@shivaedev/server 0.9.1 → 0.9.3

package/src/safeOtlpSerialization.ts

@@ -2,7 +2,7 @@ import { Effect, Layer } from "effect";
 import type { OtlpResource, OtlpTracer } from "effect/observability";
 import { OtlpSerialization } from "effect/observability";
 import { isSensitiveKey, REDACTED, redactText, type SensitiveKey } from "@shivaedev/errors/sensitive.ts";
-import { RedactionPolicy } from "#RedactionPolicy.ts";
+import { type HostRedactionPolicy, RedactionPolicy, redactionForRpc } from "#RedactionPolicy.ts";
 import { redactOtlpUrl } from "#redactOtlpUrl.ts";
 
 function otlpSensitive(sensitive: SensitiveKey): SensitiveKey {
@@ -37,25 +37,30 @@ function spanName(span: { readonly name: string; readonly kind: number; readonly
 	return span.name;
 }
 
-function redactTraces(data: OtlpTracer.TraceData, sensitive: SensitiveKey): OtlpTracer.TraceData {
-	function text(value: string) {
-		return redactOtlpText(value, "", sensitive);
-	}
+function redactTraces(data: OtlpTracer.TraceData, policy: HostRedactionPolicy): OtlpTracer.TraceData {
+	const resourceSensitive = otlpSensitive(policy);
 	return {
 		...data,
 		resourceSpans: data.resourceSpans.map((resource) => ({
 			...resource,
-			resource: { ...resource.resource, attributes: attributes(resource.resource.attributes, sensitive) },
+			resource: { ...resource.resource, attributes: attributes(resource.resource.attributes, resourceSensitive) },
 			scopeSpans: resource.scopeSpans.map((scope) => ({
 				...scope,
-				spans: scope.spans.map((span) => ({
-					...span,
-					attributes: attributes(span.attributes, sensitive),
-					events: span.events.map((event) => ({ ...event, attributes: attributes(event.attributes, sensitive), name: text(event.name) })),
-					links: span.links.map((link) => ({ ...link, attributes: attributes(link.attributes, sensitive) })),
-					name: text(spanName(span)),
-					status: { ...span.status, ...(span.status.message === undefined ? {} : { message: text(span.status.message) }) },
-				})),
+				spans: scope.spans.map((span) => {
+					const method = span.attributes.find(({ key }) => key === "rpc.method")?.value.stringValue;
+					const sensitive = otlpSensitive(redactionForRpc(policy, method));
+					function text(value: string) {
+						return redactOtlpText(value, "", sensitive);
+					}
+					return {
+						...span,
+						attributes: attributes(span.attributes, sensitive),
+						events: span.events.map((event) => ({ ...event, attributes: attributes(event.attributes, sensitive), name: text(event.name) })),
+						links: span.links.map((link) => ({ ...link, attributes: attributes(link.attributes, sensitive) })),
+						name: text(spanName(span)),
+						status: { ...span.status, ...(span.status.message === undefined ? {} : { message: text(span.status.message) }) },
+					};
+				}),
 			})),
 		})),
 	};
@@ -64,7 +69,7 @@ export const safeOtlpSerialization = Layer.effect(
 	OtlpSerialization.OtlpSerialization,
 	Effect.gen(function* () {
 		const serialization = yield* OtlpSerialization.OtlpSerialization;
-		const sensitive = otlpSensitive(yield* RedactionPolicy);
+		const sensitive = yield* RedactionPolicy;
 		return OtlpSerialization.OtlpSerialization.of({
 			...serialization,
 			traces: (data) => serialization.traces(redactTraces(data, sensitive)),

