@riocrypto/common-server 1.0.2899 → 1.0.2901

package/build/services/logger.d.ts

@@ -4,6 +4,12 @@ declare class LoggerService {
     constructor();
     private sensitiveSubstrings;
     private isSensitiveKey;
+    private normalizeKey;
+    private fullyRedactedBodyFields;
+    private lastFourBodyFields;
+    private attributionBodyFields;
+    private redactBodyFields;
+    redactLogBody: (source: any, propName: string) => any;
     private maskValue;
     private deepMaskSensitiveKeys;
     private maskSensitiveData;

package/build/services/logger.js

@@ -36,6 +36,88 @@ class LoggerService {
             "passphrase",
             "csrf",
         ];
+        // Identity-grade personal data. Replaced outright rather than partially
+        // masked, because a partial RFC, date of birth or street address is still
+        // identifying and none of them help debugging.
+        this.fullyRedactedBodyFields = new Set([
+            "rfcCurpOrdenante",
+            "rfcCurpBeneficiario",
+            "RFC",
+            "RUC",
+            "NIT",
+            "beneficiaryRfc",
+            // Fintoc carries the counterparty RFC or CURP in holder_id.
+            "holder_id",
+            "taxId",
+            "tax_identification_number",
+            "personalId",
+            "id_number",
+            "documentoOrdenante",
+            "documentoBeneficiario",
+            "NroDocOri",
+            "birthday",
+            "dob",
+            "date_of_birth",
+            // Address components only. A bare "address" key is a blockchain wallet
+            // address in the crypto services, which is not personal data.
+            "street1",
+            "street2",
+            "street_line_1",
+            "street_line_2",
+            "address_street_1",
+            "address_street_2",
+            "postalCode",
+            "DireccionBeneficiario",
+        ].map((field) => this.normalizeKey(field)));
+        // Account identifiers. Truncated rather than replaced so a deposit can
+        // still be matched to an account from the log line alone.
+        this.lastFourBodyFields = new Set([
+            "CLABE",
+            "IBAN",
+            "accountNumber",
+            "routingNumber",
+            "cuentaOrdenante",
+            "cuentaBeneficiario",
+            "cuentaBeneficiario2",
+            "cuentaBaaS",
+            "cuentaOrigen",
+            "originCLABE",
+            "destinationCLABE",
+            "senderCLABE",
+            "receiverCLABE",
+            "originAccountNumber",
+            "CCI",
+            "CCIV",
+            "CCI_Gene",
+            "CCIOrigen",
+            "CCIDestino",
+            "cciBeneficiario",
+            "originCCI",
+        ].map((field) => this.normalizeKey(field)));
+        // Authenticated-identity attribution, logged deliberately as a security
+        // control. They contain "auth", so the credential substring rule would
+        // swallow them now that it walks bodies too.
+        this.attributionBodyFields = new Set([
+            "authId",
+            "adminAuthId",
+            "authName",
+            "adminAuthName",
+            "authEmail",
+            "adminAuthEmail",
+            "authPhoneNumber",
+        ].map((field) => this.normalizeKey(field)));
+        // express-winston filter for services that whitelist whole bodies. It hands
+        // over either the parsed object or the raw string depending on the content
+        // type it saw, and it calls this once per whitelisted field as well as once
+        // per top-level body key, so it cannot assume it has the whole body.
+        this.redactLogBody = (source, propName) => {
+            if (!source || typeof source !== "object")
+                return source;
+            const value = source[propName];
+            if (value === undefined || value === null)
+                return value;
+            return this.redactBodyFields({ [propName]: value })[propName];
+        };
         this.maskSensitiveData = (0, winston_1.format)((info) => {
             var _a, _b, _c, _d, _e;
             // Mask sensitive headers
@@ -70,17 +152,12 @@ class LoggerService {
             if (((_d = (_c = info.meta) === null || _c === void 0 ? void 0 : _c.req) === null || _d === void 0 ? void 0 : _d.body) &&
                 typeof info.meta.req.body === "object" &&
                 info.meta.req.body !== null) {
-                const requestBody = info.meta.req.body; // Type assertion
-                const requestBodyFieldsToMaskWithLastFour = [
-                    "accountNumber",
-                    "routingNumber",
-                ];
-                requestBodyFieldsToMaskWithLastFour.forEach((field) => {
-                    if (Object.prototype.hasOwnProperty.call(requestBody, field) &&
-                        typeof requestBody[field] === "string") {
-                        requestBody[field] = this.maskValue(requestBody[field], true);
