@reproapp/node-sdk 0.0.46 → 0.0.47

package/test/policy-capture-attestation.test.js

@@ -0,0 +1,234 @@
+process.env.REPRO_SDK_BACKGROUND_IDLE_DELAY_MS = '0';
+process.env.REPRO_SDK_BACKGROUND_BUSY_IDLE_DELAY_MS = '0';
+process.env.REPRO_SDK_BACKGROUND_MAX_DEFER_MS = '0';
+process.env.TRACE_IDLE_FLUSH_MS = '10';
+process.env.TRACE_LINGER_AFTER_FINISH_MS = '0';
+
+const assert = require('node:assert/strict');
+const http = require('node:http');
+const express = require('express');
+
+const {
+    __reproTestHooks,
+    initReproTracing,
+    reproMiddleware,
+} = require('../dist');
+const {
+    normalizeRuntimePrivacyPolicy,
+} = require('../dist/privacy');
+const { flushIngestQueue } = require('../dist/ingest/client');
+
+function flattenEvents(posts) {
+    return posts.flatMap((body) => Array.isArray(body?.events) ? body.events : []);
+}
+
+async function waitForCapturedEvent(capturedBodies, sessionId, eventType, timeoutMs = 2000) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        const found = flattenEvents(capturedBodies).some(
+            (event) => event.session_id === sessionId && event.event_type === eventType,
+        );
+        if (found) return;
+        await new Promise((resolve) => setTimeout(resolve, 10));
+    }
+    assert.fail(`timed out waiting for ${eventType} in ${sessionId}`);
+}
+
+function requestJson(port, path) {
+    return new Promise((resolve, reject) => {
+        const request = http.get({
+            host: '127.0.0.1',
+            port,
+            path,
+            headers: {
+                'x-bug-session-id': `S_attestation_${path.slice(1)}`,
+                'x-bug-action-id': `A_attestation_${path.slice(1)}`,
+                'x-bug-request-start': String(Date.now()),
+            },
+        }, (response) => {
+            const chunks = [];
+            response.on('data', (chunk) => chunks.push(chunk));
+            response.on('end', () => {
+                try {
+                    resolve({
+                        status: response.statusCode,
+                        body: JSON.parse(Buffer.concat(chunks).toString('utf8')),
+                    });
+                } catch (error) {
+                    reject(error);
+                }
+            });
+        });
+        request.on('error', reject);
+    });
+}
+
+async function drainCapture() {
+    await __reproTestHooks.drainSdkBackgroundQueueForTest();
+    await flushIngestQueue();
+}
+
+function policyWithProtectedSecret() {
+    return normalizeRuntimePrivacyPolicy({
+        environment: 'dev',
+        statements: [{
+            sid: 'drop-internal-secret',
+            when: {
+                scope: 'FIELD',
+                selector: 'field:internalSecret',
+                target: 'response.body.internalSecret|trace.args.internalSecret',
+            },
+            apply: { action: 'DROP' },
+            meta: { priority: 1 },
+        }],
+    });
+}
+
+async function main() {
+    const capturedBodies = [];
+    const originalFetch = global.fetch;
+    global.fetch = async (_url, init = {}) => {
+        capturedBodies.push(JSON.parse(String(init.body || '{}')));
+        return {
+            ok: true,
+            status: 202,
+            json: async () => ({ accepted: 1 }),
+            text: async () => '{"accepted":1}',
+        };
+    };
+
+    let server;
+    try {
+        initReproTracing({ instrument: false, logFunctionCalls: false });
+
+        const failingCfg = {
+            tenantId: 'TENANT_test',
+            appId: 'APP_policy_failure',
+            appSecret: 'secret',
+            serviceName: 'policy-attestation',
+            privacy: { environment: 'dev' },
+            ingestBase: 'http://127.0.0.1:65535',
+        };
+        const failingPolicy = policyWithProtectedSecret();
+        assert(failingPolicy);
+        // Fault injection after normalization exercises the real SDK failure path
+        // without adding a production-only bypass to the policy engine.
