@scalebun/react-native 1.0.2 → 1.0.3

package/src/integrations/xhr/xhrInterceptor.ts

@@ -1,231 +1,231 @@
-/**
- * ScaleBun SDK — XHR Interceptor
- *
- * Monkey-patches `XMLHttpRequest` to capture network events.
- *
- * When `captureNetworkBodies` is enabled:
- *   - Request headers: shimmed via `setRequestHeader` to record headers
- *     before `send()` is called.
- *   - Response headers: parsed from `getAllResponseHeaders()` in the `load`
- *     handler.
- *   - Request body: captured from the `send(body)` argument (strings only;
- *     FormData / ArrayBuffer etc. get a placeholder).
- *   - Response body: read from `xhr.responseText` after the response
- *     arrives, truncated to `networkBodyMaxBytes`. Binary content-types
- *     are skipped.
- *   - All headers and bodies pass through `redactNetworkEvent` when
- *     `redactNetwork` is true.
- *
- * ⚠️  PRIVACY: Body capture is opt-in via `captureNetworkBodies: true`.
- * The integrator is responsible for compliance with applicable privacy
- * regulations (GDPR, CCPA, etc.) and their own privacy policy.
- *
- * Scope: JS-host (XHR) only.
- * Native-layer capture (OkHttp / URLSession) is a separate future task.
- */
-
-import { noThrow } from '../../core/lifecycle/crashSafe';
-import { logger } from '../../core/logger/internalLogger';
-import {
-    extractRequestBody,
-    extractResponseBodyFromXHR,
-    parseXHRResponseHeaders,
-    requestBodyBytes,
-    contentLengthBytes,
-    DEFAULT_BODY_MAX_BYTES,
-} from '../network/bodyCapture';
-import { redactNetworkEvent } from '../../debug/redaction';
-
-// ─── Config ───────────────────────────────────────────────────────────────────
-
-export interface XHRInterceptorOptions {
-    /** Capture request/response headers and bodies. Default: false */
-    captureNetworkBodies?: boolean;
-    /** Max bytes to capture per body before truncating. Default: 65536 */
-    networkBodyMaxBytes?: number;
-    /** Apply redaction pipeline to captured headers/bodies. Default: true (fail closed) */
-    redactNetwork?: boolean;
-}
-
-// ─── Interceptor ─────────────────────────────────────────────────────────────
-
-export function installXHRInterceptor(
-    onEvent: (data: any) => void,
-    options: XHRInterceptorOptions = {},
-): void {
-    noThrow(() => {
-        const XMLHttpRequest = (globalThis as any).XMLHttpRequest;
-        if (!XMLHttpRequest) {
-            logger.warn('XMLHttpRequest not found, skipping interceptor');
-            return;
-        }
-
-        const captureBodies = options.captureNetworkBodies ?? false;
-        const maxBytes = options.networkBodyMaxBytes ?? DEFAULT_BODY_MAX_BYTES;
-        // Privacy fails CLOSED: redaction is on unless explicitly opted out.
-        const shouldRedact = options.redactNetwork ?? true;
-
-        const originalOpen = XMLHttpRequest.prototype.open;
-        const originalSend = XMLHttpRequest.prototype.send;
-        const originalSetRequestHeader = XMLHttpRequest.prototype.setRequestHeader;
-
-        // ── open(): record method + URL + reset captured headers ───────────
-        XMLHttpRequest.prototype.open = function (method: string, url: string) {
-            this._scalebun_method = method.toUpperCase();
-            this._scalebun_url = url;
-            this._scalebun_start = Date.now();
-            // Reset per-request state
-            this._scalebun_requestHeaders = {};
-            return originalOpen.apply(this, arguments as any);
-        };
-
-        // ── setRequestHeader(): accumulate request headers (if capturing) ──
-        XMLHttpRequest.prototype.setRequestHeader = function (name: string, value: string) {
-            if (captureBodies && this._scalebun_requestHeaders !== undefined) {
-                // Lowercase keys for consistency with fetch header convention
-                this._scalebun_requestHeaders[name.toLowerCase()] = value;
-            }
-            return originalSetRequestHeader.apply(this, arguments as any);
-        };
-
-        // ── send(): capture request body + wire load/error handlers ────────
-        XMLHttpRequest.prototype.send = function (body?: any) {
-            // Byte count is non-PII → always measured (independent of body capture).
