.length;
+    } catch {
+      return 'unknown';
+    }
+  }
+
+  /**
+   * Logs an incoming request
+   */
+  public static logRequest(
+    req: App.Request,
+  ): void {
+    const params = req.bodyJSON && req.bodyJSON.parameters ? req.bodyJSON.parameters : req.bodyJSON;
+    const requestLog = {
+      event: 'opal_tool_request',
+      path: req.path,
+      parameters: this.createParameterSummary(params)
+    };
+
+    // Log with Zaius audience so developers only see requests for accounts they have access to
+    logger.info(LogVisibility.Zaius, JSON.stringify(requestLog));
+  }
+
+  /**
+   * Logs a successful response
+   */
+  public static logResponse(
+    req: App.Request,
+    response: App.Response,
+    processingTimeMs?: number
+  ): void {
+
+    const responseLog = {
+      event: 'opal_tool_response',
+      path: req.path,
+      duration: processingTimeMs ? `${processingTimeMs}ms` : undefined,
+      status: response.status,
+      contentType: response.headers?.get('content-type') || 'unknown',
+      contentLength: this.calculateContentLength(response.bodyJSON),
+      success: response.status >= 200 && response.status < 300
+    };
+
+    // Log with Zaius audience so developers only see requests for accounts they have access to
+    logger.info(LogVisibility.Zaius, JSON.stringify(responseLog));
+  }
+}