@reproapp/node-sdk 0.0.52 → 0.0.53

package/dist/index.js

@@ -2340,12 +2340,15 @@ function coerceMongoId(value) {
     if (typeof value !== 'object') {
         return null;
     }
+    // Argument lists and query-result arrays are business data, not BSON ids.
+    if (Array.isArray(value))
+        return null;
     const bsonType = typeof value?._bsontype === 'string' ? String(value._bsontype).toLowerCase() : '';
     const ctorName = typeof value?.constructor?.name === 'string' ? String(value.constructor.name).toLowerCase() : '';
     const looksLikeObjectId = bsonType.includes('objectid') ||
         ctorName === 'objectid' ||
         typeof value.toHexString === 'function';
-    const fromBufferShape = coerceMongoIdFromBufferShape(value, looksLikeObjectId);
+    const fromBufferShape = looksLikeObjectId ? coerceMongoIdFromBufferShape(value, true) : null;
     if (fromBufferShape) {
         return fromBufferShape;
     }
@@ -2422,12 +2425,11 @@ function coerceMongoIdFromBufferShape(value, includeIdCandidate = false) {
         if (!Array.isArray(bytes) || bytes.length !== 12) {
             return null;
         }
-        const normalized = bytes.map((byte) => Number(byte));
-        if (normalized.some((byte) => !Number.isInteger(byte) || byte < 0 || byte > 255)) {
+        if (bytes.some((byte) => typeof byte !== 'number' || !Number.isInteger(byte) || byte < 0 || byte > 255)) {
             return null;
         }
         try {
-            return Buffer.from(normalized).toString('hex');
+            return Buffer.from(bytes).toString('hex');
         }
         catch {
             return null;

