@sailfish-ai/recorder 1.7.20 → 1.7.21

package/dist/index.js

@@ -16,19 +16,24 @@ const DOMAINS_TO_NOT_PROPAGATE_HEADER_TO_DEFAULT = [
     "*.googleapis.com",
     "*.amazonaws.com", // Exclude AWS S3
     "*.smooch.io", // Exclude smooch-related requests
-    "*.zendesk.com", // Exclude zendesk-related requests
+    // Exclude zendesk-related requests
+    "*.zendesk.com",
+    "*.zdassets.com",
 ];
 const BAD_HTTP_STATUS = [
     400, // BAD REQUEST
     403, // FORBIDDEN
 ];
 const CORS_KEYWORD = "CORS";
+const STORAGE_VERSION = 1;
 const DYNAMIC_PASSED_HOSTS_KEY = "dynamicPassedHosts";
 const DYNAMIC_EXCLUDED_HOSTS_KEY = "dynamicExcludedHosts";
 const SF_API_KEY_FOR_UPDATE = "sailfishApiKey";
 const SF_BACKEND_API = "sailfishBackendApi";
 const INCLUDE = "include";
 const SAME_ORIGIN = "same-origin";
+const ALLOWED_HEADERS_HEADER = "access-control-allow-headers";
+const OPTIONS = "OPTIONS";
 /**
  * Notify the backend of the updated dynamicExcludedHosts
  */
@@ -42,54 +47,106 @@ function updateExcludedHostsStorageAndBackend(dynamicExcludedHosts) {
 }
 const dynamicExcludedHosts = new Set();
 const dynamicPassedHosts = new Set();
-// Load initial dynamicExcludedHosts from localStorage
+// 2️⃣ Load & evict old entries (>7 days) + version check for Excluded
 (() => {
     const stored = localStorage.getItem(DYNAMIC_EXCLUDED_HOSTS_KEY);
-    if (stored) {
-        try {
-            JSON.parse(stored).forEach((host) => dynamicExcludedHosts.add(host));
-        }
-        catch (e) {
-            if (DEBUG)
-                console.log("Failed to parse dynamicExcludedHosts from storage", e);
+    if (!stored)
+        return;
+    try {
+        const wrapper = JSON.parse(stored);
+        // if it's from an old version, drop it
+        if (wrapper.version !== STORAGE_VERSION) {
             localStorage.removeItem(DYNAMIC_EXCLUDED_HOSTS_KEY);
+            return;
+        }
+        const now = Date.now();
+        const valid = {};
+        for (const [host, ts] of Object.entries(wrapper.entries)) {
+            if (now - ts < 7 * 24 * 60 * 60 * 1000) {
+                dynamicExcludedHosts.add(host);
+                valid[host] = ts;
+            }
         }
+        localStorage.setItem(DYNAMIC_EXCLUDED_HOSTS_KEY, JSON.stringify({ version: STORAGE_VERSION, entries: valid }));
+    }
+    catch (e) {
+        if (DEBUG)
+            console.warn("Failed to parse dynamicExcludedHosts:", e);
+        localStorage.removeItem(DYNAMIC_EXCLUDED_HOSTS_KEY);
     }
 })();
-// Load initial dynamicPassedHosts from localStorage
+// 3️⃣ Load & evict old entries (>7 days) + version check for Passed
 (() => {
     const stored = localStorage.getItem(DYNAMIC_PASSED_HOSTS_KEY);
-    if (stored) {
-        try {
-            JSON.parse(stored).forEach((host) => dynamicPassedHosts.add(host));
-        }
-        catch (e) {
-            if (DEBUG)
-                console.log("Failed to parse dynamicPassedHosts from storage", e);
+    if (!stored)
+        return;
+    try {
+        const wrapper = JSON.parse(stored);
+        if (wrapper.version !== STORAGE_VERSION) {
             localStorage.removeItem(DYNAMIC_PASSED_HOSTS_KEY);
+            return;
+        }
+        const now = Date.now();
+        const valid = {};
+        for (const [host, ts] of Object.entries(wrapper.entries)) {
+            if (now - ts < 7 * 24 * 60 * 60 * 1000) {
+                dynamicPassedHosts.add(host);
+                valid[host] = ts;
+            }
         }
+        localStorage.setItem(DYNAMIC_PASSED_HOSTS_KEY, JSON.stringify({ version: STORAGE_VERSION, entries: valid }));
+    }
+    catch (e) {
+        if (DEBUG)
+            console.warn("Failed to parse dynamicPassedHosts:", e);
