@reproapp/node-sdk 0.0.46 → 0.0.48

package/test/privacy-policy-index.test.js

@@ -0,0 +1,194 @@
+const assert = require('node:assert/strict');
+const {
+    applyRuntimePrivacyPolicyAsync,
+    normalizeRuntimePrivacyPolicy,
+} = require('../dist/privacy');
+
+function functionStatement(index) {
+    return {
+        sid: `function-${index}`,
+        when: {
+            scope: 'FUNCTION',
+            selector: `Service${index}.method${index}`,
+            target: 'trace.args.payload',
+        },
+        apply: { action: 'KEEP_EXACT' },
+        meta: { priority: index + 10 },
+    };
+}
+
+async function main() {
+    const uniqueFunctionStatements = Array.from(
+        { length: 3000 },
+        (_, index) => functionStatement(index),
+    );
+    const duplicateFunctionStatements = Array.from(
+        { length: 2000 },
+        (_, index) => ({
+            ...functionStatement(index % 100),
+            sid: `duplicate-${index}`,
+            meta: { priority: 10_000 + index },
+        }),
+    );
+    const matchingFunctionStatement = {
+        sid: 'matching-function',
+        when: {
+            scope: 'FUNCTION',
+            selector: 'CapturedService.loadNames',
+            target: 'trace.args.payload.privateNote',
+        },
+        apply: { action: 'DROP' },
+        meta: { priority: 1 },
+    };
+    const responseFieldStatement = {
+        sid: 'drop-private-note',
+        when: {
+            scope: 'FIELD',
+            selector: 'field:privateNote',
+            target: 'response.body.data[].privateNote',
+        },
+        apply: { action: 'DROP' },
+        meta: { priority: 2 },
+    };
+    const exactTargetFieldStatement = {
+        sid: 'drop-targeted-secret',
+        when: {
+            scope: 'FIELD',
+            selector: 'field:generatedAlias',
+            target: 'response.body.data[].targetedSecret',
+        },
+        apply: { action: 'DROP' },
+        meta: { priority: 3 },
+    };
+    const positionalTargetFieldStatement = {
+        sid: 'tokenize-positional-owner',
+        when: {
+            scope: 'FIELD',
+            selector: 'field:incidentOwnerName',
+            target: 'trace.args[4]',
+        },
+        apply: { action: 'TOKENIZE' },
+        meta: { priority: 3 },
+    };
+    const globalPatternStatement = {
+        sid: 'drop-secret-text',
+        when: {
+            scope: 'PATTERN',
+            selector: 'secret-text',
+            pattern: 'secret-value',
+            target: 'response.body.data[].notes',
+        },
+        apply: { action: 'DROP' },
+        meta: { priority: 4 },
+    };
+
+    const policy = normalizeRuntimePrivacyPolicy({
+        environment: 'dev',
+        statements: [
+            ...uniqueFunctionStatements,
+            ...duplicateFunctionStatements,
+            matchingFunctionStatement,
+            responseFieldStatement,
+            exactTargetFieldStatement,
+            positionalTargetFieldStatement,
+            globalPatternStatement,
+        ],
+    });
+
+    assert(policy);
+    assert.equal(
+        policy.statements.length,
+        uniqueFunctionStatements.length + 5,
+        'semantically duplicate generated statements must be removed',
+    );
+    assert.match(policy.fingerprint, /^[a-f0-9]{64}$/);
+    const normalizedPatternStatement = policy.statements.find(
+        (statement) => statement.sid === globalPatternStatement.sid,
+    );
+    assert(normalizedPatternStatement);
+    normalizedPatternStatement.pattern = /secret-value/gi;
+
+    const response = {
+        data: Array.from({ length: 1000 }, (_, index) => ({
+            id: `depot-${index}`,
+            location: `Location ${index}`,
+            country: `Country ${index % 20}`,
+            status: 'active',
+            privateNote: `private-${index}`,
+            targetedSecret: `targeted-${index}`,
+            notes: `secret-value-${index}`,
+        })),
+        message: 'depot names',
+        statusCode: 200,
+    };
+
+    const startedAt = Date.now();
+    const transformedResponse = await applyRuntimePrivacyPolicyAsync(
