@reportforge/playwright-pdf 0.22.1 → 0.23.0

package/README.md

@@ -64,6 +64,7 @@ Three templates, one reporter. Every PDF is fully offline: fonts, charts, and sc
 - **Rich execution capture**: opt-in "Steps to Reproduce" outline (a nested, copy-pasteable Markdown list of your `test.step`s and assertions; add `apiSteps` for the full click/fill/check trail), Node console tail, and trace/video links under each failed test in the defect log. Read straight from the Playwright step tree: no fixtures, no test-code changes. Enable via `capture` (`steps` / `apiSteps` / `console` / `evidence`); off by default.
 - **Configurable sections**: add or remove any report section per template via `sections`.
 - **Executive report brief band**: leads with a plain-language brief (trend + root causes) and one hero pass-rate number instead of a flat KPI grid
+- **Data protection**: AES-256 password-protected PDFs (no external tools) and opt-in redaction of credentials/PII in report content and live streams
 - **Hybrid licensing**: one short key unlocks it; reports keep rendering offline via a locally cached license between refreshes
 - **Update notice**: when a newer reporter version is published, each run ends with one info line naming it and the update command; no extra network calls
 
@@ -187,7 +188,7 @@ All options are the second element of the reporter tuple.
 | `primaryColor` | `string` | `'#CC785C'` | Primary brand colour (3-, 6-, or 8-digit hex). Used for headers and accent bars. |
 | `accentColor` | `string` | `'#3F7D58'` | Accent brand colour (hex). Used for highlights and badges. |
 | `watermark` | `string` | n/a | Text to render as a diagonal watermark overlay from the Suite Breakdown page onward (summary/chart pages stay clean), e.g. `'CONFIDENTIAL'` or `'DRAFT'`. |
-| `pdfPassword` | `string` | n/a | Password-protect the generated PDF. Requires `qpdf` installed on the system. |
+| `pdfPassword` | `string` | n/a | Password-protect the generated PDF with AES-256, applied in-process with no external tools required. Also encrypts the failure-overflow sidecar (`*-failures.json.enc`; decrypt with `npx @reportforge/playwright-pdf decrypt-failures`). Recommended: `process.env.RF_PDF_PASSWORD`. |
 | `reportTitle` | `string` | `'Playwright Test Report'` | Custom title for the report cover page and running header. |
 | `projectName` | `string` | from `package.json` | Project or application name. Inferred from the `package.json` `name` field if absent. |
 | `open` | `boolean` | `false` | Open the generated PDF automatically after generation. For local use only; ignored in CI. |
@@ -202,6 +203,7 @@ All options are the second element of the reporter tuple.
 | `notify` | `object` | n/a | Notification channels: `slack`, `teams` (each `{ url, enabled, on }`), `discord` (`{ url, enabled, on, attachPdf }`), `email` (`{ to, enabled, on, attachPdf }`). See the Notifications docs. |
 | `failureAnalysis` | `object` | `{ enabled: true }` | Offline failure root-cause analysis (embedded classifier; no runtime network) with on-device personalization: label collected failures, then the `train-model` CLI trains + evaluates a local layer entirely on your machine; it activates only when it beats the base model, and nothing leaves the machine. Fields: `enabled` (default `true`), `maxClusters` (default `10`), `minStrength` (`weak`\|`moderate`\|`strong`, default `weak`), `maxFailuresToAnalyse` (default `500`), `collectUnclassified` (default `true`), `collectScope` (`blind-spots`\|`all`, default `blind-spots`), `autoUpdateModel` (default `true`), `localModel` (use the gate-passed on-device model, default `true`), `localModelPath` (share a team-trained model via a repo-committed file). See the Failure Analysis docs. |
 | `capture` | `object` | `{}` (off) | Opt-in rich execution capture for the defect log (reporter-side; no fixtures, no test-code changes). Fields: `steps` (a copy-pasteable "Steps to Reproduce" outline built from the Playwright step tree; each row is a Markdown list line indented under its parent `test.step`, default `false`), `apiSteps` (include every top-level `pw:api` action (click/fill/check/goto) in the outline for a full action trail; without it the outline shows only `test.step` intent + `expect` assertions, default `false`), `console` (Node stdout/stderr tail, default `false`), `evidence` (trace/video file links, default `false`), `maxSteps` (default `50`), `maxConsoleLines` (default `50`). Renders in the Defect Log section of the `detailed` template. |
+| `redact` | `object` | `{ enabled: false }` | Opt-in masking of likely credentials/PII (passwords, tokens, API keys, Bearer/JWT values, emails, high-entropy strings) in report text and the live stream. `builtins` (default `true`) toggles the built-in patterns; `patterns` adds custom regexes (fully masked); `mask` sets the replacement text (default `'[REDACTED]'`). Screenshots cannot be redacted; use `includeScreenshots: false` for strict environments. |
 | `live` | `object` | `{}` (off) | Opt-in live test-execution streaming. When `enabled`, the reporter prints an unguessable watch link to the CI logs at run start and streams per-test progress to the hosted dashboard while tests run; all shards of one CI run converge on a single live view. Fields: `enabled` (default `false`), `runId` (override the auto-derived run id), `serverUrl` (override the streaming server), `steps` (`none`\|`failed`\|`intent`\|`all`, default `failed`; `intent` shows only your `test.step` names plus any failing step), `console` (stream stdout/stderr tails, default `false`), `flushMs` (batch debounce 500-10000, default `2000`). The PDF at the end of the run is unaffected. Requires an active subscription with the `live` entitlement. See the Live Runs docs. |
 | `historyFile` | `string` | `~/.reportforge/{key}/history.json` | Path to the history JSON file. Relative paths resolve from `cwd`. Enables pass-rate trending charts in the `detailed` template. |
 | `historySize` | `number` | `10` | Maximum number of test runs to keep in the history file (integer ≥ 2). Older runs are pruned on append. |
@@ -316,6 +318,48 @@ The `on` trigger controls when the message fires:
 