package/dist/privacy.js

@@ -2891,12 +2891,14 @@ function coercePrivacyObjectId(value) {
     if (typeof value !== 'object') {
         return null;
     }
+    if (Array.isArray(value))
+        return null;
     const bsonType = typeof value?._bsontype === 'string' ? String(value._bsontype).toLowerCase() : '';
     const ctorName = typeof value?.constructor?.name === 'string' ? String(value.constructor.name).toLowerCase() : '';
     const looksLikeObjectId = bsonType.includes('objectid') ||
         ctorName === 'objectid' ||
         typeof value.toHexString === 'function';
-    const fromBufferShape = coercePrivacyObjectIdFromBufferShape(value, looksLikeObjectId);
+    const fromBufferShape = looksLikeObjectId ? coercePrivacyObjectIdFromBufferShape(value, true) : null;
     if (fromBufferShape) {
         return fromBufferShape;
     }
@@ -2970,12 +2972,11 @@ function coercePrivacyObjectIdFromBufferShape(value, includeIdCandidate = false)
         if (!Array.isArray(bytes) || bytes.length !== 12) {
             return null;
         }
-        const normalized = bytes.map((byte) => Number(byte));
-        if (normalized.some((byte) => !Number.isInteger(byte) || byte < 0 || byte > 255)) {
+        if (bytes.some((byte) => typeof byte !== 'number' || !Number.isInteger(byte) || byte < 0 || byte > 255)) {
             return null;
         }
         try {
-            return Buffer.from(normalized).toString('hex');
+            return Buffer.from(bytes).toString('hex');
         }
         catch {
             return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reproapp/node-sdk",
-  "version": "0.0.52",
+  "version": "0.0.53",
   "description": "Repro Nest SDK",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -10,13 +10,13 @@
   },
   "scripts": {
     "test:latency": "npm run build && node test/privacy-fetch-timeout.test.js && node test/capture-latency.testcontainers.test.js",
-    "test:live-capture": "npm run build && node test/live-capture-limits.test.js && node test/ingest-throttle-retention.test.js && node test/live-capture-limits.testcontainers.test.js",
+    "test:live-capture": "npm run build && node test/twelve-element-capture.testcontainers.test.js && node test/live-capture-limits.test.js && node test/ingest-throttle-retention.test.js && node test/live-capture-limits.testcontainers.test.js",
     "test:live-brokers": "npm run build && node test/live-broker-limits.testcontainers.test.js",
     "build": "tsc -p tsconfig.json",
     "dev": "tsc -p tsconfig.json --watch --preserveWatchOutput",
     "prepublishOnly": "npm run build",
-    "test": "npm run build && node test/semantic-serialization.test.js && node test/semantic-serialization-trace.test.js && node test/content-addressed-trace-values.test.js && node test/trace-observation-snapshots.test.js && node test/session-storage-budget.test.js && node test/trace-source-exclude.test.js && node test/unawaited.test.js && node test/integration-unawaited.js && node test/request-flush-timing.test.js && node test/request-capture-background.test.js && node test/init-auto-http-server.test.js && node test/backend-live-mode.test.js && node test/client-performance-regression.test.js && node test/request-manifest-priority.test.js && node test/runtime-no-double-invoke.test.js && node test/express-trace-http-args.test.js && node test/trace-batch-size.test.js && node test/sdk-background-priority.test.js && node test/sdk-background-timeout-isolation.test.js && node test/runtime-service-registration.test.js && node test/ingest-queue-retention.test.js && node test/ingest-high-priority-retention.test.js && node test/ingest-high-priority-fairness.test.js && node test/ingest-critical-retention.test.js && node test/ingest-critical-retry-retention.test.js && node test/ingest-batching.test.js && node test/ingest-timeout.test.js && node -r ./tracer/register test/promise-map.test.js && node test/disable-subtree.test.js && node test/circular-capture.test.js && node test/wrap-plugin-arrow-args.test.js && node test/wrap-plugin-super-call.test.js && node test/function-arg-identity.test.js && node test/privacy-service-scope.test.js && node test/privacy-policy-index.test.js && node test/policy-capture-attestation.test.js && node test/privacy-runtime-policy.test.js && node test/runtime-privacy-materialization.test.js && node test/kafka-runtime-privacy-policy.test.js && node test/amqplib-integration.test.js && node test/mongodb-integration.test.js && node test/mongodb-esm-import-hook.test.js && node test/mongodb-suppression-cleanup.test.js && node test/postgresql-integration.test.js",
-    "test:containers": "npm run build && node test/background-continuous-traffic.testcontainers.test.js && node test/runtime-no-double-invoke.testcontainers.test.js && node test/wrap-plugin-super-call.testcontainers.test.js && node test/function-arg-identity.testcontainers.test.js && node test/mongodb-mongoose-native-suppression.testcontainers.test.js && node test/content-addressed-mongodb.testcontainers.test.js && node test/policy-session-completion.testcontainers.test.js && node test/postgresql-integrations.testcontainers.test.js"
+    "test": "npm run build && node test/semantic-serialization.test.js && node test/semantic-serialization-trace.test.js && node test/content-addressed-trace-values.test.js && node test/trace-observation-snapshots.test.js && node test/session-storage-budget.test.js && node test/trace-source-exclude.test.js && node test/unawaited.test.js && node test/integration-unawaited.js && node test/request-flush-timing.test.js && node test/request-capture-background.test.js && node test/init-auto-http-server.test.js && node test/backend-live-mode.test.js && node test/client-performance-regression.test.js && node test/request-manifest-priority.test.js && node test/runtime-no-double-invoke.test.js && node test/express-trace-http-args.test.js && node test/trace-batch-size.test.js && node test/sdk-background-priority.test.js && node test/sdk-background-timeout-isolation.test.js && node test/runtime-service-registration.test.js && node test/ingest-queue-retention.test.js && node test/ingest-high-priority-retention.test.js && node test/ingest-high-priority-fairness.test.js && node test/ingest-critical-retention.test.js && node test/ingest-critical-retry-retention.test.js && node test/ingest-batching.test.js && node test/ingest-timeout.test.js && node -r ./tracer/register test/promise-map.test.js && node test/disable-subtree.test.js && node test/circular-capture.test.js && node test/wrap-plugin-arrow-args.test.js && node test/wrap-plugin-super-call.test.js && node test/function-arg-identity.test.js && node test/privacy-service-scope.test.js && node test/privacy-policy-index.test.js && node test/policy-capture-attestation.test.js && node test/object-id-shapes.test.js && node test/privacy-runtime-policy.test.js && node test/runtime-privacy-materialization.test.js && node test/kafka-runtime-privacy-policy.test.js && node test/amqplib-integration.test.js && node test/mongodb-integration.test.js && node test/mongodb-esm-import-hook.test.js && node test/mongodb-suppression-cleanup.test.js && node test/postgresql-integration.test.js",
+    "test:containers": "npm run build && node test/twelve-element-capture.testcontainers.test.js && node test/background-continuous-traffic.testcontainers.test.js && node test/runtime-no-double-invoke.testcontainers.test.js && node test/wrap-plugin-super-call.testcontainers.test.js && node test/function-arg-identity.testcontainers.test.js && node test/mongodb-mongoose-native-suppression.testcontainers.test.js && node test/content-addressed-mongodb.testcontainers.test.js && node test/policy-session-completion.testcontainers.test.js && node test/postgresql-integrations.testcontainers.test.js"
   },
   "peerDependencies": {
     "express": "^5.1.0",

