@reproapp/node-sdk 0.0.48 → 0.0.50

package/test/live-capture-limits.testcontainers.test.js

@@ -0,0 +1,78 @@
+process.env.REPRO_SDK_BACKGROUND_IDLE_DELAY_MS = '0';
+process.env.REPRO_SDK_BACKGROUND_BUSY_IDLE_DELAY_MS = '0';
+process.env.REPRO_SDK_BACKGROUND_MAX_DEFER_MS = '30';
+process.env.TRACE_IDLE_FLUSH_MS = '10';
+process.env.TRACE_LINGER_AFTER_FINISH_MS = '0';
+const assert = require('node:assert/strict');
+const http = require('node:http');
+const { GenericContainer, Wait } = require('testcontainers');
+const { initRepro } = require('../dist');
+const { flushIngestQueue } = require('../dist/ingest/client');
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
+
+async function main() {
+  const posts = [];
+  const sink = http.createServer((req, res) => {
+    const chunks = [];
+    req.on('data', chunk => chunks.push(chunk));
+    req.on('end', () => { posts.push(JSON.parse(Buffer.concat(chunks))); res.writeHead(202); res.end('{}'); });
+  });
+  await new Promise(resolve => sink.listen(0, '127.0.0.1', resolve));
+  let mongo, app;
+  try {
+    mongo = await new GenericContainer('mongo:7').withExposedPorts(27017).withWaitStrategy(Wait.forListeningPorts()).start();
+    const config = { tenantId: 'TENANT_limits', appId: 'APP_limits', appSecret: 'test',
+      privacy: { environment: 'dev', captureRaw: true }, ingestBase: `http://127.0.0.1:${sink.address().port}`,
+      tracing: { fullValueCapture: true, disableFunctionTypes: ['constructor'], logFunctionCalls: false } };
+    await initRepro(config);
+    app = await require('./fixtures/live-capture-limits-server').start(config, `mongodb://${mongo.getHost()}:${mongo.getMappedPort(27017)}/limits`);
+    for (const mode of ['live', 'staging']) {
+      const response = await fetch(`http://127.0.0.1:${app.server.address().port}/shipment?__repro_sid=S_${mode}&__repro_aid=A_${mode}&__repro_mode=${mode}`);
+      assert.equal(response.status, 200);
+      const actual = await response.json();
+      assert.equal(actual.rows.length, 157, 'recording must not alter the application response');
+      assert.equal(actual.rows[156].id, 156);
+    }
+    const deadline = Date.now() + 30_000;
+    let events = [];
+    do {
+      await flushIngestQueue();
+      events = posts.flatMap(post => post.events || []);
+      if (events.filter(event => event.event_type === 'request_capture_manifest').length >= 2) break;
+      await sleep(100);
+    } while (Date.now() < deadline);
+    for (const mode of ['live', 'staging']) {
+      const scoped = events.filter(event => event.session_id === `S_${mode}`);
+      const request = scoped.find(event => event.event_type === 'backend_request')?.payload?.request;
+      assert(request, `missing ${mode} request`);
+      const values = scoped.flatMap(event => [...(event.payload?.traceValues || []), ...(event.payload?.requestValues || []), ...(event.payload?.dbValues || [])]);
+      if (request.respBodyValueCapture?.valueId) assert(values.some(value => value.id === request.respBodyValueCapture.valueId), 'response reference must resolve');
+      const body = values.find(value => value.id === request.respBodyValueCapture?.valueId)?.value || request.respBody;
+      assert(body?.rows, `missing ${mode} response body`);
+      assert.equal(body.rows.length, mode === 'live' ? 101 : 157, JSON.stringify({ mode, capture: request.respBodyValueCapture, valueTargets: values.map(value => value.target) }));
+      if (mode === 'live') {
+        assert.equal(body.rows[100].originalCount, 157);
+        assert.equal(request.respBodyValueCapture.complete, false);
+      }
+      const changes = scoped.filter(event => event.event_type === 'db_change').flatMap(event => event.payload?.db || []);
+      const read = changes.find(change => change.op === 'findOne');
+      assert(read, `missing ${mode} database query`);
+      const result = values.find(value => value.id === read.resultMetaValueCapture?.valueId)?.value || read.resultMeta;
+      const resultText = JSON.stringify(result);
+      assert(resultText?.includes('SHIP-LIMIT'), `missing ${mode} database result ${JSON.stringify(read)}`);
+      assert.equal(resultText.includes('"id":156'), mode === 'staging', 'query results must follow the same mode as responses');
+      if (mode === 'live') assert.equal(read.resultMetaValueCapture.complete, false);
+      const trace = scoped.flatMap(event => event.payload?.trace || []).find(event => event.fn === 'inspectShipment' && event.type === 'enter');
+      assert(trace, `missing ${mode} function arguments`);
+      const args = values.find(value => value.id === trace.argsValueCapture?.valueId)?.value || trace.args;
+      assert.equal(args[0].rows.length, mode === 'live' ? 101 : 157);
