@scalebun/react-native 1.0.0 → 1.0.2

package/src/debug/redaction.ts

@@ -1,290 +1,290 @@
-/**
- * ScaleBun Debug — Security Redaction & PII Detection
- *
- * Ensures sensitive data is never sent over the debug transport.
- * All functions return new objects (never mutate originals).
- * All functions are no-throw safe.
- */
-
-// ─── Constants ──────────────────────────────────────────────────────────────
-
-const REDACTED = '[REDACTED]';
-
-/** Headers that must always be redacted (case-insensitive) */
-const SENSITIVE_HEADERS = new Set([
-    'authorization',
-    'cookie',
-    'set-cookie',
-    'x-api-key',
-    'x-auth-token',
-    'proxy-authorization',
-]);
-
-/** PII detection patterns */
-const PII_PATTERNS: Array<{ name: string; pattern: RegExp }> = [
-    { name: 'email', pattern: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g },
-    { name: 'phone', pattern: /(?:\+?\d{1,3}[-.\s]?)?\(?\d{2,4}\)?[-.\s]?\d{3,4}[-.\s]?\d{3,4}/g },
-    { name: 'ssn', pattern: /\b\d{3}-\d{2}-\d{4}\b/g },
-    { name: 'credit_card', pattern: /\b\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b/g },
-    { name: 'ip_address', pattern: /\b(?:\d{1,3}\.){3}\d{1,3}\b/g },
-];
-
-/** Keys in request/response bodies that likely contain sensitive data */
-const SENSITIVE_BODY_KEYS = new Set([
-    'password',
-    'passwd',
-    'secret',
-    'token',
-    'access_token',
-    'refresh_token',
-    'api_key',
-    'apiKey',
-    'private_key',
-    'privateKey',
-    'credit_card',
-    'creditCard',
-    'ccNumber',
-    'cvv',
-    'ssn',
-    'social_security',
-]);
-
-// ─── Header Redaction ───────────────────────────────────────────────────────
-
-/**
- * Redact sensitive HTTP headers. Returns a new object with redacted values.
- * Original headers object is not mutated.
- */
-export function redactHeaders(
-    headers: Record<string, string> | undefined,
-): Record<string, string> {
-    if (!headers) return {};
-    const result: Record<string, string> = {};
-    try {
-        for (const [key, value] of Object.entries(headers)) {
-            if (SENSITIVE_HEADERS.has(key.toLowerCase())) {
-                result[key] = REDACTED;
-            } else {
-                result[key] = value;
-            }
-        }
-    } catch {
-        // If iteration fails, return empty — never throw
-    }
-    return result;
-}
-
-// ─── Body Redaction ─────────────────────────────────────────────────────────
-
-/**
- * Deep-redact sensitive keys in a body object. Returns a new object.
- * Handles nested objects and arrays. Never throws.
- */
-export function redactBody(body: unknown, maxDepth = 10): unknown {
-    try {
-        return _redactValue(body, 0, maxDepth);
-    } catch {
-        return REDACTED;
-    }
-}
-
-function _redactValue(value: unknown, depth: number, maxDepth: number): unknown {
-    if (depth > maxDepth) return '[MAX_DEPTH]';
-    if (value === null || value === undefined) return value;
-
-    if (typeof value === 'string') {
-        // Don't deeply redact strings at the value level here,
-        // PII scanning is a separate concern
-        return value;
-    }
-
-    if (Array.isArray(value)) {
-        return value.map(item => _redactValue(item, depth + 1, maxDepth));
-    }
-
-    if (typeof value === 'object') {
-        const result: Record<string, unknown> = {};
-        for (const [key, val] of Object.entries(value as Record<string, unknown>)) {
-            if (SENSITIVE_BODY_KEYS.has(key) || SENSITIVE_BODY_KEYS.has(key.toLowerCase())) {
-                result[key] = REDACTED;
-            } else {
-                result[key] = _redactValue(val, depth + 1, maxDepth);
-            }
-        }
-        return result;
-    }
-
-    return value;
-}
-
-// ─── PII Scanning ───────────────────────────────────────────────────────────
-
-export interface PIIWarning {
-    type: string;
-    match: string;
-    /** Where in the data the PII was found */
-    location: string;
-}
-
-/**
- * Scan a string for PII patterns. Returns list of warnings.
- * Never throws.