package/src/index.ts

@@ -2906,6 +2906,8 @@ function coerceMongoId(value: any): string | null {
     if (typeof value !== 'object') {
         return null;
     }
+    // Argument lists and query-result arrays are business data, not BSON ids.
+    if (Array.isArray(value)) return null;
 
     const bsonType = typeof (value as any)?._bsontype === 'string' ? String((value as any)._bsontype).toLowerCase() : '';
     const ctorName = typeof value?.constructor?.name === 'string' ? String(value.constructor.name).toLowerCase() : '';
@@ -2914,7 +2916,7 @@ function coerceMongoId(value: any): string | null {
         ctorName === 'objectid' ||
         typeof (value as any).toHexString === 'function';
 
-    const fromBufferShape = coerceMongoIdFromBufferShape(value, looksLikeObjectId);
+    const fromBufferShape = looksLikeObjectId ? coerceMongoIdFromBufferShape(value, true) : null;
     if (fromBufferShape) {
         return fromBufferShape;
     }
@@ -2994,13 +2996,12 @@ function coerceMongoIdFromBufferShape(value: any, includeIdCandidate: boolean =
             return null;
         }
 
-        const normalized = bytes.map((byte) => Number(byte));
-        if (normalized.some((byte) => !Number.isInteger(byte) || byte < 0 || byte > 255)) {
+        if (bytes.some((byte) => typeof byte !== 'number' || !Number.isInteger(byte) || byte < 0 || byte > 255)) {
             return null;
         }
 
         try {
-            return Buffer.from(normalized).toString('hex');
+            return Buffer.from(bytes).toString('hex');
         } catch {
             return null;
         }

package/src/privacy.ts

@@ -3685,6 +3685,7 @@ function coercePrivacyObjectId(value: any): string | null {
     if (typeof value !== 'object') {
         return null;
     }
+    if (Array.isArray(value)) return null;
 
     const bsonType = typeof (value as any)?._bsontype === 'string' ? String((value as any)._bsontype).toLowerCase() : '';
     const ctorName = typeof value?.constructor?.name === 'string' ? String(value.constructor.name).toLowerCase() : '';
@@ -3693,7 +3694,7 @@ function coercePrivacyObjectId(value: any): string | null {
         ctorName === 'objectid' ||
         typeof value.toHexString === 'function';
 