-            this._scalebun_requestSize = requestBodyBytes(body);
-
-            // Capture request body synchronously before send
-            let requestBody: unknown | undefined;
-            if (captureBodies) {
-                requestBody = extractRequestBody(body);
-                this._scalebun_requestBody = requestBody;
-            }
-
-            // ── Load handler ───────────────────────────────────────────────
-            this.addEventListener('load', () => {
-                noThrow(() => {
-                    const duration = Date.now() - this._scalebun_start;
-
-                    let responseHeaders: Record<string, string> | undefined;
-                    let responseBody: unknown | undefined;
-                    let capturedRequestHeaders: Record<string, string> | undefined;
-                    let capturedRequestBody: unknown | undefined;
-
-                    if (captureBodies) {
-                        capturedRequestHeaders = this._scalebun_requestHeaders ?? {};
-                        capturedRequestBody = this._scalebun_requestBody;
-
-                        // Parse response headers
-                        const rawHeaders = this.getAllResponseHeaders();
-                        responseHeaders = parseXHRResponseHeaders(rawHeaders);
-
-                        // Extract response body. responseText is ONLY readable when
-                        // responseType is '' or 'text'; for 'blob'/'arraybuffer'/'json'
-                        // accessing it throws ("responseText is only available if
-                        // responseType is '' or 'text'"). Guard so we skip the body
-                        // instead of raising a non-fatal error per request.
-                        const contentType = this.getResponseHeader('content-type');
-                        const rt = this.responseType;
-                        const safeText =
-                            rt === '' || rt === 'text' ? this.responseText : null;
-                        responseBody = extractResponseBodyFromXHR(
-                            safeText,
-                            contentType,
-                            maxBytes,
-                        );
-                    }
-
-                    // Apply redaction pipeline
-                    let finalRequestHeaders = capturedRequestHeaders;
-                    let finalResponseHeaders = responseHeaders;
-                    let finalRequestBody = capturedRequestBody;
-                    let finalResponseBody = responseBody;
-                    let piiWarnings: any[] | undefined;
-
-                    if (captureBodies && shouldRedact) {
-                        const redacted = redactNetworkEvent({
-                            url: this._scalebun_url,
-                            method: this._scalebun_method,
-                            status: this.status,
-                            duration,
-                            requestHeaders: capturedRequestHeaders,
-                            responseHeaders,
-                            requestBody: capturedRequestBody,
-                            responseBody,
-                        });
-                        finalRequestHeaders = redacted.requestHeaders;
-                        finalResponseHeaders = redacted.responseHeaders;
-                        finalRequestBody = redacted.requestBody;
-                        finalResponseBody = redacted.responseBody;
-                        piiWarnings = redacted.piiWarnings;
-                    }
-
-                    onEvent({
-                        type: 'network',
-                        method: this._scalebun_method,
-                        url: this._scalebun_url,
-                        status: this.status,
-                        statusText: this.statusText,
-                        duration,
-                        requestSize: this._scalebun_requestSize ?? 0,
-                        responseSize: contentLengthBytes(this.getResponseHeader('content-length')),
-                        ...(captureBodies && {
-                            requestHeaders: finalRequestHeaders,
-                            responseHeaders: finalResponseHeaders,
-                            requestBody: finalRequestBody,
-                            responseBody: finalResponseBody,
-                            ...(piiWarnings !== undefined && { piiWarnings }),
-                        }),
-                    });
-                });
-            });
-
-            // ── Error handler ──────────────────────────────────────────────
-            this.addEventListener('error', () => {
-                noThrow(() => {
-                    const duration = Date.now() - this._scalebun_start;
-
-                    // Redact identically to the load/success path — the error
-                    // branch MUST NOT leak Authorization/Cookie headers or body.
-                    let finalRequestHeaders = this._scalebun_requestHeaders;
-                    let finalRequestBody = this._scalebun_requestBody;
-                    let piiWarnings: any[] | undefined;
-
-                    if (captureBodies && shouldRedact) {
-                        const redacted = redactNetworkEvent({
-                            url: this._scalebun_url,
-                            method: this._scalebun_method,
-                            status: 0,
-                            duration,
-                            requestHeaders: this._scalebun_requestHeaders,
-                            requestBody: this._scalebun_requestBody,
-                        });
-                        finalRequestHeaders = redacted.requestHeaders;
-                        finalRequestBody = redacted.requestBody;
-                        piiWarnings = redacted.piiWarnings;
-                    }
-
-                    onEvent({
-                        type: 'network',
-                        method: this._scalebun_method,
-                        url: this._scalebun_url,
-                        status: 0,
-                        error: 'XMLHttpRequest error',
-                        duration,
-                        requestSize: this._scalebun_requestSize ?? 0,
-                        ...(captureBodies && finalRequestHeaders !== undefined && {
-                            requestHeaders: finalRequestHeaders,
-                        }),
-                        ...(captureBodies && finalRequestBody !== undefined && {
-                            requestBody: finalRequestBody,
-                        }),
-                        ...(piiWarnings !== undefined && { piiWarnings }),
-                    });
-                });
-            });
-
-            return originalSend.apply(this, arguments as any);
-        };
-
-        logger.debug('XHR Interceptor installed');
-    });
-}
+/**
+ * ScaleBun SDK — XHR Interceptor
+ *
+ * Monkey-patches `XMLHttpRequest` to capture network events.