+        localStorage.removeItem(DYNAMIC_PASSED_HOSTS_KEY);
     }
 })();
 // Override add() to persist updates to localStorage
 const originalExcludedAdd = dynamicExcludedHosts.add;
 dynamicExcludedHosts.add = (host) => {
     const cleanedHost = host?.trim();
-    if (!cleanedHost) {
+    if (!cleanedHost || dynamicExcludedHosts.has(cleanedHost)) {
         return dynamicExcludedHosts;
     }
     originalExcludedAdd.call(dynamicExcludedHosts, cleanedHost);
-    localStorage.setItem(DYNAMIC_EXCLUDED_HOSTS_KEY, JSON.stringify(Array.from(dynamicExcludedHosts)));
+    try {
+        // read existing map or start fresh
+        const stored = localStorage.getItem(DYNAMIC_EXCLUDED_HOSTS_KEY);
+        const obj = stored ? JSON.parse(stored) : {};
+        obj[cleanedHost] = Date.now();
+        localStorage.setItem(DYNAMIC_EXCLUDED_HOSTS_KEY, JSON.stringify(obj));
+    }
+    catch (e) {
+        if (DEBUG)
+            console.warn("Persist dynamicExcludedHosts failed:", e);
+    }
     updateExcludedHostsStorageAndBackend(dynamicExcludedHosts);
     return dynamicExcludedHosts;
 };
 const originalPassedAdd = dynamicPassedHosts.add;
+// === UPDATED: override to store timestamp on add (passed hosts) ===
 dynamicPassedHosts.add = (host) => {
     const cleanedHost = host?.trim();
     if (!cleanedHost) {
         return dynamicPassedHosts;
     }
+    // If we already have it, just return
+    if (dynamicPassedHosts.has(cleanedHost)) {
+        return dynamicPassedHosts;
+    }
     originalPassedAdd.call(dynamicPassedHosts, cleanedHost);
-    localStorage.setItem(DYNAMIC_PASSED_HOSTS_KEY, JSON.stringify(Array.from(dynamicPassedHosts)));
+    // Persist a host->timestamp map
+    try {
+        const stored = localStorage.getItem(DYNAMIC_PASSED_HOSTS_KEY);
+        const obj = stored ? JSON.parse(stored) : {};
+        obj[cleanedHost] = Date.now();
+        localStorage.setItem(DYNAMIC_PASSED_HOSTS_KEY, JSON.stringify(obj));
+    }
+    catch (e) {
+        if (DEBUG)
+            console.warn("Persist dynamicPassedHosts failed:", e);
+    }
     return dynamicPassedHosts;
 };
 const ActionType = {
@@ -197,7 +254,10 @@ function getOrSetUserDeviceUuid() {
     let userDeviceUuid = localStorage.getItem("sailfishUserDeviceUuid");
     if (!userDeviceUuid) {
         userDeviceUuid = uuidv4();
-        localStorage.setItem("sailfishUserDeviceUuid", userDeviceUuid);
+        try {
+            localStorage.setItem("sailfishUserDeviceUuid", userDeviceUuid);
+        }
+        catch { }
     }
     return userDeviceUuid;
 }
@@ -315,16 +375,12 @@ function shouldSkipHeadersPropagation(url, domainsToNotPropagateHeadersTo = [])
 function performOptionsPreflightForXHR(url, init, xSf3RidHeaderValue, domain) {
     return new Promise((resolve) => {
         const xhr = new XMLHttpRequest();
-        xhr.open("OPTIONS", url, true);
-        // Mirror credentials
+        xhr.open(OPTIONS, url, true);
         xhr.withCredentials = init.credentials === INCLUDE;
-        // CORS preflight headers
-        const method = (init.method || "GET").toUpperCase();
-        xhr.setRequestHeader("Access-Control-Request-Method", method);
-        const rawHeaders = init.headers instanceof Headers
-            ? Object.entries(init.headers)
-            : init.headers || {};
-        const customHeaders = Object.keys(rawHeaders)
+        // Normalize headers into a standard Headers instance
+        const headerEntries = new Headers(init.headers || {});
+        const rawKeys = Array.from(headerEntries.keys());
+        const customHeaders = rawKeys
             .map((h) => h.toLowerCase())
             .filter((h) => ![
             "accept",