-    const fromBufferShape = coercePrivacyObjectIdFromBufferShape(value, looksLikeObjectId);
+    const fromBufferShape = looksLikeObjectId ? coercePrivacyObjectIdFromBufferShape(value, true) : null;
     if (fromBufferShape) {
         return fromBufferShape;
     }
@@ -3774,13 +3775,12 @@ function coercePrivacyObjectIdFromBufferShape(value: any, includeIdCandidate: bo
             return null;
         }
 
-        const normalized = bytes.map((byte) => Number(byte));
-        if (normalized.some((byte) => !Number.isInteger(byte) || byte < 0 || byte > 255)) {
+        if (bytes.some((byte) => typeof byte !== 'number' || !Number.isInteger(byte) || byte < 0 || byte > 255)) {
             return null;
         }
 
         try {
-            return Buffer.from(normalized).toString('hex');
+            return Buffer.from(bytes).toString('hex');
         } catch {
             return null;
         }

package/test/object-id-shapes.test.js

@@ -0,0 +1,36 @@
+const assert = require('node:assert/strict');
+const { ObjectId } = require('mongodb');
+const { __reproTestHooks } = require('../dist');
+const { applyRuntimePrivacyPolicy, applyRuntimePrivacyPolicyAsync } = require('../dist/privacy');
+
+async function main() {
+  const serializers = {
+    trace: value => __reproTestHooks.sanitizeTraceValueForPrivacyForTest(value),
+    policy: value => applyRuntimePrivacyPolicy(null, 'trace.args', value, { appId: 'APP_test' }),
+    asyncPolicy: value => applyRuntimePrivacyPolicyAsync(null, 'db.resultMeta', value, { appId: 'APP_test' }),
+  };
+  const bytes = Array.from({ length: 12 }, (_, i) => i);
+  const hex = '000102030405060708090a0b';
+  for (const [name, serialize] of Object.entries(serializers)) {
+    const rows = bytes.map(ordinal => Object.assign(Object.create(null), { ordinal, status: 'active' }));
+    const numericKeys = Object.fromEntries(bytes.map(i => [i, i]));
+    for (const input of [bytes, rows, numericKeys, { buffer: bytes }, { type: 'Buffer', data: bytes }]) {
+      const result = await serialize(input);
+      assert.deepEqual(JSON.parse(JSON.stringify(result)), JSON.parse(JSON.stringify(input)),
+        `${name}: ordinary data must not be collapsed to a BSON id`);
+    }
+    for (const input of [new ObjectId(hex), { $oid: hex }, { _bsontype: 'ObjectId', buffer: bytes }]) {
+      assert.equal(await serialize(input), hex, `${name}: genuine ObjectId representation must remain supported`);
+    }
+    let coercions = 0;
+    const invalidByte = { valueOf() { coercions += 1; throw new Error('must not coerce application objects'); } };
+    for (const invalid of [invalidByte, Object.create(null), '1', -1, 256, 1.5, NaN]) {
+      const input = { _bsontype: 'ObjectId', buffer: [...bytes.slice(0, 11), invalid] };
+      assert.equal(await serialize(input), '[mongo-id]', `${name}: invalid bytes must not become a fabricated ObjectId`);
+    }
+    assert.equal(coercions, 0);
+  }
+  console.log('ObjectId discrimination passed for trace, synchronous and asynchronous privacy serialization');
+}
+
+main().catch(error => { console.error(error); process.exitCode = 1; });