 The summary includes pass rate, test counts, duration, and the report filename. Notifications require a valid license and fire after PDF generation (or after a PDF failure; you still get the ping).
 
+### Data Protection
+
+Two independent, opt-in controls: encrypt the PDF itself, and mask likely secrets before they ever reach report content.
+
+```typescript
+// playwright.config.ts
+reporter: [
+  ['@reportforge/playwright-pdf', {
+    pdfPassword: process.env.RF_PDF_PASSWORD,
+    redact: {
+      enabled: true,
+      patterns: ['MYCO_[A-Z0-9]+'],   // custom regexes, fully masked
+    },
+  }],
+],
+```
+
+**`pdfPassword`** encrypts the PDF with AES-256, applied in-process with no external tools required. When a failure-overflow sidecar is written (`maxInlineFailures` exceeded), it's encrypted too, as `{basename}-failures.json.enc`:
+
+```bash
+npx @reportforge/playwright-pdf decrypt-failures reports/2026-04-28-report-failures.json.enc --password=$RF_PDF_PASSWORD
+# or set RF_PDF_PASSWORD and drop --password
+```
+
+**`redact`** masks likely credentials and PII in error messages, stack traces, step titles, captured console output, test/suite titles, annotations, failure-analysis text, chart labels, and in the live watch stream. It runs after failure analysis, so classifier accuracy is unaffected. Built-in patterns (`builtins: true`, the default) catch:
+
+| Catches | Kept as-is | Example |
+|---|---|---|
+| `key=value` / `"key": "value"` credentials (`password`, `secret`, `token`, `apiKey`, `auth`, `credential`, `privateKey`, `accessKey`, `clientSecret`, …) | the key name | `password: "hunter2"` → `password: "[REDACTED]"` |
+| `Authorization: Bearer …` / `Basic …` | the scheme word | `Bearer eyJhbGc...` → `Bearer [REDACTED]` |
+| JWTs | n/a | `eyJhbGciOi...` |
+| Provider key prefixes | n/a | AWS `AKIA…`, GitHub `ghp_`/`gho_`/`github_pat_`, Slack `xox*`, OpenAI-style `sk-`, Razorpay `rzp_live_`/`rzp_test_`, Google `AIza…` |
+| URLs with embedded credentials | the username | `https://alice:hunter2@host` → `https://alice:[REDACTED]@host` |
+| Emails | first character + domain | `jsmith@example.com` → `j***@example.com` |
+| High-entropy strings (20+ mixed letters/digits) | n/a | tokens and keys with no recognizable prefix |
+
+Add your own with `patterns` (strings compiled as case-sensitive regexes with the `g` flag); custom matches are always fully masked. `mask` overrides the default replacement text (`'[REDACTED]'`).
+
+> **Screenshots cannot be redacted:** pixel content is opaque to text-based masking. Set `includeScreenshots: false` in strict environments.
+
+Full details at [reportforge.org/docs/advanced/security](https://reportforge.org/docs/advanced/security).
+
 ### Test History Trending
 