+    }
+    console.log('real Mongo + Express + instrumented traces: live bounds and exact staging evidence passed');
+  } finally {
+    if (app) await app.close();
+    await flushIngestQueue();
+    await new Promise(resolve => sink.close(resolve));
+    if (mongo) await mongo.stop();
+  }
+}
+main().catch(error => { console.error(error); process.exitCode = 1; });

package/test/policy-session-completion.testcontainers.test.js

@@ -79,6 +79,7 @@ function requestNames(port, index) {
                 'x-bug-session-id': 'S_policy_completion',
                 'x-bug-action-id': `A_policy_completion_${index}`,
                 'x-bug-request-start': String(Date.now()),
+                'x-demo-actor-id': 'policy-completion-actor',
             },
         }, (response) => {
             const chunks = [];
@@ -152,10 +153,26 @@ async function main() {
             captureHeaders: false,
             privacy: {
                 environment: 'dev',
-                policy: largePolicy(),
+            },
+            liveMode: {
+                enabled: true,
+                backendOnly: true,
+                defineActorId: ({ req }) => req.headers['x-demo-actor-id'],
+                shouldCapture: () => true,
+                actorType: 'policy-test-user',
             },
             ingestBase: 'http://127.0.0.1:65535',
         };
+        __reproTestHooks.shareRuntimePrivacyStateForTest(
+            {
+                ...cfg,
+                privacy: {
+                    environment: 'dev',
+                    policy: largePolicy(),
+                },
+            },
+            cfg,
+        );
 
         const depotSchema = new mongoose.Schema({
             location: String,

package/test/trace-observation-snapshots.test.js

@@ -0,0 +1,403 @@
+process.env.REPRO_SDK_BACKGROUND_MAX_DEFER_MS = '50';
+process.env.REPRO_SDK_BACKGROUND_IDLE_DELAY_MS = '0';
+process.env.REPRO_SDK_BACKGROUND_BUSY_IDLE_DELAY_MS = '0';
+process.env.REPRO_SDK_TRACE_INLINE_VALUE_MAX_SERIALIZED_CHARS = '256';
+process.env.REPRO_TRACE_BATCH_MAX_SERIALIZED_BYTES = '65536';
+process.env.TRACE_IDLE_FLUSH_MS = '10';
+process.env.TRACE_LINGER_AFTER_FINISH_MS = '0';
+
+const assert = require('node:assert/strict');
+const { EventEmitter } = require('node:events');
+const { initReproTracing, reproMiddleware, __reproTestHooks } = require('../dist');
+const { flushIngestQueue } = require('../dist/ingest/client');
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+function deferred() {
+    let resolve;
+    let reject;
+    const promise = new Promise((resolvePromise, rejectPromise) => {
+        resolve = resolvePromise;
+        reject = rejectPromise;
+    });
+    return { promise, resolve, reject };
+}
+
+function makeReqRes(sessionId) {
+    const req = new EventEmitter();
+    req.method = 'POST';
+    req.url = '/trace-observation-snapshots';
+    req.originalUrl = req.url;
+    req.headers = {
+        'x-bug-session-id': sessionId,
+        'x-bug-action-id': `A_${sessionId}`,
+        'x-bug-request-start': String(Date.now()),
+    };
+    req.body = {};
+    req.params = {};
+    req.query = {};
+
+    const res = new EventEmitter();
+    res.statusCode = 204;
+    res.getHeader = () => undefined;
+    res.getHeaders = () => ({});
+    res.setHeader = () => {};
+    res.write = () => true;
+    res.end = function end() {
+        this.emit('finish');
+        return this;
+    };
+    return { req, res };
+}
+
+function makePayload(id, phase = 'before') {
+    return {
+        id,
+        phase,
+        nested: { count: 0 },
+        rows: Array.from({ length: 20 }, (_, index) => ({
+            index,
+            location: `${id}-LOCATION-${String(index).padStart(3, '0')}`,
+            state: 'initial',
+        })),
+    };
+}
+
+function mutateSyncPayload(payload) {
+    payload.phase = 'inside-sync';
+    payload.nested.count = 1;
+    payload.rows[0].state = 'inside-sync';
+    return payload;
+}
+
+function observeVersion(payload) {
+    return payload.phase;
+}
+
+function observeAliasedPayload(payload) {
+    return payload;
+}
+
+async function mutateAsyncPayload(payload, gate) {
+    payload.phase = 'started';
+    await gate;
+    payload.phase = 'settled';
+    payload.nested.count += 1;
+    payload.rows[0].state = 'settled';
+    return payload;
+}
+
+function mutateAndThrow(payload) {
+    payload.phase = 'before-throw';
+    payload.nested.count = 7;
+    throw new Error('expected trace snapshot failure path');
+}
+
+function observeHostilePayload(payload) {
+    return payload;
+}
+
+async function waitForCapture(posts) {
+    const deadline = Date.now() + 5000;