+        policy,
+        'response.body',
+        response,
+        {
+            appId: 'APP_test',
+            appSecret: 'secret',
+            routeKey: 'GET /api/v1/depots/:id/names',
+        },
+    );
+    const elapsedMs = Date.now() - startedAt;
+
+    assert.equal(transformedResponse.data.length, 1000);
+    assert.equal(transformedResponse.data[0].id, 'depot-0');
+    assert.equal(transformedResponse.data[999].privateNote, '[dropped]');
+    assert.equal(transformedResponse.data[0].targetedSecret, '[dropped]');
+    assert.equal(transformedResponse.data[999].targetedSecret, '[dropped]');
+    assert(
+        transformedResponse.data.every((entry) => entry.notes === '[dropped]'),
+        'global/sticky regex state must not make identical pattern matches alternate',
+    );
+    assert(
+        elapsedMs < 1500,
+        `large response policy evaluation took ${elapsedMs}ms; function rules were likely scanned per node`,
+    );
+
+    const transformedTrace = await applyRuntimePrivacyPolicyAsync(
+        policy,
+        'trace.args',
+        {
+            payload: {
+                safeValue: 'visible',
+                privateNote: 'must-not-be-visible',
+            },
+        },
+        {
+            appId: 'APP_test',
+            appSecret: 'secret',
+            trace: {
+                fn: 'CapturedService.loadNames',
+                file: '/app/src/captured.service.ts',
+            },
+        },
+    );
+    assert.equal(transformedTrace.payload.safeValue, 'visible');
+    assert.equal(transformedTrace.payload.privateNote, '[dropped]');
+
+    const transformedPositionalTrace = await applyRuntimePrivacyPolicyAsync(
+        policy,
+        'trace.args',
+        ['safe', 'safe', 'safe', 'safe', 'Jane Security'],
+        {
+            appId: 'APP_test',
+            appSecret: 'secret',
+            trace: {
+                fn: 'CapturedService.loadNames',
+                file: '/app/src/captured.service.ts',
+            },
+        },
+    );
+    assert.match(transformedPositionalTrace[4], /^4_tok_[a-f0-9]{12}$/);
+
+    console.log(`privacy policy index OK (${elapsedMs}ms)`);
+}
+
+main().catch((error) => {
+    console.error(error);
+    process.exit(1);
+});

package/test/sdk-background-timeout-isolation.test.js

@@ -0,0 +1,39 @@
+process.env.REPRO_SDK_BACKGROUND_WORK_TIMEOUT_MS = '20';
+process.env.REPRO_SDK_BACKGROUND_IDLE_DELAY_MS = '0';
+process.env.REPRO_SDK_BACKGROUND_BUSY_IDLE_DELAY_MS = '0';
+
+const assert = require('node:assert/strict');
+const { __reproTestHooks } = require('../dist');
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+async function main() {
+    const hooks = __reproTestHooks;
+    hooks.resetSdkBackgroundQueuesForTest();
+    const order = [];
+
+    hooks.scheduleSdkBackgroundWorkForTest(async () => {
+        order.push('first-start');
+        await sleep(80);
+        order.push('first-end');
+    }, { priority: 'high' });
+    hooks.scheduleSdkBackgroundWorkForTest(() => {
+        order.push('second');
+    }, { priority: 'high' });
+
+    await hooks.drainSdkBackgroundQueueForTest();
+
+    assert.deepEqual(
+        order,
+        ['first-start', 'first-end', 'second'],
+        'a slow background capture must finish before the queue advances',
+    );
+
+    hooks.resetSdkBackgroundQueuesForTest();
+    console.log('sdk background timeout isolation OK');
+}
+
+main().catch((error) => {
+    console.error(error);
+    process.exit(1);
+});

package/test/semantic-serialization-trace.test.js

@@ -0,0 +1,152 @@
+const assert = require('node:assert/strict');
+const http = require('node:http');
+
+process.env.REPRO_SDK_BACKGROUND_IDLE_DELAY_MS = '25';
+process.env.REPRO_SDK_TRACE_INLINE_VALUE_MAX_SERIALIZED_CHARS = '2048';
+process.env.TRACE_IDLE_FLUSH_MS = '10';
+process.env.TRACE_LINGER_AFTER_FINISH_MS = '0';
+
+const originalFetch = global.fetch;
+const capturedBodies = [];
+
+global.fetch = async (url, init = {}) => {
+    assert.match(String(url), /\/v1\/ingest\/events$/);