@@ -335,11 +391,25 @@ function performOptionsPreflightForXHR(url, init, xSf3RidHeaderValue, domain) {
         if (customHeaders.length) {
             xhr.setRequestHeader("Access-Control-Request-Headers", customHeaders.join(","));
         }
-        // Add tracing header
-        this.setRequestHeader(xSf3RidHeader, xSf3RidHeaderValue);
+        // Set the CORS preflight method header
+        xhr.setRequestHeader("Access-Control-Request-Method", (init.method || "GET").toUpperCase());
+        // Correctly add the tracing header to the XHR instance
+        xhr.setRequestHeader(xSf3RidHeader, xSf3RidHeaderValue);
         xhr.onload = () => {
             if (xhr.status >= 200 && xhr.status < 300) {
-                resolve(ActionType.PROPAGATE);
+                const allowed = xhr.getResponseHeader(ALLOWED_HEADERS_HEADER);
+                if (allowed &&
+                    allowed
+                        .split(",")
+                        .map((h) => h.trim().toLowerCase())
+                        .includes(xSf3RidHeader.toLowerCase())) {
+                    resolve(ActionType.PROPAGATE);
+                }
+                else {
+                    DEBUG &&
+                        console.log(`[XHR Interceptor] Header ${xSf3RidHeader} not allowed by preflight for ${domain}`);
+                    resolve(ActionType.IGNORE);
+                }
             }
             else {
                 DEBUG &&
@@ -401,19 +471,26 @@ function setupXMLHttpRequestInterceptor(domainsToNotPropagateHeaderTo = []) {
                     console.warn(`Could not set X-Sf3-Rid header for ${url}`, e);
                 }
             }
-            // On CORS or network error during send, add domain to passed-hosts list
-            this.addEventListener("error", () => {
+            // On CORS or network error during send, log it and add to excluded-hosts
+            this.addEventListener("error", (evt) => {
+                console.error(`[XHR Interceptor] Network error for ${domain} (${url}):`, evt, `status=${this.status}`, `statusText=${this.statusText}`);
                 dynamicExcludedHosts.add(domain);
             }, { once: true });
-            // On successful send (HTTP 2xx), add domain to passed-hosts list
+            // On load, log non-2xx statuses (including CORS-blocked status=0) and track passes
             this.addEventListener("load", () => {
                 if (this.status === 0) {
-                    // status 0 on load is often a CORS‐blocked response
+                    DEBUG &&
+                        console.error(`[XHR Interceptor] CORS blocked (status=0) for ${domain} (${url})`, `statusText=${this.statusText}`);
                     dynamicExcludedHosts.add(domain);
                 }
-                if (this.status >= 200 && this.status < 300) {
+                else if (this.status >= 200 && this.status < 300) {
                     dynamicPassedHosts.add(domain);
                 }
+                else {
+                    DEBUG &&
+                        console.error(`[XHR Interceptor] HTTP error ${this.status} ${this.statusText} for ${domain} (${url})`);
+                    dynamicExcludedHosts.add(domain);
+                }
             }, { once: true });
             return originalSend.apply(this, args);
         };
@@ -447,37 +524,44 @@ function setupXMLHttpRequestInterceptor(domainsToNotPropagateHeaderTo = []) {
 }
 /**
  * Performs an OPTIONS preflight check to decide header propagation.
- * Returns 'propagate' if OPTIONS succeeds, 'ignore' otherwise.
+ * Returns PROPAGATE if both header & method are allowed, IGNORE if disallowed
+ * or on a CORS error, null if OPTIONS returned non-2xx.
