@skrr-ai/cli 0.1.114 → 0.1.116

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/telemetryRedaction.js

@@ -1,261 +1,173 @@
 "use strict";
-/**
- * Keeping a Hosted Machine preview capability out of telemetry (OSK-16174).
- *
- * `/api/previews/<token>/...` serves a person's machine with NO login: the token in the path is a bearer
- * capability (`pvw_<22 chars>.<expiry>.<22 chars>`, idle TTL ten minutes). Anyone who can read a trace, an error
- * report or a log line that carries it can open the preview, so every sink that records a URL has to run its
- * strings through here first. This file is the ONE place that knows what to look for; the sinks (OpenTelemetry
- * exporters, Sentry hooks, request and CSRF logs, client-log ingest) only decide WHERE to call it.
- *
- * WHAT IT MATCHES. The prefix `pvw_` and then every character a token is made of, however far that goes, rather
- * than the exact 22.digits.22 shape. A truncated token is still part of the secret, a log line cut at 200
- * characters is the ordinary way one gets truncated, and a looser match costs nothing: the marker replaces
- * only what looked like a token. The token alphabet is base64url plus the two dots, or any of those characters
- * written as a percent-escape, once or several times (`encodeURIComponent` of a URL that was itself in a query
- * string). `packages/data-provider/specs/hostedPreview.spec.ts` pins this against the contract's token shape
- * and `api/server/services/HostedPreview/__tests__/telemetryRedaction.spec.js` against tokens the issuer really
- * mints, so a change to either side fails there rather than in a trace nobody reads.
- *
- * THE OTHER PATH CREDENTIALS (OSK-16174). Four more bearer credentials travel in a URL, and until they were added here
- * only the request logger's path rewrite (`requestLogger.js`) knew them, so the same address that was scrubbed from a
- * log line reached a trace and an error report in full: a workspace invitation (`wsi_`), a platform invitation
- * (`pinv_`), a member's invitation link (`usr_`) and an operator's (`adm2_`, and the older `adm_`). Unlike `pvw_`, whose
- * prefix is rare enough to match on its own, `usr_` and `adm_` begin ordinary words and identifiers (`/usr_local`,
- * `adm_users`), so each of these is recognised by the SHAPE its minting code gives it, and a lookalike is left alone:
- *
- *   wsi_ / pinv_ / usr_ / adm2_   `<prefix>_<32 hex>.<version>.<key id>.<43 base64url>`, from `buildCredential` in
- *                                 `api/models/WorkspaceInvite.js` and `PlatformInvitation.js` and `buildUserCode` and
- *                                 `buildAdminCode` in `InvitationCode.js`. The older member link, `usr_<32 hex>.<24
- *                                 base64url>`, has the same first two fields. Matched from the prefix to the end of the
- *                                 token's characters once the 32-hex id and its dot are there, so a credential cut off
- *                                 later in the log line is still redacted whole.
- *   adm_                          `adm_<43 base64url>`, the older operator code (`generateCode`: 32 random bytes).
- *                                 Exactly 43 characters, because that is the only length it has.
- *
- * `api/server/services/HostedPreview/__tests__/telemetryRedaction.spec.js` mints credentials with the real minting
- * code and requires every one to come out as the marker, so a change to either side fails there.
- *
- * HUMAN QR SIGN-IN. Its locator has no token prefix, so redact only the known
- * `/api/auth/qr/requests/<locator>` path and `/auth/qr?request=<locator>` query
- * (including percent-encoded nested URLs). Private protocol field names are
- * redacted in serialized text and structured records, including numeric
- * comparison codes. Ordinary request ids, operation names and error/metric
- * categories remain usable. All existing preview-redaction sinks inherit it.
- *
- * WHAT IT DOES NOT. A prefix that is itself percent-encoded (`%70vw_`) is not recognised: nothing in this
- * repository writes one, and a scan that decoded every string first would cost every sink on every record. A
- * credential cut off before its id is whole (`pinv_0123abc`) is an identifier, not yet the secret, and is left as it
- * is. The request log's own `/[credential]` rewrite stays as it is, and is looser (any `wsi_`, `pinv_`, `usr_`,
- * `adm_`, `adm2_` or `pvw_` path segment), because a path segment is a place a credential is known to be.