+    capturedBodies.push(JSON.parse(String(init.body || '{}')));
+    return {
+        ok: true,
+        status: 202,
+        json: async () => ({ ok: true }),
+        text: async () => '{"ok":true}',
+    };
+};
+
+const { initRepro } = require('../dist');
+const { flushIngestQueue } = require('../dist/ingest/client');
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+async function waitFor(predicate, timeoutMs = 4000) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        if (predicate()) return;
+        await sleep(20);
+    }
+    assert(predicate(), 'timed out waiting for semantic trace capture');
+}
+
+function eventsOf(type) {
+    return capturedBodies
+        .flatMap((body) => Array.isArray(body?.events) ? body.events : [])
+        .filter((event) => event?.event_type === type);
+}
+
+function get(url) {
+    return new Promise((resolve, reject) => {
+        const request = http.get(url, (response) => {
+            let body = '';
+            response.setEncoding('utf8');
+            response.on('data', (chunk) => { body += chunk; });
+            response.on('end', () => resolve({ statusCode: response.statusCode, body }));
+        });
+        request.on('error', reject);
+    });
+}
+
+async function main() {
+    const config = {
+        tenantId: 'TENANT_semantic_trace',
+        appId: 'APP_semantic_trace',
+        appSecret: 'secret',
+        appName: 'semantic-trace',
+        serviceName: 'semantic-trace',
+        ingestBase: 'http://127.0.0.1:65535',
+        tracing: {
+            disableFunctionTypes: ['constructor'],
+            fullValueCapture: true,
+            logFunctionCalls: false,
+        },
+    };
+
+    await initRepro(config);
+    const { startServer } = require('./fixtures/semantic-serialization-trace-server');
+    const server = await startServer(config);
+
+    try {
+        const port = server.address().port;
+        const response = await get(
+            `http://127.0.0.1:${port}/semantic-trace` +
+            `?__repro_sid=S_semantic_trace&__repro_aid=A_semantic_trace&__repro_start=${Date.now()}`,
+        );
+        assert.equal(response.statusCode, 200);
+        assert.deepEqual(JSON.parse(response.body), {
+            accepted: true,
+            originalGeneratorObserved: true,
+            originalShipmentObserved: true,
+            runtimeConfigStillReadable: true,
+            shipmentNumber: 'SHIP-TRACE-1001',
+            lastKit: 'KIT-0159',
+        });
+
+        await waitFor(() => eventsOf('backend_request').length === 1);
+        await waitFor(() => eventsOf('trace_batch').some((event) =>
+            event.payload?.trace?.some((traceEvent) => traceEvent?.fn === 'recordShipment')
+        ));
+        await flushIngestQueue();
+
+        const traceBatches = eventsOf('trace_batch');
+        const traceEvents = traceBatches.flatMap((event) => event.payload?.trace || []);
+        const enter = traceEvents.find((event) => event?.type === 'enter' && event?.fn === 'recordShipment');
+        assert(enter, JSON.stringify(traceEvents));
+
+        const traceValues = traceBatches.flatMap((event) => event.payload?.traceValues || []);
+        const argsValue = traceValues.find((entry) =>
+            entry?.id === enter.argsValueCapture?.valueId && entry?.target === 'trace.args'
+        );
+        const capturedArgs = argsValue?.value || enter.args;
+        assert(Array.isArray(capturedArgs), JSON.stringify({ enter, traceValues }));
+
+        assert.equal(capturedArgs[0].__class, 'ShipmentGenerator');
+        assert.equal(capturedArgs[0].triggerAction, 'ShipmentCreated');
+        assert.deepEqual(capturedArgs[0].logger, {
+            __kind: 'repro-semantic',
+            category: 'logger',
+            className: 'Logger',
+            context: 'ShipmentGenerator',
+        });
+        assert.deepEqual(capturedArgs[0].apiConfigService.configService, {
+            __kind: 'repro-semantic',
+            category: 'configuration-service',
+            className: 'ConfigService',
+        });
+
+        assert.equal(capturedArgs[1].shipmentNumber, 'SHIP-TRACE-1001');