package/test/twelve-element-capture.testcontainers.test.js

@@ -0,0 +1,116 @@
+process.env.REPRO_SDK_BACKGROUND_IDLE_DELAY_MS = '0';
+process.env.REPRO_SDK_BACKGROUND_BUSY_IDLE_DELAY_MS = '0';
+process.env.REPRO_SDK_BACKGROUND_MAX_DEFER_MS = '30';
+process.env.TRACE_IDLE_FLUSH_MS = '10';
+process.env.TRACE_LINGER_AFTER_FINISH_MS = '0';
+const assert = require('node:assert/strict');
+const http = require('node:http');
+const express = require('express');
+const mongoose = require('mongoose');
+const { GenericContainer, Wait } = require('testcontainers');
+const { initReproTracing, reproMiddleware, reproMongoosePlugin } = require('../dist');
+const { flushIngestQueue } = require('../dist/ingest/client');
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
+
+async function main() {
+  let container, connection, server, sink;
+  const posts = [];
+  try {
+    sink = http.createServer(async (req, res) => {
+      const parts = []; for await (const part of req) parts.push(part);
+      posts.push(JSON.parse(Buffer.concat(parts).toString()));
+      res.writeHead(202); res.end('{}');
+    });
+    await new Promise(resolve => sink.listen(0, '127.0.0.1', resolve));
+    container = await new GenericContainer('mongo:7').withExposedPorts(27017)
+      .withWaitStrategy(Wait.forListeningPorts()).start();
+    connection = await mongoose.createConnection(`mongodb://${container.getHost()}:${container.getMappedPort(27017)}/twelve_elements`).asPromise();
+    initReproTracing({ instrument: false, logFunctionCalls: false, fullValueCapture: true });
+    const app = express();
+    const policy = { environment: 'dev', statements: [{ sid: 'drop-secret',
+      when: { scope: 'FIELD', selector: 'field:internalSecret', target: '**.internalSecret' },
+      apply: { action: 'DROP' }, meta: { priority: 1 } }] };
+    for (const privacy of ['policy', 'raw']) {
+      const config = { tenantId: 'TENANT_twelve', appId: 'APP_twelve', appSecret: 'test',
+        serviceName: `depot-${privacy}`, captureHeaders: false,
+        privacy: { environment: 'dev', captureRaw: privacy === 'raw', ...(privacy === 'policy' ? { policy } : {}) },
+        ingestBase: `http://127.0.0.1:${sink.address().port}` };
+      const schema = new mongoose.Schema({ ordinal: Number, location: String, internalSecret: String });
+      schema.plugin(reproMongoosePlugin(config));
+      const Depot = connection.model(`Depot_${privacy}`, schema);
+      await Depot.insertMany(Array.from({ length: 13 }, (_, ordinal) => ({ ordinal, location: `Depot ${ordinal}`, internalSecret: 'private-fixture-secret' })));
+      app.use(`/${privacy}`, reproMiddleware(config));
+      app.get(`/${privacy}/:count`, async (req, res, next) => {
+        try {
+          const rows = await Depot.find({}).sort({ ordinal: 1 }).limit(Number(req.params.count)).lean().exec();
+          function projectDepots(input) { return input; }
+          const observed = global.__repro_call(projectDepots, null, [rows], __filename, 1, 'projectDepots', false);
+          function numericArguments(...values) { return values; }
+          const numbers = global.__repro_call(numericArguments, null, Array.from({ length: 12 }, (_, i) => i), __filename, 2, 'numericArguments', false);
+          res.json({ rows: observed, numbers });
+        } catch (error) { next(error); }
+      });
+    }
+    server = await new Promise(resolve => { const listener = app.listen(0, '127.0.0.1', () => resolve(listener)); });
+    const scenarios = [];
+    for (const mode of ['live', 'staging']) for (const privacy of ['policy', 'raw']) for (const count of [12, 11, 13]) {
+      const sid = `S_${mode}_${privacy}_${count}`;
+      const response = await fetch(`http://127.0.0.1:${server.address().port}/${privacy}/${count}`, { headers: {
+        'x-bug-session-id': sid, 'x-bug-action-id': `A_${sid}`, 'x-repro-capture-mode': mode,
+      } });