- *
- * COST. Linear in the input. The only nested repetition is `%(?:25)*XX`, and `XX` is never `25`, so the engine
- * cannot read one run of `25`s two ways; the tests feed it a megabyte of the worst shapes.
- *
- * NEVER THROWS. These run inside telemetry hooks, and a hook that throws takes a request or an error report
- * with it. Whatever cannot be scrubbed is reported to the caller as such (`false`), and the caller drops the
- * record, because a record with the token still in it is exactly what this exists to prevent.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.QR_SIGN_IN_REDACTION = exports.PREVIEW_TOKEN_REDACTION = void 0;
-exports.isQrSignInSecretField = isQrSignInSecretField;
-exports.redactPreviewTokens = redactPreviewTokens;
-exports.redactPreviewTokensDeep = redactPreviewTokensDeep;
-exports.withPreviewTokenRedaction = withPreviewTokenRedaction;
-/** What replaces a token. Fixed, so a trace can say a preview was involved but not which one. */
-exports.PREVIEW_TOKEN_REDACTION = 'pvw_[redacted]';
-/**
- * One character of a token: base64url, a dot, or any of those written as a percent-escape. An escape that was
- * escaped again is `%25` followed by the original two digits (`_` is `%5F`, then `%255F`, then `%25255F`), which is
- * what the `(?:25)*` is for. `25` is not itself a digit pair of a token character, so a run of them can only be
- * read one way.
- */
-const TOKEN_CHAR = '(?:[A-Za-z0-9._-]|%(?:25)*(?:2[DdEe]|3[0-9]|4[1-9A-Fa-f]|5[0-9AaFf]|6[1-9A-Fa-f]|7[0-9Aa]))';
-/**
- * `pvw` then an underscore, which may be written `%5F` (or `%255F`, ...); then at least ONE token character. Not
- * zero: the marker is `pvw_[`, and `[` is not a token character, so a string that was already redacted matches
- * nothing and redacting twice changes nothing.
- */
-const PREVIEW_TOKEN = new RegExp(`pvw(?:_|%(?:25)*5[Ff])${TOKEN_CHAR}+`, 'g');
-/**
- * A prefix's underscore, which (like the token's own characters) may be written as a percent-escape, once or several
- * times; and the dot that ends an id.
- */
-const UNDERSCORE = '(?:_|%(?:25)*5[Ff])';
-const DOT = '(?:\\.|%(?:25)*2[Ee])';
-/**
- * `wsi`, `pinv`, `usr` or `adm2`, an underscore, and then a lookahead that insists on what the minting code writes
- * next: 32 lowercase hex characters and the dot that ends them. Everything the credential is made of follows, and the
- * prefix is captured so the marker can say which kind it was. `usr_<40 hex>`, `usr_00000001` and `/usr_profile` have no
- * dot after exactly 32 hex characters, so they match nothing.
- */
-const SIGNED_CREDENTIAL = new RegExp(`(wsi|pinv|usr|adm2)${UNDERSCORE}(?=[0-9a-f]{32}${DOT})${TOKEN_CHAR}+`, 'g');
-/**
- * The older operator code: `adm_` and exactly 43 base64url characters (32 random bytes), not followed by another one.
- * A shorter or longer run of letters is a name, not this credential. The characters are the plain alphabet and not
- * `TOKEN_CHAR`, whose dot would swallow the full stop at the end of a sentence.