package/src/schemaSensitiveAst.ts

@@ -0,0 +1,106 @@
+import { Predicate, type SchemaAST } from "effect";
+import { isSensitiveKey } from "@shivaedev/errors/sensitive.ts";
+
+function children(ast: SchemaAST.AST): readonly SchemaAST.AST[] {
+	switch (ast._tag) {
+		case "Objects":
+			return [...ast.propertySignatures.map((property) => property.type), ...ast.indexSignatures.flatMap((index) => [index.parameter, index.type])];
+		case "Arrays":
+			return [...ast.elements, ...ast.rest];
+		case "Union":
+			return ast.types;
+		case "Declaration":
+			return ast.typeParameters;
+		case "Suspend":
+			return [ast.thunk()];
+		default:
+			return [];
+	}
+}
+function sensitiveCheck(check: SchemaAST.Check<never>): boolean {
+	return check.annotations?.sensitive === true || (check._tag === "FilterGroup" && check.checks.some(sensitiveCheck));
+}
+export function marked(ast: SchemaAST.AST, seen = new Set<SchemaAST.AST>()): boolean {
+	if (seen.has(ast)) {
+		return false;
+	}
+	seen.add(ast);
+	if (
+		ast.annotations?.sensitive === true
+		|| ast.context?.annotations?.sensitive === true
+		|| ast.checks?.some(sensitiveCheck)
+		|| (Predicate.hasProperty(ast.annotations?.representation, "id") && ast.annotations.representation.id === "effect/schema/Redacted")
+	) {
+		return true;
+	}
+	const nested = ast._tag === "Objects" ? ast.indexSignatures.map((index) => index.type) : children(ast);
+	return (ast.encoding?.some((link) => marked(link.to, seen)) ?? false) || nested.some((type) => marked(type, seen));
+}
+function containsSensitive(ast: SchemaAST.AST, keys: ReadonlySet<string>): boolean {
+	return (
+		marked(ast)
+		|| propertiesOf(ast).some((property) => typeof property.name === "string" && (keys.has(property.name) || isSensitiveKey(property.name)))
+	);
+}
+export function collectEncodedKeys(ast: SchemaAST.AST, keys: Set<string>) {
+	let source = ast;
+	let sensitive = false;
+	for (const link of ast.encoding ?? []) {
+		sensitive ||= containsSensitive(source, keys);
+		if (sensitive) {
+			for (const property of propertiesOf(link.to)) {
+				if (typeof property.name === "string") {
+					keys.add(property.name);
+				}
+			}
+		}
+		source = link.to;
+	}
+}
+function fixedOutput(ast: SchemaAST.AST): boolean {
+	if (ast._tag === "Union") {
+		return ast.types.every(fixedOutput);
+	}
+	return ast._tag === "Objects" && ast.indexSignatures.length === 0;
+}
+export function maskedValue(ast: SchemaAST.AST, keys: ReadonlySet<string>, seen = new Set<SchemaAST.AST>()): boolean {
+	if (seen.has(ast)) {
+		return false;
+	}
+	seen.add(ast);
+	if (marked(ast)) {
+		return true;
+	}
+	let source = ast;
+	let sensitive = false;
+	for (const link of ast.encoding ?? []) {
+		sensitive ||= containsSensitive(source, keys);
+		if (sensitive && !fixedOutput(link.to)) {
+			return true;
+		}
+		source = link.to;
+	}
+	const nested = ast._tag === "Objects" ? ast.indexSignatures.map((index) => index.type) : children(ast);
+	return nested.some((type) => maskedValue(type, keys, seen));
+}
+export function collect(ast: SchemaAST.AST, nodes: Set<SchemaAST.AST>, encodings = true) {
+	if (nodes.has(ast)) {
+		return;
+	}
+	nodes.add(ast);
+	for (const child of [...children(ast), ...(encodings ? (ast.encoding?.map((link) => link.to) ?? []) : [])]) {
+		collect(child, nodes, encodings);
+	}
+}
+function propertiesOf(ast: SchemaAST.AST) {
+	const nodes = new Set<SchemaAST.AST>();
+	collect(ast, nodes, false);
+	return [...nodes].flatMap((node) => (node._tag === "Objects" ? node.propertySignatures : []));
+}
+export function collectFieldKeys(properties: SchemaAST.Objects["propertySignatures"], keys: Set<string>, sensitive: (ast: SchemaAST.AST) => boolean) {
+	for (const property of properties) {
+		if (typeof property.name === "string" && sensitive(property.type)) {
+			keys.add(property.name);
+		}
+	}
+}

package/src/schemaSensitiveKeys.ts

@@ -1,130 +1,20 @@
-import { Predicate, type Schema, type SchemaAST } from "effect";
+import type { Schema, SchemaAST } from "effect";
 import { Rpc, type RpcGroup } from "effect/rpc";
 import { isSensitiveKey } from "@shivaedev/errors/sensitive.ts";
+import { collect, collectEncodedKeys, collectFieldKeys, marked, maskedValue } from "#schemaSensitiveAst.ts";
 