-                    }
-                });
+                // Walks the whole body for personal data and credentials. accountNumber
+                // and routingNumber are in lastFourBodyFields, so they keep the
+                // truncation they had here and now get it when nested too.
+                const requestBody = this.redactBodyFields(info.meta.req.body);
+                // Kept to the top level, as before. "code" is too generic to walk with,
+                // and nested error and status codes have to stay readable.
                 const requestBodyFieldsToMaskWithoutLastFour = [
                     "password",
                     "newPassword",
@@ -94,13 +171,15 @@ class LoggerService {
                         requestBody[field] = this.maskValue(requestBody[field]);
                     }
                 });
+                info.meta.req.body = requestBody;
             }
             // Mask sensitive response body fields
             const resAsAny = (_e = info.meta) === null || _e === void 0 ? void 0 : _e.res;
             if ((resAsAny === null || resAsAny === void 0 ? void 0 : resAsAny.body) &&
                 typeof resAsAny.body === "object" &&
                 resAsAny.body !== null) {
-                const responseBody = resAsAny.body; // Keep this assertion for object access
+                const responseBody = this.redactBodyFields(resAsAny.body);
+                // Kept to the top level, as before. "value" is too generic to walk with.
                 const responseBodyFieldsToMask = ["secret", "value"];
                 responseBodyFieldsToMask.forEach((field) => {
                     if (Object.prototype.hasOwnProperty.call(responseBody, field) &&
@@ -108,6 +187,7 @@ class LoggerService {
                         responseBody[field] = this.maskValue(responseBody[field]);
                     }
                 });
+                resAsAny.body = responseBody;
             }
             return info;
         });
@@ -193,6 +273,53 @@ class LoggerService {
         const lower = key.toLowerCase();
         return this.sensitiveSubstrings.some((sub) => lower.includes(sub));
     }
+    // Body keys are compared on the whole normalised key rather than on a
+    // substring, so CLABEOffset, fintocAccountNumberId and tipoCuentaOrdenante
+    // stay readable even though they contain a redacted word.
+    normalizeKey(key) {
+        return key.toLowerCase().replace(/[_-]/g, "");
+    }
+    redactBodyFields(value, seen = new WeakSet(), depth = 0) {
+        if (depth > 8 || value === null || value === undefined)
+            return value;
+        if (typeof value !== "object")
+            return value;
+        if (seen.has(value))
+            return "[Circular]";
+        seen.add(value);
+        if (Array.isArray(value)) {
+            return value.map((item) => this.redactBodyFields(item, seen, depth + 1));
+        }
+        const result = {};
+        for (const key of Object.keys(value)) {
+            const entry = value[key];
+            const normalized = this.normalizeKey(key);
+            // STP sends the optional beneficiario2 fields as empty strings on most
+            // notifications, and masking those only hides that they were empty.
+            if (entry === "") {
+                result[key] = entry;
+            }
+            else if (this.fullyRedactedBodyFields.has(normalized)) {
+                result[key] = "[REDACTED]";
+            }
+            else if (this.lastFourBodyFields.has(normalized) &&
+                (typeof entry === "string" || typeof entry === "number")) {
+                result[key] = this.maskValue(String(entry), true);
+            }
+            else if (this.isSensitiveKey(key) &&
+                !this.attributionBodyFields.has(normalized) &&
+                typeof entry === "string") {
+                result[key] = this.maskValue(entry);
+            }
+            else if (typeof entry === "object" && entry !== null) {
+                result[key] = this.redactBodyFields(entry, seen, depth + 1);
+            }
+            else {
+                result[key] = entry;
+            }
+        }
+        return result;
+    }
     maskValue(value, showLastFour = false) {
         if (showLastFour) {
             return value.length > 4 ? "*".repeat(12) + value.slice(-4) : "************";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riocrypto/common-server",
-  "version": "1.0.2899",
+  "version": "1.0.2901",
   "description": "",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -28,7 +28,7 @@
     "@google-cloud/secret-manager": "^5.6.0",
     "@google-cloud/storage": "^7.19.0",
     "@hyperdx/node-opentelemetry": "^0.10.3",
-    "@riocrypto/common": "1.0.2711",
+    "@riocrypto/common": "1.0.2713",
     "@slack/web-api": "^7.15.0",
     "@types/express": "^4.17.25",
     "axios": "1.18.1",