- */
-const LEGACY_OPERATOR_CODE = new RegExp(`(adm)${UNDERSCORE}(?=[A-Za-z0-9_-]{43}(?![A-Za-z0-9_-]))[A-Za-z0-9_-]{43}`, 'g');
-/** QR locators have no identifying prefix, so match only their protocol locations. */
-exports.QR_SIGN_IN_REDACTION = '[redacted]';
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var telemetryRedaction_exports = {};
+__export(telemetryRedaction_exports, {
+  PREVIEW_TOKEN_REDACTION: () => PREVIEW_TOKEN_REDACTION,
+  QR_SIGN_IN_REDACTION: () => QR_SIGN_IN_REDACTION,
+  isQrSignInSecretField: () => isQrSignInSecretField,
+  redactPreviewTokens: () => redactPreviewTokens,
+  redactPreviewTokensDeep: () => redactPreviewTokensDeep,
+  withPreviewTokenRedaction: () => withPreviewTokenRedaction
+});
+module.exports = __toCommonJS(telemetryRedaction_exports);
+const PREVIEW_TOKEN_REDACTION = "pvw_[redacted]";
+const TOKEN_CHAR = "(?:[A-Za-z0-9._-]|%(?:25)*(?:2[DdEe]|3[0-9]|4[1-9A-Fa-f]|5[0-9AaFf]|6[1-9A-Fa-f]|7[0-9Aa]))";
+const PREVIEW_TOKEN = new RegExp(`pvw(?:_|%(?:25)*5[Ff])${TOKEN_CHAR}+`, "g");
+const UNDERSCORE = "(?:_|%(?:25)*5[Ff])";
+const DOT = "(?:\\.|%(?:25)*2[Ee])";
+const SIGNED_CREDENTIAL = new RegExp(`(wsi|pinv|usr|adm2)${UNDERSCORE}(?=[0-9a-f]{32}${DOT})${TOKEN_CHAR}+`, "g");
+const LEGACY_OPERATOR_CODE = new RegExp(`(adm)${UNDERSCORE}(?=[A-Za-z0-9_-]{43}(?![A-Za-z0-9_-]))[A-Za-z0-9_-]{43}`, "g");
+const QR_SIGN_IN_REDACTION = "[redacted]";
 const escapedLiteral = (value) => [...value].map((char) => {
-    const literal = char.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-    return `(?:${literal}|%(?:25)*${char.charCodeAt(0).toString(16)})`;
-}).join('');
-const QR_REQUEST_PATH = new RegExp(`(${escapedLiteral('/api/auth/qr/requests/')})${TOKEN_CHAR}+`, 'gi');
-const QR_LINK_QUERY = new RegExp(`(${escapedLiteral('/auth/qr?')})([^\\s"'<>#]*)`, 'gi');
-const QR_REQUEST_QUERY = new RegExp(`(^|${escapedLiteral('&')})(${escapedLiteral('request')}${escapedLiteral('=')})${TOKEN_CHAR}+`, 'gi');
-const QR_SECRET_FIELDS = new Set([
-    'statustoken', 'claimtoken', 'codeverifier', 'codechallenge', 'comparisoncode',
+  const literal = char.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return `(?:${literal}|%(?:25)*${char.charCodeAt(0).toString(16)})`;
+}).join("");
+const QR_REQUEST_PATH = new RegExp(`(${escapedLiteral("/api/auth/qr/requests/")})${TOKEN_CHAR}+`, "gi");
+const QR_LINK_QUERY = new RegExp(`(${escapedLiteral("/auth/qr?")})([^\\s"'<>#]*)`, "gi");
+const QR_REQUEST_QUERY = new RegExp(`(^|${escapedLiteral("&")})(${escapedLiteral("request")}${escapedLiteral("=")})${TOKEN_CHAR}+`, "gi");
+const QR_SECRET_FIELDS = /* @__PURE__ */ new Set([
+  "statustoken",
+  "claimtoken",
+  "codeverifier",
+  "codechallenge",
+  "comparisoncode"
 ]);
-/** Fields are protocol-specific; preserve ordinary request ids, error codes and metrics. */
 function isQrSignInSecretField(key) {
-    const leaf = key.split('.').pop() || '';
-    return QR_SECRET_FIELDS.has(leaf.replace(/[_-]/g, '').toLowerCase());
+  const leaf = key.split(".").pop() || "";
+  return QR_SECRET_FIELDS.has(leaf.replace(/[_-]/g, "").toLowerCase());
 }
 const QR_SECRET_ASSIGNMENT = /((?:["']?)(?:statusToken|claimToken|codeVerifier|codeChallenge|comparisonCode|status_token|claim_token|code_verifier|code_challenge|comparison_code)(?:["']?)\s*[:=]\s*["']?)([A-Za-z0-9._~%+-]+)/gi;
 function redactQrSignInText(value) {
-    // Undici/Sentry may split url.query/query_string from its path. The QR's
-    // direction vocabulary identifies that standalone query without treating an
-    // ordinary application's `request` query key as a secret globally.