- */
-export function scanForPII(text: string, location = 'unknown'): PIIWarning[] {
-    const warnings: PIIWarning[] = [];
-    try {
-        for (const { name, pattern } of PII_PATTERNS) {
-            // Reset regex state
-            pattern.lastIndex = 0;
-            let match = pattern.exec(text);
-            while (match) {
-                warnings.push({
-                    type: name,
-                    match: _maskPII(match[0]),
-                    location,
-                });
-                match = pattern.exec(text);
-            }
-        }
-    } catch {
-        // Never throw — return whatever we found so far
-    }
-    return warnings;
-}
-
-/**
- * Scan an object deeply for PII. Returns list of warnings.
- * Never throws.
- */
-export function scanObjectForPII(
-    obj: unknown,
-    basePath = '',
-    maxDepth = 10,
-): PIIWarning[] {
-    const warnings: PIIWarning[] = [];
-    try {
-        _scanObject(obj, basePath, 0, maxDepth, warnings);
-    } catch {
-        // Never throw
-    }
-    return warnings;
-}
-
-function _scanObject(
-    value: unknown,
-    path: string,
-    depth: number,
-    maxDepth: number,
-    warnings: PIIWarning[],
-): void {
-    if (depth > maxDepth || value === null || value === undefined) return;
-
-    if (typeof value === 'string') {
-        const found = scanForPII(value, path);
-        warnings.push(...found);
-        return;
-    }
-
-    if (Array.isArray(value)) {
-        value.forEach((item, i) => {
-            _scanObject(item, `${path}[${i}]`, depth + 1, maxDepth, warnings);
-        });
-        return;
-    }
-
-    if (typeof value === 'object') {
-        for (const [key, val] of Object.entries(value as Record<string, unknown>)) {
-            _scanObject(val, path ? `${path}.${key}` : key, depth + 1, maxDepth, warnings);
-        }
-    }
-}
-
-/**
- * Mask PII for display — show first/last chars only.
- * e.g. "john@example.com" -> "jo***com"
- */
-function _maskPII(value: string): string {
-    if (value.length <= 4) return '***';
-    return value.slice(0, 2) + '***' + value.slice(-3);
-}
-
-// ─── URL Redaction ──────────────────────────────────────────────────────────
-
-/**
- * Redact query parameters that may contain tokens/secrets.
- * Never throws.
- */
-export function redactUrl(url: string): string {
-    try {
-        const sensitiveParams = new Set([
-            'token', 'access_token', 'refresh_token',
-            'api_key', 'apiKey', 'key', 'secret', 'password',
-        ]);
-
-        const parsed = new URL(url);
-        for (const param of sensitiveParams) {
-            if (parsed.searchParams.has(param)) {
-                parsed.searchParams.set(param, REDACTED);
-            }
-        }
-        return parsed.toString();
-    } catch {
-        // If URL parsing fails, return as-is
-        return url;
-    }
-}
-
-// ─── Full Redaction Pipeline ────────────────────────────────────────────────
-
-export interface RedactedNetworkEvent {
-    url: string;
-    method: string;
-    status: number;
-    duration: number;
-    requestHeaders: Record<string, string>;
-    responseHeaders: Record<string, string>;
-    requestBody: unknown;
-    responseBody: unknown;
-    piiWarnings: PIIWarning[];
-}
-
-/**
- * Apply full redaction pipeline to a network event.
- */
-export function redactNetworkEvent(event: {
-    url?: string;
-    method?: string;
-    status?: number;
-    duration?: number;
-    requestHeaders?: Record<string, string>;
-    responseHeaders?: Record<string, string>;
-    requestBody?: unknown;
-    responseBody?: unknown;
-}): RedactedNetworkEvent {
-    const piiWarnings: PIIWarning[] = [];
-
-    // Scan URL for PII
-    if (event.url) {
-        piiWarnings.push(...scanForPII(event.url, 'url'));
-    }
-
-    // Scan bodies for PII
-    if (event.requestBody) {
-        piiWarnings.push(...scanObjectForPII(event.requestBody, 'requestBody'));
-    }
-    if (event.responseBody) {
-        piiWarnings.push(...scanObjectForPII(event.responseBody, 'responseBody'));
-    }
-
-    return {
-        url: event.url ? redactUrl(event.url) : '',
-        method: event.method ?? 'GET',
-        status: event.status ?? 0,
-        duration: event.duration ?? 0,
-        requestHeaders: redactHeaders(event.requestHeaders),
-        responseHeaders: redactHeaders(event.responseHeaders),
-        requestBody: redactBody(event.requestBody),
-        responseBody: redactBody(event.responseBody),
-        piiWarnings,
-    };
-}
+/**
+ * ScaleBun Debug — Security Redaction & PII Detection
+ *
+ * Ensures sensitive data is never sent over the debug transport.