+        assert.equal(capturedArgs[1].site.address.country.regulatory.region, 'FDA');
+        assert.equal(capturedArgs[1].kits.length, 160);
+        assert.equal(capturedArgs[1].kits[159].kitNumber, 'KIT-0159');
+
+        const allCapturedJson = JSON.stringify(capturedBodies);
+        assert(!allCapturedJson.includes('sendgrid-runtime-secret'));
+        assert(!allCapturedJson.includes('runtime-password'));
+        assert(!allCapturedJson.includes('config-secret-799'));
+        assert(!allCapturedJson.includes('logger-runtime-state'));
+
+        const argsBytes = Buffer.byteLength(JSON.stringify(capturedArgs));
+        assert(argsBytes < 30000, `semantic trace args unexpectedly large: ${argsBytes} bytes`);
+
+        console.log('semantic serialization real trace pipeline OK');
+    } finally {
+        await new Promise((resolve, reject) => {
+            server.close((error) => error ? reject(error) : resolve());
+        });
+    }
+}
+
+main()
+    .catch((error) => {
+        console.error(error);
+        process.exitCode = 1;
+    })
+    .finally(async () => {
+        await flushIngestQueue().catch(() => {});
+        global.fetch = originalFetch;
+    });

package/test/semantic-serialization.test.js

@@ -0,0 +1,229 @@
+const assert = require('node:assert/strict');
+const { __reproTestHooks } = require('../dist');
+
+const {
+    projectSemanticInfrastructureValueForTest: project,
+    sanitizeTraceValueForPrivacyForTest: sanitize,
+} = __reproTestHooks;
+
+class Logger {
+    constructor(context) {
+        this.context = context;
+        this.internalBuffer = Array.from({ length: 100 }, () => 'log-internal-state');
+    }
+
+    log() {}
+}
+
+class ConfigService {
+    constructor() {
+        this.cache = {
+            SENDGRID_API_KEY: 'secret-sendgrid-value-that-must-not-be-captured',
+            DATABASE_URL: 'mongodb://user:password@database/repro',
+        };
+        this.internalConfig = {
+            infrastructure: Array.from({ length: 500 }, (_, index) => ({
+                index,
+                secret: `internal-secret-${index}`,
+                nested: { socket: { host: 'database.internal', port: 27017 } },
+            })),
+        };
+    }
+
+    get(key) {
+        return this.cache[key];
+    }
+}
+
+class ApiConfigService {
+    constructor(configService) {
+        this.configService = configService;
+    }
+
+    getDatabaseConfig() {
+        return this.configService.get('DATABASE_URL');
+    }
+}
+
+class GlobalUserRepository {
+    constructor(apiConfigService) {
+        this.apiConfigService = apiConfigService;
+    }
+}
+
+class UserService {
+    constructor(globalUserRepository) {
+        this.globalUserRepository = globalUserRepository;
+        this.logger = new Logger('UserService');
+    }
+}
+
+class StudyConfigService {
+    constructor(userService) {
+        this.userService = userService;
+    }
+}
+
+class BlindingMailerService {
+    constructor() {
+        this.logger = new Logger('BlindingMailerService');
+        this.fromEmail = 'automated@example.test';
+    }
+}
+
+class SiteStatusChangedGenerator {
+    constructor(configService) {
+        this.blindingMailerService = new BlindingMailerService();
+        this.logger = new Logger('SiteStatusChangedGenerator');
+        this.studyConfigService = new StudyConfigService(
+            new UserService(new GlobalUserRepository(new ApiConfigService(configService))),
+        );
+        this.triggerAction = 'SiteStatusChanged';
+    }
+}
+
+class ClinicalShipmentDto {
+    constructor() {
+        this.shipmentNumber = 'SHIP-10023';
+        this.site = {
+            number: 'SITE-0042',
+            address: {
+                country: {
+                    code: 'US',
+                    regulatory: { region: 'FDA', enabled: true },
+                },
+            },
+        };
+        this.kits = Array.from({ length: 40 }, (_, index) => ({
+            kitNumber: `KIT-${String(index).padStart(4, '0')}`,
+            status: index % 2 ? 'released' : 'available',