-function children(ast: SchemaAST.AST): readonly SchemaAST.AST[] {
-	switch (ast._tag) {
-		case "Objects":
-			return [...ast.propertySignatures.map((property) => property.type), ...ast.indexSignatures.flatMap((index) => [index.parameter, index.type])];
-		case "Arrays":
-			return [...ast.elements, ...ast.rest];
-		case "Union":
-			return ast.types;
-		case "Declaration":
-			return ast.typeParameters;
-		case "Suspend":
-			return [ast.thunk()];
-		default:
-			return [];
-	}
-}
-function sensitiveCheck(check: SchemaAST.Check<never>): boolean {
-	return check.annotations?.sensitive === true || (check._tag === "FilterGroup" && check.checks.some(sensitiveCheck));
-}
-function marked(ast: SchemaAST.AST, seen = new Set<SchemaAST.AST>()): boolean {
-	if (seen.has(ast)) {
-		return false;
-	}
-	seen.add(ast);
-	if (
-		ast.annotations?.sensitive === true
-		|| ast.context?.annotations?.sensitive === true
-		|| ast.checks?.some(sensitiveCheck)
-		|| (Predicate.hasProperty(ast.annotations?.representation, "id") && ast.annotations.representation.id === "effect/schema/Redacted")
-	) {
-		return true;
-	}
-	const nested = ast._tag === "Objects" ? ast.indexSignatures.map((index) => index.type) : children(ast);
-	return (ast.encoding?.some((link) => marked(link.to, seen)) ?? false) || nested.some((type) => marked(type, seen));
-}
-function containsSensitive(ast: SchemaAST.AST, keys: ReadonlySet<string>): boolean {
-	return (
-		marked(ast)
-		|| propertiesOf(ast).some((property) => typeof property.name === "string" && (keys.has(property.name) || isSensitiveKey(property.name)))
-	);
-}
-function collectEncodedKeys(ast: SchemaAST.AST, keys: Set<string>) {
-	let source = ast;
-	let sensitive = false;
-	for (const link of ast.encoding ?? []) {
-		sensitive ||= containsSensitive(source, keys);
-		if (sensitive) {
-			for (const property of propertiesOf(link.to)) {
-				if (typeof property.name === "string") {
-					keys.add(property.name);
-				}
-			}
-		}
-		source = link.to;
-	}
-}
-function fixedOutput(ast: SchemaAST.AST): boolean {
-	if (ast._tag === "Union") {
-		return ast.types.every(fixedOutput);
-	}
-	return ast._tag === "Objects" && ast.indexSignatures.length === 0;
-}
-function maskedValue(ast: SchemaAST.AST, keys: ReadonlySet<string>, seen = new Set<SchemaAST.AST>()): boolean {
-	if (seen.has(ast)) {
-		return false;
-	}
-	seen.add(ast);
-	if (marked(ast)) {
-		return true;
-	}
-	let source = ast;
-	let sensitive = false;
-	for (const link of ast.encoding ?? []) {
-		sensitive ||= containsSensitive(source, keys);
-		if (sensitive && !fixedOutput(link.to)) {
-			return true;
-		}
-		source = link.to;
-	}
-	const nested = ast._tag === "Objects" ? ast.indexSignatures.map((index) => index.type) : children(ast);
-	return nested.some((type) => maskedValue(type, keys, seen));
-}
-function collect(ast: SchemaAST.AST, nodes: Set<SchemaAST.AST>, encodings = true) {
-	if (nodes.has(ast)) {
-		return;
-	}
-	nodes.add(ast);
-	for (const child of [...children(ast), ...(encodings ? (ast.encoding?.map((link) => link.to) ?? []) : [])]) {
-		collect(child, nodes, encodings);
-	}
-}