+ *
+ * When `captureNetworkBodies` is enabled:
+ *   - Request headers: shimmed via `setRequestHeader` to record headers
+ *     before `send()` is called.
+ *   - Response headers: parsed from `getAllResponseHeaders()` in the `load`
+ *     handler.
+ *   - Request body: captured from the `send(body)` argument (strings only;
+ *     FormData / ArrayBuffer etc. get a placeholder).
+ *   - Response body: read from `xhr.responseText` after the response
+ *     arrives, truncated to `networkBodyMaxBytes`. Binary content-types
+ *     are skipped.
+ *   - All headers and bodies pass through `redactNetworkEvent` when
+ *     `redactNetwork` is true.
+ *
+ * ⚠️  PRIVACY: Body capture is opt-in via `captureNetworkBodies: true`.
+ * The integrator is responsible for compliance with applicable privacy
+ * regulations (GDPR, CCPA, etc.) and their own privacy policy.
+ *
+ * Scope: JS-host (XHR) only.
+ * Native-layer capture (OkHttp / URLSession) is a separate future task.
+ */
+
+import { noThrow } from '../../core/lifecycle/crashSafe';
+import { logger } from '../../core/logger/internalLogger';
+import {
+    extractRequestBody,
+    extractResponseBodyFromXHR,
+    parseXHRResponseHeaders,
+    requestBodyBytes,
+    contentLengthBytes,
+    DEFAULT_BODY_MAX_BYTES,
+} from '../network/bodyCapture';
+import { redactNetworkEvent } from '../../debug/redaction';
+
+// ─── Config ───────────────────────────────────────────────────────────────────
+
+export interface XHRInterceptorOptions {
+    /** Capture request/response headers and bodies. Default: false */
+    captureNetworkBodies?: boolean;
+    /** Max bytes to capture per body before truncating. Default: 65536 */
+    networkBodyMaxBytes?: number;
+    /** Apply redaction pipeline to captured headers/bodies. Default: true (fail closed) */
+    redactNetwork?: boolean;
+}
+
+// ─── Interceptor ─────────────────────────────────────────────────────────────
+
+export function installXHRInterceptor(
+    onEvent: (data: any) => void,
+    options: XHRInterceptorOptions = {},
+): void {
+    noThrow(() => {
+        const XMLHttpRequest = (globalThis as any).XMLHttpRequest;
+        if (!XMLHttpRequest) {
+            logger.warn('XMLHttpRequest not found, skipping interceptor');
+            return;
+        }
+
+        const captureBodies = options.captureNetworkBodies ?? false;
+        const maxBytes = options.networkBodyMaxBytes ?? DEFAULT_BODY_MAX_BYTES;
+        // Privacy fails CLOSED: redaction is on unless explicitly opted out.
+        const shouldRedact = options.redactNetwork ?? true;
+
+        const originalOpen = XMLHttpRequest.prototype.open;
+        const originalSend = XMLHttpRequest.prototype.send;
+        const originalSetRequestHeader = XMLHttpRequest.prototype.setRequestHeader;
+
+        // ── open(): record method + URL + reset captured headers ───────────
+        XMLHttpRequest.prototype.open = function (method: string, url: string) {
+            this._scalebun_method = method.toUpperCase();
+            this._scalebun_url = url;
+            this._scalebun_start = Date.now();
+            // Reset per-request state
+            this._scalebun_requestHeaders = {};
+            return originalOpen.apply(this, arguments as any);
+        };
+
+        // ── setRequestHeader(): accumulate request headers (if capturing) ──
+        XMLHttpRequest.prototype.setRequestHeader = function (name: string, value: string) {
+            if (captureBodies && this._scalebun_requestHeaders !== undefined) {
+                // Lowercase keys for consistency with fetch header convention
+                this._scalebun_requestHeaders[name.toLowerCase()] = value;
+            }
+            return originalSetRequestHeader.apply(this, arguments as any);
+        };
+
+        // ── send(): capture request body + wire load/error handlers ────────
+        XMLHttpRequest.prototype.send = function (body?: any) {
+            // Byte count is non-PII → always measured (independent of body capture).
