@riocrypto/common-server 1.0.2901 → 1.0.2903

package/build/services/logger.d.ts

@@ -7,7 +7,11 @@ declare class LoggerService {
     private normalizeKey;
     private fullyRedactedBodyFields;
     private lastFourBodyFields;
+    private clearTextExactBodyFields;
     private attributionBodyFields;
+    private bodySensitiveSubstrings;
+    private bodyCredentialFields;
+    private isSensitiveBodyKey;
     private redactBodyFields;
     redactLogBody: (source: any, propName: string) => any;
     private maskValue;

package/build/services/logger.js

@@ -69,31 +69,26 @@ class LoggerService {
             "postalCode",
             "DireccionBeneficiario",
         ].map((field) => this.normalizeKey(field)));
-        // Account identifiers. Truncated rather than replaced so a deposit can
-        // still be matched to an account from the log line alone.
+        // Pull-capable account identifiers, truncated to the last four. An ACH debit
+        // can be initiated from a routing and account number pair, and a SEPA direct
+        // debit from an IBAN, so these are closer to a credential than to an address.
+        //
+        // CLABE and CCI are deliberately absent. SPEI and CCE are credit-push only,
+        // so a destination account cannot be drained by anyone who reads it, and the
+        // full value is the evidence that a settlement went where it was instructed
+        // to. Truncating it would cost real traceability to buy very little.
         this.lastFourBodyFields = new Set([
-            "CLABE",
             "IBAN",
             "accountNumber",
             "routingNumber",
-            "cuentaOrdenante",
-            "cuentaBeneficiario",
-            "cuentaBeneficiario2",
-            "cuentaBaaS",
-            "cuentaOrigen",
-            "originCLABE",
-            "destinationCLABE",
-            "senderCLABE",
-            "receiverCLABE",
             "originAccountNumber",
-            "CCI",
-            "CCIV",
-            "CCI_Gene",
-            "CCIOrigen",
-            "CCIDestino",
-            "cciBeneficiario",
-            "originCCI",
         ].map((field) => this.normalizeKey(field)));
+        // Matched on literal spelling, not the normalised key, because the two
+        // spellings mean different things. Fintoc puts a CLABE in account_number
+        // (see createTransfer in fintoc-client), which is push-only and should stay
+        // readable, while bank-accounts uses accountNumber for US accounts, which is
+        // pull-capable and stays truncated above.
+        this.clearTextExactBodyFields = new Set(["account_number"]);
         // Authenticated-identity attribution, logged deliberately as a security
         // control. They contain "auth", so the credential substring rule would
         // swallow them now that it walks bodies too.
@@ -106,6 +101,24 @@ class LoggerService {
             "adminAuthEmail",
             "authPhoneNumber",
         ].map((field) => this.normalizeKey(field)));
+        // sensitiveSubstrings is written for headers and config objects, where "key"
+        // means API key. In a request body it nearly always means identifier
+        // instead -- tracking_key, idempotencyKey, uniqueCompositeKey, tradeKey --
+        // and "sign" matches cosigner. Both are dropped here so the reconciliation
+        // layer stays readable, and the two real credentials they were catching are
+        // listed by name below. Headers, console output and stdout are untouched and
+        // keep the full list.
+        this.bodySensitiveSubstrings = [
+            "token",
+            "secret",
+            "auth",
+            "password",
+            "private",
+            "credential",
+            "passphrase",
+            "csrf",
+        ];
+        this.bodyCredentialFields = new Set(["apiKey", "signature"].map((field) => this.normalizeKey(field)));
         // express-winston filter for services that whitelist whole bodies. It hands
         // over either the parsed object or the raw string depending on the content
         // type it saw, and it calls this once per whitelisted field as well as once
@@ -279,6 +292,15 @@ class LoggerService {
     normalizeKey(key) {
         return key.toLowerCase().replace(/[_-]/g, "");
     }
+    isSensitiveBodyKey(key) {
+        const normalized = this.normalizeKey(key);
+        if (this.attributionBodyFields.has(normalized))
+            return false;
+        if (this.bodyCredentialFields.has(normalized))
+            return true;
+        const lower = key.toLowerCase();
+        return this.bodySensitiveSubstrings.some((sub) => lower.includes(sub));
+    }
     redactBodyFields(value, seen = new WeakSet(), depth = 0) {
         if (depth > 8 || value === null || value === undefined)
             return value;
@@ -303,12 +325,11 @@ class LoggerService {
                 result[key] = "[REDACTED]";
             }
             else if (this.lastFourBodyFields.has(normalized) &&
+                !this.clearTextExactBodyFields.has(key) &&
                 (typeof entry === "string" || typeof entry === "number")) {
                 result[key] = this.maskValue(String(entry), true);
             }
-            else if (this.isSensitiveKey(key) &&
-                !this.attributionBodyFields.has(normalized) &&
-                typeof entry === "string") {
+            else if (this.isSensitiveBodyKey(key) && typeof entry === "string") {
                 result[key] = this.maskValue(entry);
             }
             else if (typeof entry === "object" && entry !== null) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riocrypto/common-server",
-  "version": "1.0.2901",
+  "version": "1.0.2903",
   "description": "",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",