+        failingPolicy.statements[0].selectorLeaves = null;
+        __reproTestHooks.setRuntimePrivacyPolicyForTest(failingCfg, failingPolicy);
+
+        const rawCfg = {
+            ...failingCfg,
+            appId: 'APP_policy_raw',
+            privacy: {
+                environment: 'dev',
+                captureRaw: true,
+            },
+        };
+        __reproTestHooks.setRuntimePrivacyPolicyForTest(rawCfg, failingPolicy);
+
+        const app = express();
+        app.use('/failed', reproMiddleware(failingCfg));
+        app.get('/failed', (_request, response) => {
+            const value = global.__repro_call(
+                (input) => input,
+                null,
+                [{ internalSecret: 'super-secret-policy-value' }],
+                __filename,
+                1,
+                'PolicyService.capture',
+                true,
+            );
+            response.json({
+                ok: true,
+                internalSecret: value.internalSecret,
+            });
+        });
+        app.use('/raw', reproMiddleware(rawCfg));
+        app.get('/raw', (_request, response) => {
+            response.json({
+                ok: true,
+                internalSecret: 'raw-mode-secret',
+            });
+        });
+
+        server = await new Promise((resolve) => {
+            const listening = app.listen(0, '127.0.0.1', () => resolve(listening));
+        });
+        const port = server.address().port;
+
+        const failedResponse = await requestJson(port, '/failed');
+        assert.equal(failedResponse.status, 200);
+        assert.equal(failedResponse.body.internalSecret, 'super-secret-policy-value');
+        await waitForCapturedEvent(
+            capturedBodies,
+            'S_attestation_failed',
+            'request_capture_manifest',
+        );
+        await drainCapture();
+
+        const failedEvents = flattenEvents(capturedBodies)
+            .filter((event) => event.session_id === 'S_attestation_failed');
+        const failedRequest = failedEvents.find((event) => event.event_type === 'backend_request');
+        const failedManifest = failedEvents.find((event) => event.event_type === 'request_capture_manifest');
+        const failedTrace = failedEvents.find((event) => event.event_type === 'trace_batch');
+        assert(failedRequest, 'policy failure must retain backend request metadata');
+        assert(failedManifest, 'policy failure must emit a terminal request manifest');
+        assert(failedTrace, 'policy failure must retain a metadata-only trace');
+        assert.equal(
+            failedManifest.payload.requestCaptureManifest.expected.backendRequest,
+            1,
+            'observed request count must not become zero after policy failure',
+        );
+        assert.equal(failedManifest.payload.requestCaptureManifest.privacy.mode, 'policy');
+        assert.equal(failedManifest.payload.requestCaptureManifest.privacy.status, 'failed');
+        assert.match(
+            failedManifest.payload.requestCaptureManifest.privacy.policyFingerprint,
+            /^[a-f0-9]{64}$/,
+        );
+        assert(
+            failedManifest.payload.requestCaptureManifest.captureFailures.length > 0,
+            'policy failure must be declared for hydration',
+        );
+        assert.equal(
+            JSON.stringify(failedEvents).includes('super-secret-policy-value'),
+            false,
+            'failed policy materialization must fail closed without raw-value leakage',
+        );
+
+        capturedBodies.length = 0;
+        const rawResponse = await requestJson(port, '/raw');
+        assert.equal(rawResponse.status, 200);
+        await waitForCapturedEvent(
+            capturedBodies,
+            'S_attestation_raw',
+            'request_capture_manifest',
+        );
+        await drainCapture();
+
+        const rawEvents = flattenEvents(capturedBodies)
+            .filter((event) => event.session_id === 'S_attestation_raw');
+        const rawManifest = rawEvents.find((event) => event.event_type === 'request_capture_manifest');
+        assert(rawManifest);
+        assert.equal(rawManifest.payload.requestCaptureManifest.privacy.mode, 'raw');
+        assert.equal(rawManifest.payload.requestCaptureManifest.privacy.status, 'bypassed');