-function propertiesOf(ast: SchemaAST.AST) {
-	const nodes = new Set<SchemaAST.AST>();
-	collect(ast, nodes, false);
-	return [...nodes].flatMap((node) => (node._tag === "Objects" ? node.propertySignatures : []));
-}
-function collectFieldKeys(properties: SchemaAST.Objects["propertySignatures"], keys: Set<string>, sensitive: (ast: SchemaAST.AST) => boolean) {
-	for (const property of properties) {
-		if (typeof property.name === "string" && sensitive(property.type)) {
-			keys.add(property.name);
-		}
-	}
-}
-export function schemaSensitiveKeys<R extends Rpc.Any>(group: RpcGroup.RpcGroup<R>, extra: readonly string[] = []) {
+function rpcSensitiveKeys(rpc: Rpc.AnyWithProps, extra: readonly string[]) {
 	const keys = new Set(extra);
 	const nodes = new Set<SchemaAST.AST>();
-	const requests: Rpc.AnyWithProps[] = [];
-	for (const rpc of group.requests.values()) {
-		if (Rpc.isRpc(rpc)) {
-			requests.push(rpc);
-		}
-	}
-	for (const rpc of requests) {
-		const schemas: Schema.Top[] = [
-			rpc.payloadSchema,
-			rpc.successSchema,
-			rpc.errorSchema,
-			rpc.defectSchema,
-			...[...rpc.middlewares].map((m) => m.error),
-		];
-		for (const schema of schemas) {
-			collect(schema.ast, nodes);
-		}
+	const schemas: Schema.Top[] = [
+		rpc.payloadSchema,
+		rpc.successSchema,
+		rpc.errorSchema,
+		rpc.defectSchema,
+		...[...rpc.middlewares].map((m) => m.error),
+	];
+	for (const schema of schemas) {
+		collect(schema.ast, nodes);
 	}
 	const properties = [...nodes].flatMap((ast) => (ast._tag === "Objects" ? ast.propertySignatures : []));
 	collectFieldKeys(properties, keys, marked);
@@ -136,13 +26,24 @@ export function schemaSensitiveKeys<R extends Rpc.Any>(group: RpcGroup.RpcGroup<
 			collectEncodedKeys(ast, keys);
 		}
 	} while (keys.size !== previousSize);
-	const roots = requests.map((rpc) => ({
+	return Object.assign((key: string) => keys.has(key) || isSensitiveKey(key), {
 		die: maskedValue(rpc.defectSchema.ast, keys),
 		fail: [rpc.errorSchema, ...[...rpc.middlewares].map((m) => m.error)].some((schema) => maskedValue(schema.ast, keys)),
-		tag: rpc._tag,
-	}));
-	return Object.assign((key: string) => keys.has(key) || isSensitiveKey(key), {
+	});
+}
+export function schemaSensitiveKeys<R extends Rpc.Any>(group: RpcGroup.RpcGroup<R>, extra: readonly string[] = []) {
+	const policies = new Map<string, ReturnType<typeof rpcSensitiveKeys>>();
+	for (const rpc of group.requests.values()) {
+		if (Rpc.isRpc(rpc)) {
+			policies.set(rpc._tag, rpcSensitiveKeys(rpc, extra));
+		}
+	}
+	function sensitive(key: string) {
+		return extra.includes(key) || isSensitiveKey(key) || [...policies.values()].some((policy) => policy(key));
+	}
+	return Object.assign(sensitive, {
+		forRpc: (tag: string | undefined) => (tag === undefined ? sensitive : (policies.get(tag) ?? sensitive)),
 		maskFailure: (tag: string | undefined, reason: "Fail" | "Die") =>
-			roots.some((root) => (tag === undefined || tag === root.tag) && (reason === "Fail" ? root.fail : root.die)),
+			[...policies].some(([method, policy]) => (tag === undefined || tag === method) && (reason === "Fail" ? policy.fail : policy.die)),
 	});
 }