+      assert.equal(response.status, 200);
+      const data = await response.json();
+      assert.equal(data.rows.length, count);
+      assert.equal(data.rows[0].internalSecret, 'private-fixture-secret', 'SDK must not mutate business results');
+      assert.deepEqual(data.numbers, Array.from({ length: 12 }, (_, i) => i));
+      scenarios.push({ sid, mode, privacy, count });
+    }
+    let events;
+    const deadline = Date.now() + 30000;
+    do {
+      await flushIngestQueue();
+      events = posts.flatMap(post => post.events || []);
+      if (events.filter(e => e.event_type === 'request_capture_manifest').length >= scenarios.length) break;
+      await sleep(50);
+    } while (Date.now() < deadline);
+    for (const { sid, privacy, count } of scenarios) {
+      const scoped = events.filter(e => e.session_id === sid);
+      const manifest = scoped.find(e => e.event_type === 'request_capture_manifest')?.payload.requestCaptureManifest;
+      assert(manifest, `missing manifest ${sid}`);
+      assert.equal(manifest.captureFailures, undefined, `${sid}: ${JSON.stringify(manifest.captureFailures)}`);
+      if (privacy === 'policy') assert.equal(manifest.privacy.status, 'applied');
+      const values = scoped.flatMap(e => [...(e.payload.traceValues || []), ...(e.payload.requestValues || []), ...(e.payload.dbValues || [])]);
+      const resolve = (record, ref, field) => values.find(v => v.id === record?.[ref]?.valueId)?.value ?? record?.[field];
+      const trace = scoped.flatMap(e => e.payload.trace || []);
+      const args = resolve(trace.find(e => e.fn === 'projectDepots' && e.type === 'enter'), 'argsValueCapture', 'args');
+      const result = resolve(trace.find(e => e.fn === 'projectDepots' && e.type === 'exit'), 'returnValueCapture', 'returnValue');
+      for (const rows of [args?.[0], result]) {
+        assert.equal(rows?.length, count, `missing business array ${sid}`);
+        assert.equal(rows.at(-1).ordinal, count - 1);
+        assert.equal(rows[0].internalSecret, privacy === 'policy' ? '[dropped]' : 'private-fixture-secret');
+      }
+      const numbers = resolve(trace.find(e => e.fn === 'numericArguments' && e.type === 'enter'), 'argsValueCapture', 'args');
+      assert.deepEqual(numbers, Array.from({ length: 12 }, (_, i) => i), 'numeric argument list must not become an ObjectId');
+      const request = scoped.find(e => e.event_type === 'backend_request')?.payload.request;
+      const body = resolve(request, 'respBodyValueCapture', 'respBody');
+      assert.equal(body.rows.length, count);
+      const dbRead = scoped.flatMap(e => e.payload.db || []).find(e => e.op === 'find');
+      assert(dbRead, `missing Mongo read ${sid}`);
+      const dbResult = resolve(dbRead, 'resultMetaValueCapture', 'resultMeta');
+      const rows = Array.isArray(dbResult) ? dbResult : dbResult?.result;
+      assert.equal(rows?.length, count, `missing Mongo result ${sid}: ${JSON.stringify({ dbRead, dbResult })}`);
+      assert.equal(rows[0].internalSecret, privacy === 'policy' ? '[dropped]' : 'private-fixture-secret');
+      assert.equal(scoped.filter(e => e.event_type === 'trace_batch').length, manifest.expected.traceBatch);
+      assert.equal(scoped.flatMap(e => e.payload.db || []).length, manifest.expected.dbChange);
+      if (privacy === 'policy') assert(!JSON.stringify(scoped).includes('private-fixture-secret'), 'secret leaked into captured evidence');
+    }
+    console.log('12 live/staging policy/raw scenarios: business arrays, numeric arguments, Mongo results and manifests passed');
+  } finally {
+    if (server) await new Promise(resolve => server.close(resolve));
+    if (connection) await connection.close();
+    await flushIngestQueue();
+    if (sink) await new Promise(resolve => sink.close(resolve));
+    if (container) await container.stop();
+  }
+}
+main().catch(error => { console.error(error); process.exitCode = 1; });