+        assert.equal(rawManifest.payload.requestCaptureManifest.captureFailures, undefined);
+        assert(
+            JSON.stringify(rawEvents).includes('raw-mode-secret'),
+            'captureRaw must continue to retain raw values explicitly',
+        );
+
+        console.log('policy capture attestation OK');
+    } finally {
+        await __reproTestHooks.drainSdkBackgroundQueueForTest().catch(() => {});
+        await flushIngestQueue().catch(() => {});
+        global.fetch = originalFetch;
+        if (server) {
+            await new Promise((resolve) => server.close(resolve));
+        }
+    }
+}
+
+main().catch((error) => {
+    console.error(error);
+    process.exit(1);
+});

package/test/policy-session-completion.testcontainers.test.js

@@ -0,0 +1,271 @@
+process.env.REPRO_SDK_BACKGROUND_IDLE_DELAY_MS = '0';
+process.env.REPRO_SDK_BACKGROUND_BUSY_IDLE_DELAY_MS = '0';
+process.env.REPRO_SDK_BACKGROUND_MAX_DEFER_MS = '0';
+process.env.TRACE_IDLE_FLUSH_MS = '10';
+process.env.TRACE_LINGER_AFTER_FINISH_MS = '0';
+
+const assert = require('node:assert/strict');
+const http = require('node:http');
+const express = require('express');
+const mongoose = require('mongoose');
+const { GenericContainer, Wait } = require('testcontainers');
+
+const {
+    __reproTestHooks,
+    initReproTracing,
+    reproMiddleware,
+    reproMongoosePlugin,
+} = require('../dist');
+const { flushIngestQueue } = require('../dist/ingest/client');
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+function flattenEvents(posts) {
+    return posts.flatMap((body) => Array.isArray(body?.events) ? body.events : []);
+}
+
+function eventsOf(posts, eventType) {
+    return flattenEvents(posts).filter((event) => event?.event_type === eventType);
+}
+
+function largePolicy() {
+    return {
+        environment: 'dev',
+        statements: [
+            ...Array.from({ length: 5000 }, (_, index) => ({
+                sid: `function-${index}`,
+                when: {
+                    scope: 'FUNCTION',
+                    selector: `GeneratedService${index}.method${index}`,
+                    target: 'trace.args|trace.returnValue',
+                },
+                apply: { action: 'KEEP_EXACT' },
+                meta: { priority: index + 10 },
+            })),
+            {
+                sid: 'drop-internal-secret',
+                when: {
+                    scope: 'FIELD',
+                    selector: 'field:internalSecret',
+                    target: 'response.body.data[].internalSecret|db.resultMeta[].internalSecret',
+                },
+                apply: { action: 'DROP' },
+                meta: { priority: 1 },
+            },
+        ],
+    };
+}
+
+async function startMongo() {
+    const container = await new GenericContainer('mongo:7')
+        .withExposedPorts(27017)
+        .withTmpFs({ '/data/db': 'rw,noexec,nosuid,size=1g' })
+        .withCommand(['mongod', '--bind_ip_all', '--setParameter', 'diagnosticDataCollectionEnabled=false'])
+        .withWaitStrategy(Wait.forListeningPorts())
+        .start();
+    return {
+        container,
+        uri: `mongodb://${container.getHost()}:${container.getMappedPort(27017)}/repro_policy_completion`,
+    };
+}
+
+function requestNames(port, index) {
+    return new Promise((resolve, reject) => {
+        const request = http.get({
+            host: '127.0.0.1',
+            port,
+            path: '/names',
+            headers: {
+                'x-bug-session-id': 'S_policy_completion',
+                'x-bug-action-id': `A_policy_completion_${index}`,
+                'x-bug-request-start': String(Date.now()),
+            },
+        }, (response) => {
+            const chunks = [];
+            response.on('data', (chunk) => chunks.push(chunk));
+            response.on('end', () => {
+                try {
+                    assert.equal(response.statusCode, 200);
+                    const parsed = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+                    assert.equal(parsed.data.length, 8);
+                    resolve();
+                } catch (error) {
+                    reject(error);
+                }
+            });
+        });
+        request.on('error', reject);
+    });
+}
+
+async function waitForCompleteCapture(capturedBodies, expectedRequests, timeoutMs = 30000) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        await __reproTestHooks.drainSdkBackgroundQueueForTest();