  */
 async function performOptionsPreflight(target, thisArg, url, init, sessionId, domain) {
     try {
         const headers = new Headers(init.headers || {});
         headers.set(xSf3RidHeader, sessionId);
-        const response = await target.call(thisArg, url, {
-            method: "OPTIONS",
+        const opts = {
+            method: OPTIONS,
             headers,
-        });
-        if (response.ok) {
-            return ActionType.PROPAGATE;
-        }
-        else {
+            mode: "cors",
+            credentials: init.credentials || SAME_ORIGIN,
+        };
+        const response = await target.call(thisArg, url, opts);
+        if (!response.ok) {
             DEBUG &&
                 console.log(`[Fetch Interceptor] OPTIONS returned status ${response.status} for ${domain}`);
             return null;
         }
+        // 1️⃣ Check that our header is allowed
+        const allowedHeaders = response.headers
+            .get(ALLOWED_HEADERS_HEADER)
+            ?.split(",")
+            .map((h) => h.trim().toLowerCase()) || [];
+        if (!allowedHeaders.includes(xSf3RidHeader.toLowerCase())) {
+            DEBUG &&
+                console.log(`[Fetch Interceptor] Header ${xSf3RidHeader} not allowed by preflight for ${domain}`);
+            return ActionType.IGNORE;
+        }
+        return ActionType.PROPAGATE;
     }
     catch (error) {
-        // Treat fetch errors (likely CORS failures) as ignore
-        if (error instanceof TypeError || error?.message?.includes(CORS_KEYWORD)) {
+        if (error instanceof TypeError &&
+            error.message.toLowerCase().includes(CORS_KEYWORD.toLowerCase())) {
             DEBUG &&
                 console.log(`[Fetch Interceptor] Preflight OPTIONS CORS error for ${domain}:`, error);
             return ActionType.IGNORE;
         }
-        // Other failures also ignored as some APIs or reverse proxies (e.g. NGINX) don’t route
-        // or handle OPTIONS requests, leading to:
-        // * 404 Not Found
-        // * 405 Method Not Allowed
-        // * 500 Internal Server Error
         DEBUG &&
             console.log(`[Fetch Interceptor] Preflight OPTIONS failed for ${domain}:`, error);
         return null;
@@ -487,7 +571,7 @@ async function performOptionsPreflight(target, thisArg, url, init, sessionId, do
 function setupFetchInterceptor(domainsToNotPropagateHeadersTo = []) {
     const originalFetch = window.fetch;
     const sessionId = getOrSetSessionId();
-    const cache = new Map();
+    const cachedDomains = new Map();
     window.fetch = new Proxy(originalFetch, {
         apply: async (target, thisArg, args) => {
             let input = args[0];
@@ -508,8 +592,8 @@ function setupFetchInterceptor(domainsToNotPropagateHeadersTo = []) {
             // Determine the target domain
             const domain = new URL(url, window.location.href).hostname;
             // Use cached decision if available
-            if (cache.has(domain)) {
-                const decision = cache.get(domain);
+            if (cachedDomains.has(domain)) {
+                const decision = cachedDomains.get(domain);
                 if (decision === ActionType.IGNORE) {
                     return target.apply(thisArg, args);
                 }
@@ -519,7 +603,7 @@ function setupFetchInterceptor(domainsToNotPropagateHeadersTo = []) {
             }
             // Check exclusion domains and cache 'ignore'
             if (shouldSkipHeadersPropagation(url, domainsToNotPropagateHeadersTo)) {
-                cache.set(domain, ActionType.IGNORE);
+                cachedDomains.set(domain, ActionType.IGNORE);
                 return target.apply(thisArg, args);
             }
             let decision = ActionType.PROPAGATE;
@@ -533,7 +617,7 @@ function setupFetchInterceptor(domainsToNotPropagateHeadersTo = []) {
                     dynamicExcludedHosts.add(domain);
                 }
             }
-            cache.set(domain, decision);
+            cachedDomains.set(domain, decision);
             if (decision === ActionType.PROPAGATE) {
                 return injectHeaderWrapper(target, thisArg, args, input, init, sessionId, url);
             }
@@ -595,8 +679,8 @@ function setupFetchInterceptor(domainsToNotPropagateHeadersTo = []) {
                 const errorMessage = error.message || "Fetch request failed";
                 // Treat fetch errors (likely CORS failures) as ignore
                 // Since some APIs or reverse proxies (such as NGINX) do not route or handle OPTIONS requests, CORS may occur while the request is being made.