-    const standaloneQuery = /(?:^|[?&])direction=(?:mobile_approves_web|web_approves_mobile)(?:&|$)/.test(value)
-        ? value.replace(QR_REQUEST_QUERY, `$1$2${exports.QR_SIGN_IN_REDACTION}`) : value;
-    return standaloneQuery
-        .replace(QR_REQUEST_PATH, `$1${exports.QR_SIGN_IN_REDACTION}`)
-        .replace(QR_LINK_QUERY, (_match, prefix, query) => prefix + query.replace(QR_REQUEST_QUERY, `$1$2${exports.QR_SIGN_IN_REDACTION}`))
-        .replace(QR_SECRET_ASSIGNMENT, `$1${exports.QR_SIGN_IN_REDACTION}`);
+  const standaloneQuery = /(?:^|[?&])direction=(?:mobile_approves_web|web_approves_mobile)(?:&|$)/.test(value) ? value.replace(QR_REQUEST_QUERY, `$1$2${QR_SIGN_IN_REDACTION}`) : value;
+  return standaloneQuery.replace(QR_REQUEST_PATH, `$1${QR_SIGN_IN_REDACTION}`).replace(QR_LINK_QUERY, (_match, prefix, query) => prefix + query.replace(QR_REQUEST_QUERY, `$1$2${QR_SIGN_IN_REDACTION}`)).replace(QR_SECRET_ASSIGNMENT, `$1${QR_SIGN_IN_REDACTION}`);
 }
-/** Cheap test before the older prefix-based credential expressions. */
-const CREDENTIAL_HINTS = ['pvw', 'wsi', 'pinv', 'usr', 'adm'];
+const CREDENTIAL_HINTS = ["pvw", "wsi", "pinv", "usr", "adm"];
 const credentialMarker = (_match, prefix) => `${prefix}_[redacted]`;
 function redactPreviewTokens(value) {
-    if (typeof value !== 'string')
-        return value;
-    const qrSafe = redactQrSignInText(value);
-    if (!CREDENTIAL_HINTS.some((hint) => qrSafe.indexOf(hint) !== -1))
-        return qrSafe;
-    return qrSafe
-        .replace(PREVIEW_TOKEN, exports.PREVIEW_TOKEN_REDACTION)
-        .replace(SIGNED_CREDENTIAL, credentialMarker)
-        .replace(LEGACY_OPERATOR_CODE, credentialMarker);
+  if (typeof value !== "string")
+    return value;
+  const qrSafe = redactQrSignInText(value);
+  if (!CREDENTIAL_HINTS.some((hint) => qrSafe.indexOf(hint) !== -1))
+    return qrSafe;
+  return qrSafe.replace(PREVIEW_TOKEN, PREVIEW_TOKEN_REDACTION).replace(SIGNED_CREDENTIAL, credentialMarker).replace(LEGACY_OPERATOR_CODE, credentialMarker);
 }
-const DEFAULT_MAX_NODES = 50_000;
+const DEFAULT_MAX_NODES = 5e4;
 const DEFAULT_MAX_DEPTH = 32;
-/**
- * Redact every string inside an object graph, IN PLACE (an error report is rewritten far more cheaply than it is
- * copied). Returns `true` when the whole graph was scrubbed and `false` when some of it could not be: past
- * the bounds, frozen, behind a getter that throws. A `false` means the value may still hold a token and must not
- * be sent. Binary payloads are skipped, not walked, and Error messages and stacks are scrubbed though they are
- * not enumerable.