+    while (Date.now() < deadline) {
+        const events = posts.flatMap((post) => post.events || []);
+        if (events.some((event) => event.event_type === 'backend_request') &&
+            events.some((event) => event.event_type === 'trace_batch')) {
+            break;
+        }
+        await sleep(20);
+    }
+    await __reproTestHooks.drainSdkBackgroundQueueForTest();
+    await flushIngestQueue();
+}
+
+function inspectCapture(posts) {
+    const ingestEvents = posts.flatMap((post) => post.events || []);
+    const traceBatches = ingestEvents.filter((event) => event.event_type === 'trace_batch');
+    const events = traceBatches.flatMap((event) => event.payload?.trace || []);
+    const definitions = traceBatches.flatMap((event) => event.payload?.traceValues || []);
+    const definitionsById = new Map(definitions.map((definition) => [definition.id, definition]));
+
+    const resolveCaptured = (event, field) => {
+        const capture = event[field];
+        assert.equal(capture?.status, 'stored', `${event.fn} ${event.type} lacks ${field}`);
+        const definition = definitionsById.get(capture.valueId);
+        assert(definition, `missing definition ${capture.valueId}`);
+        return definition.value;
+    };
+
+    return { ingestEvents, traceBatches, events, definitions, definitionsById, resolveCaptured };
+}
+
+function eventsFor(capture, fn) {
+    return capture.events.filter((event) => event.fn === fn);
+}
+
+async function main() {
+    const config = {
+        tenantId: 'TENANT_trace_observation_snapshot',
+        appId: 'APP_trace_observation_snapshot',
+        appSecret: 'trace-observation-snapshot-secret',
+        captureHeaders: false,
+        privacy: { environment: 'dev', captureRaw: true },
+        ingestBase: 'http://127.0.0.1:65535',
+    };
+
+    initReproTracing({ instrument: false, fullValueCapture: true, logFunctionCalls: false });
+    __reproTestHooks.resetSdkBackgroundQueuesForTest();
+
+    const posts = [];
+    const previousFetch = global.fetch;
+    global.fetch = async (_url, init = {}) => {
+        posts.push(JSON.parse(String(init.body || '{}')));
+        return {
+            ok: true,
+            status: 202,
+            json: async () => ({ ok: true }),
+            text: async () => '{"ok":true}',
+        };
+    };
+
+    const sessionId = 'S_trace_observation_snapshot';
+    const middleware = reproMiddleware(config);
+    const { req, res } = makeReqRes(sessionId);
+
+    try {
+        await new Promise((resolve, reject) => {
+            middleware(req, res, async (middlewareError) => {
+                if (middlewareError) {
+                    reject(middlewareError);
+                    return;
+                }
+
+                try {
+                    const syncPayload = makePayload('sync');
+                    const syncResult = global.__repro_call(
+                        mutateSyncPayload,
+                        null,
+                        [syncPayload],
+                        '/app/trace-observation.service.ts',
+                        20,
+                        'mutateSyncPayload',
+                        false,
+                    );
+                    assert.strictEqual(syncResult, syncPayload, 'tracing changed sync return identity');
+                    syncPayload.phase = 'after-sync-caller';
+                    syncPayload.nested.count = 99;
+                    syncPayload.rows[0].state = 'after-sync-caller';
+
+                    const versionedPayload = makePayload('versioned', 'v1');
+                    for (const phase of ['v1', 'v2', 'v1']) {
+                        versionedPayload.phase = phase;
+                        const observed = global.__repro_call(
+                            observeVersion,
+                            null,
+                            [versionedPayload],
+                            '/app/trace-observation.service.ts',
+                            40,
+                            'observeVersion',
+                            false,
+                        );
+                        assert.equal(observed, phase);
+                    }
+                    versionedPayload.phase = 'after-version-caller';
+
+                    const shared = {
+                        value: 'alias-before',
+                        rows: makePayload('alias-rows').rows,
+                    };
+                    const aliasedPayload = { id: 'alias', left: shared, right: shared };
+                    aliasedPayload.self = aliasedPayload;
+                    const aliasResult = global.__repro_call(
+                        observeAliasedPayload,
+                        null,