+ * All functions return new objects (never mutate originals).
+ * All functions are no-throw safe.
+ */
+
+// ─── Constants ──────────────────────────────────────────────────────────────
+
+const REDACTED = '[REDACTED]';
+
+/** Headers that must always be redacted (case-insensitive) */
+const SENSITIVE_HEADERS = new Set([
+    'authorization',
+    'cookie',
+    'set-cookie',
+    'x-api-key',
+    'x-auth-token',
+    'proxy-authorization',
+]);
+
+/** PII detection patterns */
+const PII_PATTERNS: Array<{ name: string; pattern: RegExp }> = [
+    { name: 'email', pattern: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g },
+    { name: 'phone', pattern: /(?:\+?\d{1,3}[-.\s]?)?\(?\d{2,4}\)?[-.\s]?\d{3,4}[-.\s]?\d{3,4}/g },
+    { name: 'ssn', pattern: /\b\d{3}-\d{2}-\d{4}\b/g },
+    { name: 'credit_card', pattern: /\b\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b/g },
+    { name: 'ip_address', pattern: /\b(?:\d{1,3}\.){3}\d{1,3}\b/g },
+];
+
+/** Keys in request/response bodies that likely contain sensitive data */
+const SENSITIVE_BODY_KEYS = new Set([
+    'password',
+    'passwd',
+    'secret',
+    'token',
+    'access_token',
+    'refresh_token',
+    'api_key',
+    'apiKey',
+    'private_key',
+    'privateKey',
+    'credit_card',
+    'creditCard',
+    'ccNumber',
+    'cvv',
+    'ssn',
+    'social_security',
+]);
+
+// ─── Header Redaction ───────────────────────────────────────────────────────
+
+/**
+ * Redact sensitive HTTP headers. Returns a new object with redacted values.
+ * Original headers object is not mutated.
+ */
+export function redactHeaders(
+    headers: Record<string, string> | undefined,
+): Record<string, string> {
+    if (!headers) return {};
+    const result: Record<string, string> = {};
+    try {
+        for (const [key, value] of Object.entries(headers)) {
+            if (SENSITIVE_HEADERS.has(key.toLowerCase())) {
+                result[key] = REDACTED;
+            } else {
+                result[key] = value;
+            }
+        }
+    } catch {
+        // If iteration fails, return empty — never throw
+    }
+    return result;
+}
+
+// ─── Body Redaction ─────────────────────────────────────────────────────────
+
+/**
+ * Deep-redact sensitive keys in a body object. Returns a new object.
+ * Handles nested objects and arrays. Never throws.
+ */
+export function redactBody(body: unknown, maxDepth = 10): unknown {
+    try {
+        return _redactValue(body, 0, maxDepth);
+    } catch {
+        return REDACTED;
+    }
+}
+
+function _redactValue(value: unknown, depth: number, maxDepth: number): unknown {
+    if (depth > maxDepth) return '[MAX_DEPTH]';
+    if (value === null || value === undefined) return value;
+
+    if (typeof value === 'string') {
+        // Don't deeply redact strings at the value level here,
+        // PII scanning is a separate concern
+        return value;
+    }
+
+    if (Array.isArray(value)) {
+        return value.map(item => _redactValue(item, depth + 1, maxDepth));
+    }
+
+    if (typeof value === 'object') {
+        const result: Record<string, unknown> = {};
+        for (const [key, val] of Object.entries(value as Record<string, unknown>)) {
+            if (SENSITIVE_BODY_KEYS.has(key) || SENSITIVE_BODY_KEYS.has(key.toLowerCase())) {
+                result[key] = REDACTED;
+            } else {
+                result[key] = _redactValue(val, depth + 1, maxDepth);
+            }
+        }
+        return result;
+    }
+
+    return value;
+}
+
+// ─── PII Scanning ───────────────────────────────────────────────────────────
+
+export interface PIIWarning {
+    type: string;
+    match: string;
+    /** Where in the data the PII was found */
+    location: string;
+}
+
+/**
+ * Scan a string for PII patterns. Returns list of warnings.
+ * Never throws.