 After each run the reporter appends a summary entry to a local JSON file and renders a pass-rate sparkline + verdict row in the `detailed` template.
@@ -678,7 +722,6 @@ Common issues:
 
 - **`Chrome/Chromium not found`** → install Google Chrome Stable; don't use the Ubuntu `chromium-browser` snap.
 - **Charts blank** → ensure `npm run bundle-chartjs` ran at build; the reporter waits up to 30s for `window.__chartsReady`.
-- **`pdfPassword` ignored** → requires `qpdf` on `PATH` (`apt install qpdf` / `brew install qpdf` / `choco install qpdf`).
 - **No PDF generated** → verify `RF_LICENSE_KEY` is set and your subscription is active. `RF_DEBUG=1` will show the activation result; missing key, expired subscription, network failure, or no license cache all skip PDF generation.
 
 Full guide: [reportforge.org/docs/troubleshooting](https://reportforge.org/docs/troubleshooting).
@@ -697,6 +740,7 @@ Full documentation at [reportforge.org/docs](https://reportforge.org/docs):
 - [Templates](https://reportforge.org/docs/templates): minimal, detailed, executive
 - [Live runs](https://reportforge.org/docs/advanced/live): stream per-test progress to a shared watch link
 - [Report Sections](https://reportforge.org/docs/configuration#report-sections): add or remove sections per template
+- [Data protection](https://reportforge.org/docs/advanced/security): password-encrypt PDFs and redact credentials/PII from report content
 - [License & offline behaviour](https://reportforge.org/docs/licensing): license cache, machine cap, cancellation
 - [Troubleshooting](https://reportforge.org/docs/troubleshooting): common issues and debug flags
 - [Changelog](https://reportforge.org/changelog): version history and release notes

package/SECURITY.md

@@ -43,6 +43,17 @@ Out of scope:
 - Vulnerabilities exclusively in third-party services we integrate (for
   example our payment provider, Razorpay) — report those upstream.
 
+## Report data protection
+
+A generated PDF can contain whatever your tests captured: error text, console
+output, screenshots. Two opt-in reporter options limit what a report exposes
+if it ends up somewhere it shouldn't. `pdfPassword` encrypts the PDF, and the
+failure-overflow sidecar when one is written, with AES-256, applied
+in-process with no external tools required. `redact` masks likely credentials
+and PII (tokens, API keys, emails, and more) out of report content and the
+live watch stream before they're written or streamed. Neither is on by
+default. Details: [reportforge.org/docs/advanced/security](https://reportforge.org/docs/advanced/security).
+
 ## Supported versions
 
 Only the latest published version of `@reportforge/playwright-pdf` receives