+        await flushIngestQueue();
+        const backendRequests = eventsOf(capturedBodies, 'backend_request');
+        const manifests = eventsOf(capturedBodies, 'request_capture_manifest');
+        const traceBatches = eventsOf(capturedBodies, 'trace_batch');
+        if (
+            backendRequests.length === expectedRequests &&
+            manifests.length === expectedRequests &&
+            traceBatches.length >= expectedRequests
+        ) {
+            return;
+        }
+        await sleep(25);
+    }
+    assert.fail(JSON.stringify({
+        backendRequests: eventsOf(capturedBodies, 'backend_request').length,
+        manifests: eventsOf(capturedBodies, 'request_capture_manifest').length,
+        traceBatches: eventsOf(capturedBodies, 'trace_batch').length,
+        dbChanges: eventsOf(capturedBodies, 'db_change').length,
+    }));
+}
+
+async function main() {
+    const capturedBodies = [];
+    const originalFetch = global.fetch;
+    global.fetch = async (_url, init = {}) => {
+        capturedBodies.push(JSON.parse(String(init.body || '{}')));
+        return {
+            ok: true,
+            status: 202,
+            json: async () => ({ accepted: 1 }),
+            text: async () => '{"accepted":1}',
+        };
+    };
+
+    let mongo;
+    let connection;
+    let server;
+    try {
+        mongo = await startMongo();
+        connection = await mongoose.createConnection(mongo.uri).asPromise();
+        initReproTracing({ instrument: false, logFunctionCalls: false });
+
+        const cfg = {
+            tenantId: 'TENANT_test',
+            appId: 'APP_test',
+            appSecret: 'secret',
+            serviceName: 'policy-session-completion',
+            captureHeaders: false,
+            privacy: {
+                environment: 'dev',
+                policy: largePolicy(),
+            },
+            ingestBase: 'http://127.0.0.1:65535',
+        };
+
+        const depotSchema = new mongoose.Schema({
+            location: String,
+            description: String,
+            internalSecret: String,
+        });
+        reproMongoosePlugin(cfg)(depotSchema);
+        const Depot = connection.model('Depot', depotSchema, 'depots');
+        await Depot.insertMany(Array.from({ length: 8 }, (_, index) => ({
+            location: `Depot ${index}`,
+            description: `Large depot description ${index} `.repeat(500),
+            internalSecret: `secret-${index}`,
+        })));
+
+        async function loadNames() {
+            return Depot.find({}).lean();
+        }
+
+        const app = express();
+        app.use(reproMiddleware(cfg));
+        app.get('/names', async (_request, response, next) => {
+            try {
+                const data = await global.__repro_call(
+                    loadNames,
+                    null,
+                    [],
+                    __filename,
+                    1,
+                    'loadNames',
+                    true,
+                );
+                response.json({ data, message: 'depot names', statusCode: 200 });
+            } catch (error) {
+                next(error);
+            }
+        });
+
+        server = await new Promise((resolve) => {
+            const listening = app.listen(0, '127.0.0.1', () => resolve(listening));
+        });
+        const port = server.address().port;
+
+        const startedAt = Date.now();
+        await Promise.all(Array.from({ length: 14 }, (_, index) => requestNames(port, index)));
+        await waitForCompleteCapture(capturedBodies, 14);
+        const elapsedMs = Date.now() - startedAt;
+
+        const backendRequests = eventsOf(capturedBodies, 'backend_request');
+        const manifests = eventsOf(capturedBodies, 'request_capture_manifest');
+        const dbChanges = eventsOf(capturedBodies, 'db_change');
+        assert.equal(backendRequests.length, 14);
+        assert.equal(manifests.length, 14);
+        assert(dbChanges.length >= 14, `expected Mongo evidence for every request, got ${dbChanges.length}`);
+        assert(
+            manifests.every((event) => event.payload?.requestCaptureManifest?.expected?.backendRequest === 1),
+            'every request manifest must account for its backend request',
+        );