+            temperature: { minC: 2, maxC: 8 },
+        }));
+    }
+}
+
+class PricingService {
+    constructor() {
+        this.price = 125;
+        this.currency = 'USD';
+        this.breakdown = { base: 100, tax: 25 };
+    }
+}
+
+class DeliveryClient {
+    send() {}
+    connect() {}
+    disconnect() {}
+}
+
+class RuntimeConfigService {
+    constructor() {
+        Object.defineProperty(this, 'dangerousGetter', {
+            enumerable: true,
+            get() {
+                throw new Error('semantic projection invoked an application getter');
+            },
+        });
+    }
+
+    get() {
+        return 'value';
+    }
+}
+
+class RedisClient {
+    get() {}
+    set() {}
+    pipeline() {}
+}
+
+class KafkaProducer {
+    connect() {}
+    disconnect() {}
+    send() {}
+}
+
+class ChannelModel {
+    publish() {}
+    sendToQueue() {}
+    ack() {}
+}
+
+class Pool {
+    query() {}
+    connect() {}
+    end() {}
+}
+
+class DataSource {
+    createQueryRunner() {}
+}
+
+function main() {
+    const configService = new ConfigService();
+    const generator = new SiteStatusChangedGenerator(configService);
+    const businessDto = new ClinicalShipmentDto();
+
+    const rawJson = JSON.stringify([generator, businessDto]);
+    const captured = sanitize([generator, businessDto]);
+    const capturedJson = JSON.stringify(captured);
+
+    assert.equal(captured[0].__class, 'SiteStatusChangedGenerator');
+    assert.equal(captured[0].triggerAction, 'SiteStatusChanged');
+    assert.equal(captured[0].blindingMailerService.fromEmail, 'automated@example.test');
+    assert.deepEqual(captured[0].logger, {
+        __kind: 'repro-semantic',
+        category: 'logger',
+        className: 'Logger',
+        context: 'SiteStatusChangedGenerator',
+    });
+    assert.deepEqual(
+        captured[0]
+            .studyConfigService
+            .userService
+            .globalUserRepository
+            .apiConfigService
+            .configService,
+        {
+            __kind: 'repro-semantic',
+            category: 'configuration-service',
+            className: 'ConfigService',
+        },
+    );
+    assert(!capturedJson.includes('secret-sendgrid-value-that-must-not-be-captured'));
+    assert(!capturedJson.includes('internal-secret-499'));
+
+    assert.deepEqual(
+        { ...captured[1], __class: undefined },
+        { ...JSON.parse(JSON.stringify(businessDto)), __class: undefined },
+        'business DTOs must remain byte-for-byte equivalent after JSON serialization',
+    );
+
+    assert(
+        Buffer.byteLength(capturedJson) < Buffer.byteLength(rawJson) * 0.15,
+        `semantic capture did not reduce infrastructure graph enough: raw=${Buffer.byteLength(rawJson)} captured=${Buffer.byteLength(capturedJson)}`,
+    );
+
+    assert.equal(project(configService).value.category, 'configuration-service');
+    assert.equal(project(new Logger('test')).value.category, 'logger');
+    assert.equal(project(new RedisClient()).value.category, 'redis-client');
+    assert.equal(project(new KafkaProducer()).value.category, 'kafka-producer');
+    assert.equal(project(new ChannelModel()).value.category, 'amqp-channel');
+    assert.equal(project(new Pool()).value.category, 'postgres-pool');
+    assert.equal(project(new DataSource()).value.category, 'typeorm-infrastructure');
+    assert.equal(project(new DeliveryClient()), null, 'generic clients must not be mistaken for Kafka');
+
+    assert.equal(project(new PricingService()), null, 'data-only application classes must remain complete');
+    assert.deepEqual(
+        sanitize(new PricingService()),
+        { ...JSON.parse(JSON.stringify(new PricingService())), __class: 'PricingService' },
+        'data-only application classes must not be semantically projected',
+    );
+
+    assert.doesNotThrow(() => project(new RuntimeConfigService()));
+    assert.equal(project(new RuntimeConfigService()).value.category, 'configuration-service');
+
+    console.log('semantic serialization adversarial coverage OK');
+}
+
+main();