@shopify/shopify-api 14.0.0 → 14.0.1

package/lib/clients/common.ts

@@ -25,6 +25,86 @@ export function getUserAgent(config: ConfigInterface): string {
   return userAgentPrefix;
 }
 
+const REDACTED_LOG_VALUE = '****';
+
+// These headers carry reusable credentials and must not reach the logs.
+const SENSITIVE_LOG_HEADERS = new Set([
+  'authorization',
+  'cookie',
+  'set-cookie',
+  'shopify-storefront-private-token',
+  'x-shopify-access-token',
+  'x-shopify-storefront-access-token',
+]);
+
+function sanitizeHeaderValue(name: string, value: unknown): unknown {
+  return SENSITIVE_LOG_HEADERS.has(name.toLowerCase())
+    ? REDACTED_LOG_VALUE
+    : value;
+}
+
+// Keep the original serialized shape of request headers. A Headers instance
+// has no own enumerable properties, so it stays opaque here, the same as
+// JSON.stringify shows it.
+function sanitizeHeaders(headers: any): any {
+  if (!headers || typeof headers !== 'object') {
+    return headers;
+  }
+
+  if (Array.isArray(headers)) {
+    return headers.map((header) =>
+      Array.isArray(header)
+        ? [header[0], sanitizeHeaderValue(header[0], header[1])]
+        : header,
+    );
+  }
+
+  return Object.fromEntries(
+    Object.entries(headers).map(([name, value]) => [
+      name,
+      sanitizeHeaderValue(name, value),
+    ]),
+  );
+}
+
+// Response headers were always enumerated in the log, so keep that and
+// redact the credential values.
+function sanitizeEnumerableHeaders(headers: any): any {
+  if (typeof headers?.entries === 'function' && !Array.isArray(headers)) {
+    return Object.fromEntries(
+      [...headers.entries()].map(([name, value]: [string, string]) => [
+        name,
+        sanitizeHeaderValue(name, value),
+      ]),
+    );
+  }
+
+  return sanitizeHeaders(headers);
+}
+
+function sanitizeRequestParams<T>(requestParams: T): T {
+  if (Array.isArray(requestParams)) {
+    return requestParams.map((param) =>
+      param && typeof param === 'object' && 'headers' in param
+        ? {...param, headers: sanitizeHeaders(param.headers)}
+        : param,
+    ) as T;
+  }
+
+  if (
+    requestParams &&
+    typeof requestParams === 'object' &&
+    'headers' in requestParams
+  ) {
+    return {
+      ...requestParams,
+      headers: sanitizeHeaders((requestParams as {headers: any}).headers),
+    };
+  }
+
+  return requestParams;
+}
+
 function serializeResponse(response: Response | any) {
   if (!response) {
     return {error: 'No response object provided'};
@@ -42,10 +122,8 @@ function serializeResponse(response: Response | any) {
       url,
     };
 
-    if (headers?.entries) {
-      serialized.headers = Object.fromEntries(headers.entries());
-    } else if (headers) {
-      serialized.headers = headers;
+    if (headers) {
+      serialized.headers = sanitizeEnumerableHeaders(headers);
     }
 
     return serialized;
@@ -61,7 +139,9 @@ export function clientLoggerFactory(config: ConfigInterface) {
         case 'HTTP-Response': {
           const responseLog: HTTPResponseLog['content'] = logContent.content;
           logger(config).debug('Received response for HTTP request', {
-            requestParams: JSON.stringify(responseLog.requestParams),
+            requestParams: JSON.stringify(
+              sanitizeRequestParams(responseLog.requestParams),
+            ),
             response: JSON.stringify(serializeResponse(responseLog.response)),
           });
           break;
@@ -69,7 +149,9 @@ export function clientLoggerFactory(config: ConfigInterface) {
         case 'HTTP-Retry': {
           const responseLog: HTTPRetryLog['content'] = logContent.content;
           logger(config).debug('Retrying HTTP request', {
-            requestParams: JSON.stringify(responseLog.requestParams),
+            requestParams: JSON.stringify(
+              sanitizeRequestParams(responseLog.requestParams),
+            ),
             retryAttempt: responseLog.retryAttempt,
             maxRetries: responseLog.maxRetries,
             response: responseLog.lastResponse
@@ -84,7 +166,9 @@ export function clientLoggerFactory(config: ConfigInterface) {
           logger(config).debug(
             'Received response containing Deprecated GraphQL Notice',
             {
-              requestParams: JSON.stringify(responseLog.requestParams),
+              requestParams: JSON.stringify(
+                sanitizeRequestParams(responseLog.requestParams),
+              ),
               deprecationNotice: responseLog.deprecationNotice,
             },
           );

package/lib/utils/fetch-request.ts

@@ -3,6 +3,18 @@ import {LogSeverity} from '../types';
 import {abstractFetch} from '../../runtime';
 import {ConfigInterface} from '../base-types';
 
+const OAUTH_TOKEN_ENDPOINT_PATH = '/admin/oauth/access_token';
+
+// Token endpoint bodies carry OAuth secrets, so they must not reach the logs.
+// When the URL does not parse, fail closed and keep the body out of the logs.
+function canLogRequestBody(url: string): boolean {
+  try {
+    return new URL(url).pathname !== OAUTH_TOKEN_ENDPOINT_PATH;
+  } catch {
+    return false;
+  }
+}
+
 export function fetchRequestFactory(config: ConfigInterface) {
   return async function fetchRequest(
     url: string,
@@ -16,7 +28,7 @@ export function fetchRequestFactory(config: ConfigInterface) {
       log.debug('Making HTTP request', {
         method: options?.method || 'GET',
         url,
-        ...(options?.body && {body: options?.body}),
+        ...(options?.body && canLogRequestBody(url) && {body: options.body}),
       });
     }
 

package/lib/version.ts

@@ -1 +1 @@
-export const SHOPIFY_API_LIBRARY_VERSION = '14.0.0';
+export const SHOPIFY_API_LIBRARY_VERSION = '14.0.1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shopify/shopify-api",
-  "version": "14.0.0",
+  "version": "14.0.1",
   "description": "Shopify API Library for Node - accelerate development with support for authentication, graphql proxy, webhooks",
   "types": "./dist/ts/lib/index.d.ts",
   "module": "./dist/esm/lib/index.mjs",