+                        [aliasedPayload],
+                        '/app/trace-observation.service.ts',
+                        60,
+                        'observeAliasedPayload',
+                        false,
+                    );
+                    assert.strictEqual(aliasResult, aliasedPayload, 'tracing changed aliased return identity');
+                    shared.value = 'alias-after-caller';
+
+                    const gateA = deferred();
+                    const gateB = deferred();
+                    const asyncPayloadA = makePayload('async-a');
+                    const asyncPayloadB = makePayload('async-b');
+                    const pendingA = global.__repro_call(
+                        mutateAsyncPayload,
+                        null,
+                        [asyncPayloadA, gateA.promise],
+                        '/app/trace-observation.service.ts',
+                        80,
+                        'mutateAsyncPayloadA',
+                        false,
+                    );
+                    const pendingB = global.__repro_call(
+                        mutateAsyncPayload,
+                        null,
+                        [asyncPayloadB, gateB.promise],
+                        '/app/trace-observation.service.ts',
+                        90,
+                        'mutateAsyncPayloadB',
+                        false,
+                    );
+                    gateB.resolve();
+                    assert.strictEqual(await pendingB, asyncPayloadB);
+                    asyncPayloadB.phase = 'after-async-b-caller';
+                    asyncPayloadB.nested.count = 99;
+                    gateA.resolve();
+                    assert.strictEqual(await pendingA, asyncPayloadA);
+                    asyncPayloadA.phase = 'after-async-a-caller';
+                    asyncPayloadA.nested.count = 99;
+
+                    const throwingPayload = makePayload('throwing');
+                    assert.throws(() => global.__repro_call(
+                        mutateAndThrow,
+                        null,
+                        [throwingPayload],
+                        '/app/trace-observation.service.ts',
+                        110,
+                        'mutateAndThrow',
+                        false,
+                    ), /expected trace snapshot failure path/);
+                    throwingPayload.phase = 'after-throw-caller';
+                    throwingPayload.nested.count = 99;
+
+                    const hostilePayload = new Proxy(
+                        { id: 'hostile-payload' },
+                        {
+                            ownKeys() {
+                                throw new Error('hostile ownKeys trap');
+                            },
+                        },
+                    );
+                    const hostileResult = global.__repro_call(
+                        observeHostilePayload,
+                        null,
+                        [hostilePayload],
+                        '/app/trace-observation.service.ts',
+                        130,
+                        'observeHostilePayload',
+                        false,
+                    );
+                    assert.strictEqual(hostileResult, hostilePayload, 'snapshot failure changed application identity');
+
+                    res.end();
+                    resolve();
+                } catch (error) {
+                    reject(error);
+                }
+            });
+        });
+
+        await waitForCapture(posts);
+        const capture = inspectCapture(posts);
+
+        const syncEvents = eventsFor(capture, 'mutateSyncPayload');
+        assert.equal(syncEvents.length, 2);
+        const syncEnterArgs = capture.resolveCaptured(syncEvents.find((event) => event.type === 'enter'), 'argsValueCapture');
+        const syncExit = syncEvents.find((event) => event.type === 'exit');
+        const syncExitArgs = capture.resolveCaptured(syncExit, 'argsValueCapture');
+        const syncReturn = capture.resolveCaptured(syncExit, 'returnValueCapture');
+        assert.deepEqual(
+            [syncEnterArgs[0].phase, syncEnterArgs[0].nested.count, syncEnterArgs[0].rows[0].state],
+            ['before', 0, 'initial'],
+        );
+        assert.deepEqual(
+            [syncExitArgs[0].phase, syncExitArgs[0].nested.count, syncExitArgs[0].rows[0].state],
+            ['inside-sync', 1, 'inside-sync'],
+        );
+        assert.deepEqual(
+            [syncReturn.phase, syncReturn.nested.count, syncReturn.rows[0].state],
+            ['inside-sync', 1, 'inside-sync'],
+        );
+
+        const versionEvents = eventsFor(capture, 'observeVersion');
+        assert.equal(versionEvents.length, 6);