+        assert(
+            manifests.every((event) => event.payload?.requestCaptureManifest?.expected?.traceBatch >= 1),
+            'every request manifest must account for its trace batches',
+        );
+        assert(
+            manifests.every((event) => event.payload?.requestCaptureManifest?.expected?.dbChange >= 1),
+            'every request manifest must declare each observed Mongo operation before materialization',
+        );
+        assert(
+            manifests.every((event) => event.payload?.requestCaptureManifest?.privacy?.status === 'applied'),
+            'every request manifest must attest successful policy application',
+        );
+        assert(
+            manifests.every((event) =>
+                /^[a-f0-9]{64}$/.test(
+                    event.payload?.requestCaptureManifest?.privacy?.policyFingerprint ?? '',
+                ),
+            ),
+            'every policy attestation must identify the exact normalized policy',
+        );
+        assert(
+            manifests.every((event) => !event.payload?.requestCaptureManifest?.captureFailures),
+            'successful policy materialization must not report capture failures',
+        );
+
+        const responseValues = backendRequests.flatMap((event) => event.payload?.requestValues || [])
+            .filter((entry) => entry.target === 'response.body');
+        assert.equal(responseValues.length, 14);
+        assert.equal(responseValues[0].value.data.length, 8);
+        assert.equal(responseValues[0].value.data[0].internalSecret, '[dropped]');
+        assert(
+            elapsedMs < 30000,
+            `large-policy session completion exceeded 30 seconds: ${elapsedMs}ms`,
+        );
+
+        console.log(`policy session completion testcontainers OK (${elapsedMs}ms)`);
+    } finally {
+        await __reproTestHooks.drainSdkBackgroundQueueForTest().catch(() => {});
+        await flushIngestQueue().catch(() => {});
+        global.fetch = originalFetch;
+        if (server) {
+            await new Promise((resolve) => server.close(resolve));
+        }
+        if (connection) {
+            await connection.close().catch(() => {});
+        }
+        if (mongo?.container) {
+            await mongo.container.stop().catch(() => {});
+        }
+    }
+}
+
+main().catch((error) => {
+    console.error(error);
+    process.exit(1);
+});

package/test/privacy-policy-index.test.js

@@ -0,0 +1,194 @@
+const assert = require('node:assert/strict');
+const {
+    applyRuntimePrivacyPolicyAsync,
+    normalizeRuntimePrivacyPolicy,
+} = require('../dist/privacy');
+
+function functionStatement(index) {
+    return {
+        sid: `function-${index}`,
+        when: {
+            scope: 'FUNCTION',
+            selector: `Service${index}.method${index}`,
+            target: 'trace.args.payload',
+        },
+        apply: { action: 'KEEP_EXACT' },
+        meta: { priority: index + 10 },
+    };
+}
+
+async function main() {
+    const uniqueFunctionStatements = Array.from(
+        { length: 3000 },
+        (_, index) => functionStatement(index),
+    );
+    const duplicateFunctionStatements = Array.from(
+        { length: 2000 },
+        (_, index) => ({
+            ...functionStatement(index % 100),
+            sid: `duplicate-${index}`,
+            meta: { priority: 10_000 + index },
+        }),
+    );
+    const matchingFunctionStatement = {
+        sid: 'matching-function',
+        when: {
+            scope: 'FUNCTION',
+            selector: 'CapturedService.loadNames',
+            target: 'trace.args.payload.privateNote',
+        },
+        apply: { action: 'DROP' },
+        meta: { priority: 1 },
+    };
+    const responseFieldStatement = {
+        sid: 'drop-private-note',
+        when: {
+            scope: 'FIELD',
+            selector: 'field:privateNote',
+            target: 'response.body.data[].privateNote',
+        },
+        apply: { action: 'DROP' },
+        meta: { priority: 2 },
+    };
+    const exactTargetFieldStatement = {
+        sid: 'drop-targeted-secret',
+        when: {
+            scope: 'FIELD',
+            selector: 'field:generatedAlias',
+            target: 'response.body.data[].targetedSecret',
+        },
+        apply: { action: 'DROP' },
+        meta: { priority: 3 },
+    };
+    const positionalTargetFieldStatement = {