+            this._scalebun_requestSize = requestBodyBytes(body);
+
+            // Capture request body synchronously before send
+            let requestBody: unknown | undefined;
+            if (captureBodies) {
+                requestBody = extractRequestBody(body);
+                this._scalebun_requestBody = requestBody;
+            }
+
+            // ── Load handler ───────────────────────────────────────────────
+            this.addEventListener('load', () => {
+                noThrow(() => {
+                    const duration = Date.now() - this._scalebun_start;
+
+                    let responseHeaders: Record<string, string> | undefined;
+                    let responseBody: unknown | undefined;
+                    let capturedRequestHeaders: Record<string, string> | undefined;
+                    let capturedRequestBody: unknown | undefined;
+
+                    if (captureBodies) {
+                        capturedRequestHeaders = this._scalebun_requestHeaders ?? {};
+                        capturedRequestBody = this._scalebun_requestBody;
+
+                        // Parse response headers
+                        const rawHeaders = this.getAllResponseHeaders();
+                        responseHeaders = parseXHRResponseHeaders(rawHeaders);
+
+                        // Extract response body. responseText is ONLY readable when
+                        // responseType is '' or 'text'; for 'blob'/'arraybuffer'/'json'
+                        // accessing it throws ("responseText is only available if
+                        // responseType is '' or 'text'"). Guard so we skip the body
+                        // instead of raising a non-fatal error per request.
+                        const contentType = this.getResponseHeader('content-type');
+                        const rt = this.responseType;
+                        const safeText =
+                            rt === '' || rt === 'text' ? this.responseText : null;
+                        responseBody = extractResponseBodyFromXHR(
+                            safeText,
+                            contentType,
+                            maxBytes,
+                        );
+                    }
+
+                    // Apply redaction pipeline
+                    let finalRequestHeaders = capturedRequestHeaders;
+                    let finalResponseHeaders = responseHeaders;
+                    let finalRequestBody = capturedRequestBody;
+                    let finalResponseBody = responseBody;
+                    let piiWarnings: any[] | undefined;
+
+                    if (captureBodies && shouldRedact) {
+                        const redacted = redactNetworkEvent({
+                            url: this._scalebun_url,
+                            method: this._scalebun_method,
+                            status: this.status,
+                            duration,
+                            requestHeaders: capturedRequestHeaders,
+                            responseHeaders,
+                            requestBody: capturedRequestBody,
+                            responseBody,
+                        });
+                        finalRequestHeaders = redacted.requestHeaders;
+                        finalResponseHeaders = redacted.responseHeaders;
+                        finalRequestBody = redacted.requestBody;
+                        finalResponseBody = redacted.responseBody;
+                        piiWarnings = redacted.piiWarnings;
+                    }
+
+                    onEvent({
+                        type: 'network',
+                        method: this._scalebun_method,
+                        url: this._scalebun_url,
+                        status: this.status,
+                        statusText: this.statusText,
+                        duration,
+                        requestSize: this._scalebun_requestSize ?? 0,
+                        responseSize: contentLengthBytes(this.getResponseHeader('content-length')),
+                        ...(captureBodies && {
+                            requestHeaders: finalRequestHeaders,
+                            responseHeaders: finalResponseHeaders,
+                            requestBody: finalRequestBody,
+                            responseBody: finalResponseBody,
+                            ...(piiWarnings !== undefined && { piiWarnings }),
+                        }),
+                    });
+                });
+            });
+
+            // ── Error handler ──────────────────────────────────────────────
+            this.addEventListener('error', () => {
+                noThrow(() => {
+                    const duration = Date.now() - this._scalebun_start;
+
+                    // Redact identically to the load/success path — the error
+                    // branch MUST NOT leak Authorization/Cookie headers or body.
+                    let finalRequestHeaders = this._scalebun_requestHeaders;
+                    let finalRequestBody = this._scalebun_requestBody;
+                    let piiWarnings: any[] | undefined;
+
+                    if (captureBodies && shouldRedact) {
+                        const redacted = redactNetworkEvent({
+                            url: this._scalebun_url,
+                            method: this._scalebun_method,
+                            status: 0,
+                            duration,
+                            requestHeaders: this._scalebun_requestHeaders,
+                            requestBody: this._scalebun_requestBody,
+                        });
+                        finalRequestHeaders = redacted.requestHeaders;
+                        finalRequestBody = redacted.requestBody;
+                        piiWarnings = redacted.piiWarnings;
+                    }
+
+                    onEvent({
+                        type: 'network',
+                        method: this._scalebun_method,
+                        url: this._scalebun_url,
+                        status: 0,
+                        error: 'XMLHttpRequest error',
+                        duration,
+                        requestSize: this._scalebun_requestSize ?? 0,
+                        ...(captureBodies && finalRequestHeaders !== undefined && {
+                            requestHeaders: finalRequestHeaders,
+                        }),
+                        ...(captureBodies && finalRequestBody !== undefined && {
+                            requestBody: finalRequestBody,
+                        }),
+                        ...(piiWarnings !== undefined && { piiWarnings }),
+                    });
+                });
+            });
+
+            return originalSend.apply(this, arguments as any);
+        };
+
+        logger.debug('XHR Interceptor installed');
+    });
+}