-                if (error instanceof TypeError ||
-                    error?.message?.includes(CORS_KEYWORD)) {
+                if (error instanceof TypeError &&
+                    error?.message?.toLowerCase().includes(CORS_KEYWORD.toLowerCase())) {
                     DEBUG &&
                         console.log(`[Fetch Interceptor] CORS error for ${domain}:`, error);
                     dynamicExcludedHosts.add(domain);
@@ -654,23 +738,44 @@ function setupFetchInterceptor(domainsToNotPropagateHeadersTo = []) {
     async function retryWithoutPropagateHeaders(target, thisArg, args, url) {
         const domain = new URL(url).hostname;
         try {
-            // Retry the fetch without the header
-            // const retryResponse = await originalFetch(retryRequest);
-            const response = target.apply(thisArg, args);
-            // Check if retry succeeded (no network error thrown, and not a 400/403 response)
-            if (response.ok || !BAD_HTTP_STATUS.includes(response.status)) {
-                // Mark this domain to exclude the header going forward without header
-                dynamicExcludedHosts.add(domain);
-                cache.set(domain, ActionType.IGNORE); // mark domain as 'ignore' in the cache
-                // Log the original failure and the successful retry
-                console.info(`Retried request to ${url} without ${xSf3RidHeader} succeeded. ` +
-                    `Added "${domain}" to header exclusion lists.`);
+            // **Fix:** Properly await and clone the request without the tracing header
+            let input = args[0];
+            let init = args[1] || {};
+            if (typeof input === "string" || input instanceof URL) {
+                const retryInit = { ...init };
+                const retryHeaders = new Headers(init.headers || {});
+                retryHeaders.delete(xSf3RidHeader);
+                retryInit.headers = retryHeaders;
+                const response = await target.call(thisArg, input, retryInit);
+                if (response.ok || !BAD_HTTP_STATUS.includes(response.status)) {
+                    dynamicExcludedHosts.add(domain);
+                    cachedDomains.set(domain, ActionType.IGNORE);
+                    DEBUG &&
+                        console.info(`Retried request to ${url} without ${xSf3RidHeader} succeeded. Added "${domain}" to exclusion list.`);
+                }
+                return response;
+            }
+            else if (input instanceof Request) {
+                const original = input;
+                const cloned = original.clone();
+                const retryHeaders = new Headers(cloned.headers);
+                retryHeaders.delete(xSf3RidHeader);
+                const retryReq = new Request(cloned, { headers: retryHeaders });
+                const response = await target.call(thisArg, retryReq, init);
+                if (response.ok || !BAD_HTTP_STATUS.includes(response.status)) {
+                    dynamicExcludedHosts.add(domain);
+                    cachedDomains.set(domain, ActionType.IGNORE);
+                    DEBUG &&
+                        console.info(`Retried request to ${url} without ${xSf3RidHeader} succeeded. Added "${domain}" to exclusion list.`);
+                }
+                return response;
+            }
+            else {
+                // Fallback
+                return target.apply(thisArg, args);
             }
-            // Return the response from the retry attempt (successful or not)
-            return response;
         }
         catch (retryError) {
-            // Propagate the failure (no domain added to exclude lists since retry failed)
             DEBUG &&
                 console.log(`Retry without ${xSf3RidHeader} for ${url} also failed:`, retryError);
             throw retryError;
@@ -689,13 +794,19 @@ export async function startRecording({ apiKey, backendApi = "https://api-service
         host?.trim() && originalExcludedAdd.call(dynamicExcludedHosts, host);
     });
     // Persist updated excluded hosts to localStorage
-    localStorage.setItem(DYNAMIC_EXCLUDED_HOSTS_KEY, JSON.stringify(Array.from(dynamicExcludedHosts)));
+    try {
+        localStorage.setItem(DYNAMIC_EXCLUDED_HOSTS_KEY, JSON.stringify(Array.from(dynamicExcludedHosts)));
+    }
+    catch { }
     // Add provided domainsToPropagateHeaderTo to dynamicPassedHosts
     domainsToPropagateHeaderTo.forEach((host) => {
         originalPassedAdd.call(dynamicPassedHosts, host);
     });
     // Persist updated included hosts to localStorage
-    localStorage.setItem(DYNAMIC_PASSED_HOSTS_KEY, JSON.stringify(Array.from(dynamicPassedHosts)));
+    try {
+        localStorage.setItem(DYNAMIC_PASSED_HOSTS_KEY, JSON.stringify(Array.from(dynamicPassedHosts)));
+    }
+    catch { }
     // Non-blocking GraphQL request to send the domains if provided
     if (dynamicExcludedHosts.size > 0) {
         sendDomainsToNotPropagateHeaderTo(apiKey, [...dynamicExcludedHosts, ...DOMAINS_TO_NOT_PROPAGATE_HEADER_TO_DEFAULT], backendApi).catch((error) => console.error("Failed to send domains to not propagate header to:", error));
@@ -703,8 +814,8 @@ export async function startRecording({ apiKey, backendApi = "https://api-service
     sessionStorage.setItem(SF_API_KEY_FOR_UPDATE, apiKey);
     sessionStorage.setItem(SF_BACKEND_API, backendApi);
     // Setup interceptors with custom ignore and propagate domains
-    setupXMLHttpRequestInterceptor(domainsToPropagateHeaderTo);
-    setupFetchInterceptor(domainsToPropagateHeaderTo);
+    setupXMLHttpRequestInterceptor(domainsToNotPropagateHeaderTo);
+    setupFetchInterceptor(domainsToNotPropagateHeaderTo);
     gatherAndCacheDeviceInfo();
     try {
         const captureSettingsResponse = await fetchCaptureSettings(apiKey, backendApi);