+        sid: 'tokenize-positional-owner',
+        when: {
+            scope: 'FIELD',
+            selector: 'field:incidentOwnerName',
+            target: 'trace.args[4]',
+        },
+        apply: { action: 'TOKENIZE' },
+        meta: { priority: 3 },
+    };
+    const globalPatternStatement = {
+        sid: 'drop-secret-text',
+        when: {
+            scope: 'PATTERN',
+            selector: 'secret-text',
+            pattern: 'secret-value',
+            target: 'response.body.data[].notes',
+        },
+        apply: { action: 'DROP' },
+        meta: { priority: 4 },
+    };
+
+    const policy = normalizeRuntimePrivacyPolicy({
+        environment: 'dev',
+        statements: [
+            ...uniqueFunctionStatements,
+            ...duplicateFunctionStatements,
+            matchingFunctionStatement,
+            responseFieldStatement,
+            exactTargetFieldStatement,
+            positionalTargetFieldStatement,
+            globalPatternStatement,
+        ],
+    });
+
+    assert(policy);
+    assert.equal(
+        policy.statements.length,
+        uniqueFunctionStatements.length + 5,
+        'semantically duplicate generated statements must be removed',
+    );
+    assert.match(policy.fingerprint, /^[a-f0-9]{64}$/);
+    const normalizedPatternStatement = policy.statements.find(
+        (statement) => statement.sid === globalPatternStatement.sid,
+    );
+    assert(normalizedPatternStatement);
+    normalizedPatternStatement.pattern = /secret-value/gi;
+
+    const response = {
+        data: Array.from({ length: 1000 }, (_, index) => ({
+            id: `depot-${index}`,
+            location: `Location ${index}`,
+            country: `Country ${index % 20}`,
+            status: 'active',
+            privateNote: `private-${index}`,
+            targetedSecret: `targeted-${index}`,
+            notes: `secret-value-${index}`,
+        })),
+        message: 'depot names',
+        statusCode: 200,
+    };
+
+    const startedAt = Date.now();
+    const transformedResponse = await applyRuntimePrivacyPolicyAsync(
+        policy,
+        'response.body',
+        response,
+        {
+            appId: 'APP_test',
+            appSecret: 'secret',
+            routeKey: 'GET /api/v1/depots/:id/names',
+        },
+    );
+    const elapsedMs = Date.now() - startedAt;
+
+    assert.equal(transformedResponse.data.length, 1000);
+    assert.equal(transformedResponse.data[0].id, 'depot-0');
+    assert.equal(transformedResponse.data[999].privateNote, '[dropped]');
+    assert.equal(transformedResponse.data[0].targetedSecret, '[dropped]');
+    assert.equal(transformedResponse.data[999].targetedSecret, '[dropped]');
+    assert(
+        transformedResponse.data.every((entry) => entry.notes === '[dropped]'),
+        'global/sticky regex state must not make identical pattern matches alternate',
+    );
+    assert(
+        elapsedMs < 1500,
+        `large response policy evaluation took ${elapsedMs}ms; function rules were likely scanned per node`,
+    );
+
+    const transformedTrace = await applyRuntimePrivacyPolicyAsync(
+        policy,
+        'trace.args',
+        {
+            payload: {
+                safeValue: 'visible',
+                privateNote: 'must-not-be-visible',
+            },
+        },
+        {
+            appId: 'APP_test',
+            appSecret: 'secret',
+            trace: {
+                fn: 'CapturedService.loadNames',
+                file: '/app/src/captured.service.ts',
+            },
+        },
+    );
+    assert.equal(transformedTrace.payload.safeValue, 'visible');
+    assert.equal(transformedTrace.payload.privateNote, '[dropped]');
+
+    const transformedPositionalTrace = await applyRuntimePrivacyPolicyAsync(
+        policy,
+        'trace.args',
+        ['safe', 'safe', 'safe', 'safe', 'Jane Security'],
+        {
+            appId: 'APP_test',
+            appSecret: 'secret',
+            trace: {
+                fn: 'CapturedService.loadNames',
+                file: '/app/src/captured.service.ts',
+            },
+        },
+    );
+    assert.match(transformedPositionalTrace[4], /^4_tok_[a-f0-9]{12}$/);
+
+    console.log(`privacy policy index OK (${elapsedMs}ms)`);
+}
+
+main().catch((error) => {
+    console.error(error);
+    process.exit(1);
+});