+ */
+export function scanForPII(text: string, location = 'unknown'): PIIWarning[] {
+    const warnings: PIIWarning[] = [];
+    try {
+        for (const { name, pattern } of PII_PATTERNS) {
+            // Reset regex state
+            pattern.lastIndex = 0;
+            let match = pattern.exec(text);
+            while (match) {
+                warnings.push({
+                    type: name,
+                    match: _maskPII(match[0]),
+                    location,
+                });
+                match = pattern.exec(text);
+            }
+        }
+    } catch {
+        // Never throw — return whatever we found so far
+    }
+    return warnings;
+}
+
+/**
+ * Scan an object deeply for PII. Returns list of warnings.
+ * Never throws.
+ */
+export function scanObjectForPII(
+    obj: unknown,
+    basePath = '',
+    maxDepth = 10,
+): PIIWarning[] {
+    const warnings: PIIWarning[] = [];
+    try {
+        _scanObject(obj, basePath, 0, maxDepth, warnings);
+    } catch {
+        // Never throw
+    }
+    return warnings;
+}
+
+function _scanObject(
+    value: unknown,
+    path: string,
+    depth: number,
+    maxDepth: number,
+    warnings: PIIWarning[],
+): void {
+    if (depth > maxDepth || value === null || value === undefined) return;
+
+    if (typeof value === 'string') {
+        const found = scanForPII(value, path);
+        warnings.push(...found);
+        return;
+    }
+
+    if (Array.isArray(value)) {
+        value.forEach((item, i) => {
+            _scanObject(item, `${path}[${i}]`, depth + 1, maxDepth, warnings);
+        });
+        return;
+    }
+
+    if (typeof value === 'object') {
+        for (const [key, val] of Object.entries(value as Record<string, unknown>)) {
+            _scanObject(val, path ? `${path}.${key}` : key, depth + 1, maxDepth, warnings);
+        }
+    }
+}
+
+/**
+ * Mask PII for display — show first/last chars only.
+ * e.g. "john@example.com" -> "jo***com"
+ */
+function _maskPII(value: string): string {
+    if (value.length <= 4) return '***';
+    return value.slice(0, 2) + '***' + value.slice(-3);
+}
+
+// ─── URL Redaction ──────────────────────────────────────────────────────────
+
+/**
+ * Redact query parameters that may contain tokens/secrets.
+ * Never throws.
+ */
+export function redactUrl(url: string): string {
+    try {
+        const sensitiveParams = new Set([
+            'token', 'access_token', 'refresh_token',
+            'api_key', 'apiKey', 'key', 'secret', 'password',
+        ]);
+
+        const parsed = new URL(url);
+        for (const param of sensitiveParams) {
+            if (parsed.searchParams.has(param)) {
+                parsed.searchParams.set(param, REDACTED);
+            }
+        }
+        return parsed.toString();
+    } catch {
+        // If URL parsing fails, return as-is
+        return url;
+    }
+}
+
+// ─── Full Redaction Pipeline ────────────────────────────────────────────────
+
+export interface RedactedNetworkEvent {
+    url: string;
+    method: string;
+    status: number;
+    duration: number;
+    requestHeaders: Record<string, string>;
+    responseHeaders: Record<string, string>;
+    requestBody: unknown;
+    responseBody: unknown;
+    piiWarnings: PIIWarning[];
+}
+
+/**
+ * Apply full redaction pipeline to a network event.
+ */
+export function redactNetworkEvent(event: {
+    url?: string;
+    method?: string;
+    status?: number;
+    duration?: number;
+    requestHeaders?: Record<string, string>;
+    responseHeaders?: Record<string, string>;
+    requestBody?: unknown;
+    responseBody?: unknown;
+}): RedactedNetworkEvent {
+    const piiWarnings: PIIWarning[] = [];
+
+    // Scan URL for PII
+    if (event.url) {
+        piiWarnings.push(...scanForPII(event.url, 'url'));
+    }
+
+    // Scan bodies for PII
+    if (event.requestBody) {
+        piiWarnings.push(...scanObjectForPII(event.requestBody, 'requestBody'));
+    }
+    if (event.responseBody) {
+        piiWarnings.push(...scanObjectForPII(event.responseBody, 'responseBody'));
+    }
+
+    return {
+        url: event.url ? redactUrl(event.url) : '',
+        method: event.method ?? 'GET',
+        status: event.status ?? 0,
+        duration: event.duration ?? 0,
+        requestHeaders: redactHeaders(event.requestHeaders),
+        responseHeaders: redactHeaders(event.responseHeaders),
+        requestBody: redactBody(event.requestBody),
+        responseBody: redactBody(event.responseBody),
+        piiWarnings,
+    };
+}