+        const versionRefs = versionEvents.map((event) => event.argsValueCapture?.valueId);
+        assert(versionRefs.every((valueId) => typeof valueId === 'string'));
+        assert.equal(versionRefs[0], versionRefs[1], 'unchanged enter/exit observations must deduplicate');
+        assert.equal(versionRefs[2], versionRefs[3], 'second unchanged enter/exit observations must deduplicate');
+        assert.equal(versionRefs[4], versionRefs[5], 'restored enter/exit observations must deduplicate');
+        assert.equal(versionRefs[0], versionRefs[4], 'restoring prior content must restore its content ID');
+        assert.notEqual(versionRefs[0], versionRefs[2], 'same object with changed content needs a new content ID');
+        assert.deepEqual(
+            [0, 2, 4].map((index) => capture.resolveCaptured(versionEvents[index], 'argsValueCapture')[0].phase),
+            ['v1', 'v2', 'v1'],
+        );
+
+        const aliasEvents = eventsFor(capture, 'observeAliasedPayload');
+        assert.equal(aliasEvents.length, 2);
+        const aliasArgs = capture.resolveCaptured(aliasEvents[0], 'argsValueCapture');
+        assert.equal(aliasArgs[0].left.value, 'alias-before');
+        assert.deepEqual(aliasArgs[0].right, { __reproCircularRef: '$[0].left' });
+        assert.deepEqual(aliasArgs[0].self, { __reproCircularRef: '$[0]' });
+
+        for (const fn of ['mutateAsyncPayloadA', 'mutateAsyncPayloadB']) {
+            const asyncEvents = eventsFor(capture, fn);
+            assert.equal(asyncEvents.length, 2, `${fn} event count`);
+            const enterArgs = capture.resolveCaptured(asyncEvents.find((event) => event.type === 'enter'), 'argsValueCapture');
+            const exit = asyncEvents.find((event) => event.type === 'exit');
+            const exitArgs = capture.resolveCaptured(exit, 'argsValueCapture');
+            const returnValue = capture.resolveCaptured(exit, 'returnValueCapture');
+            assert.equal(enterArgs[0].phase, 'before', `${fn} enter was rewritten`);
+            assert.equal(enterArgs[0].nested.count, 0);
+            assert.equal(exitArgs[0].phase, 'settled', `${fn} exit was rewritten by caller mutation`);
+            assert.equal(exitArgs[0].nested.count, 1);
+            assert.equal(returnValue.phase, 'settled', `${fn} return was rewritten by caller mutation`);
+            assert.equal(returnValue.nested.count, 1);
+        }
+
+        const throwEvents = eventsFor(capture, 'mutateAndThrow');
+        assert.equal(throwEvents.length, 2);
+        const throwExit = throwEvents.find((event) => event.type === 'exit');
+        const throwArgs = capture.resolveCaptured(throwExit, 'argsValueCapture');
+        const throwError = capture.resolveCaptured(throwExit, 'errorValueCapture');
+        assert.equal(throwArgs[0].phase, 'before-throw');
+        assert.equal(throwArgs[0].nested.count, 7);
+        assert.equal(throwExit.threw, true);
+        assert.equal(throwError.message, 'expected trace snapshot failure path');
+
+        const hostileEvents = eventsFor(capture, 'observeHostilePayload');
+        assert.equal(hostileEvents.length, 2);
+        for (const hostileEvent of hostileEvents) {
+            assert.deepEqual(hostileEvent.args, [{
+                __kind: 'omitted',
+                reason: 'capture-snapshot-failed',
+            }]);
+        }
+        const manifests = capture.ingestEvents
+            .filter((event) => event.event_type === 'request_capture_manifest')
+            .map((event) => event.payload?.requestCaptureManifest ?? event.payload)
+            .filter(Boolean);
+        assert.equal(manifests.length, 1);
+        assert.equal(manifests[0].privacy?.status, 'failed');
+        assert(manifests[0].captureFailures?.some((failure) =>
+            failure.stage === 'trace.snapshot' &&
+            failure.target === 'trace.args' &&
+            failure.reason === 'snapshot_failed'
+        ), JSON.stringify(manifests[0]));
+
+        const serializedDefinitions = JSON.stringify(capture.definitions);
+        for (const forbidden of [
+            'after-sync-caller',
+            'after-version-caller',
+            'alias-after-caller',
+            'after-async-a-caller',
+            'after-async-b-caller',
+            'after-throw-caller',
+        ]) {
+            assert(!serializedDefinitions.includes(forbidden), `late mutation leaked into capture: ${forbidden}`);
+        }
+
+        console.log('trace observation snapshots preserve temporal values and application identity OK');
+    } finally {
+        global.fetch = previousFetch;
+    }
+}
+
+main().catch((error) => {
+    console.error(error);
+    process.exit(1);
+});