- */
 function redactPreviewTokensDeep(root, limits = {}) {
-    if (root === null || typeof root !== 'object') {
-        return true;
-    }
-    const maxNodes = limits.maxNodes ?? DEFAULT_MAX_NODES;
-    const maxDepth = limits.maxDepth ?? DEFAULT_MAX_DEPTH;
-    try {
-        const seen = new WeakSet();
-        const stack = [[root, 0]];
-        let visited = 0;
-        let complete = true;
-        const rewrite = (holder, key, current) => {
-            const next = isQrSignInSecretField(key) ? exports.QR_SIGN_IN_REDACTION : redactPreviewTokens(current);
-            if (next === current) {
-                return;
-            }
-            try {
-                holder[key] = next;
-            }
-            catch {
-                // a frozen object throws in strict code
-            }
-            if (holder[key] !== next) {
-                // and silently keeps the old value in sloppy code
-                complete = false;
-            }
-        };
-        while (stack.length > 0) {
-            const [node, depth] = stack.pop();
-            if (seen.has(node) || ArrayBuffer.isView(node)) {
-                continue;
-            }
-            seen.add(node);
-            visited += 1;
-            if (visited > maxNodes) {
-                return false;
-            }
-            const holder = node;
-            if (node instanceof Error) {
-                for (const key of ['message', 'stack']) {
-                    if (typeof holder[key] === 'string') {
-                        rewrite(holder, key, holder[key]);
-                    }
-                }
-            }
-            for (const key of Object.keys(node)) {
-                let child;
-                try {
-                    child = holder[key];
-                }
-                catch {
-                    complete = false;
-                    continue;
-                }
-                if (isQrSignInSecretField(key) || typeof child === 'string') {
-                    rewrite(holder, key, child);
-                }
-                else if (child !== null && typeof child === 'object') {
-                    if (depth + 1 > maxDepth) {
-                        complete = false;
-                    }
-                    else {
-                        stack.push([child, depth + 1]);
-                    }
-                }
-            }
-        }
-        return complete;
-    }
-    catch {
+  if (root === null || typeof root !== "object") {
+    return true;
+  }
+  const maxNodes = limits.maxNodes ?? DEFAULT_MAX_NODES;
+  const maxDepth = limits.maxDepth ?? DEFAULT_MAX_DEPTH;
+  try {
+    const seen = /* @__PURE__ */ new WeakSet();
+    const stack = [[root, 0]];
+    let visited = 0;
+    let complete = true;
+    const rewrite = (holder, key, current) => {
+      const next = isQrSignInSecretField(key) ? QR_SIGN_IN_REDACTION : redactPreviewTokens(current);
+      if (next === current) {
+        return;
+      }
+      try {
+        holder[key] = next;
+      } catch {
+      }
+      if (holder[key] !== next) {
+        complete = false;
+      }
+    };
+    while (stack.length > 0) {
+      const [node, depth] = stack.pop();
+      if (seen.has(node) || ArrayBuffer.isView(node)) {
+        continue;
+      }
+      seen.add(node);
+      visited += 1;
+      if (visited > maxNodes) {
         return false;
+      }
+      const holder = node;
+      if (node instanceof Error) {
+        for (const key of ["message", "stack"]) {
+          if (typeof holder[key] === "string") {
+            rewrite(holder, key, holder[key]);
+          }
+        }
+      }
+      for (const key of Object.keys(node)) {
+        let child;
+        try {
+          child = holder[key];
+        } catch {
+          complete = false;
+          continue;
+        }
+        if (isQrSignInSecretField(key) || typeof child === "string") {
+          rewrite(holder, key, child);
+        } else if (child !== null && typeof child === "object") {
+          if (depth + 1 > maxDepth) {
+            complete = false;
+          } else {
+            stack.push([child, depth + 1]);
+          }
+        }
+      }
     }
+    return complete;
+  } catch {
+    return false;
+  }
 }
 function isThenable(value) {
-    return (value !== null &&
-        (typeof value === 'object' || typeof value === 'function') &&
-        typeof value.then === 'function');
+  return value !== null && (typeof value === "object" || typeof value === "function") && typeof value.then === "function";
 }
-/** The record with its tokens redacted, or `null` (dropped) when that could not be done. */
 function scrubRecord(record) {
-    if (record === null || record === undefined) {
-        return record;
-    }
-    if (typeof record !== 'object') {
-        return null;
-    }
-    return redactPreviewTokensDeep(record) ? record : null;
+  if (record === null || record === void 0) {
+    return record;
+  }
+  if (typeof record !== "object") {
+    return null;
+  }
+  return redactPreviewTokensDeep(record) ? record : null;
 }
 function guard(existing) {
-    return (value, hint) => {
-        const result = existing ? existing(value, hint) : value;
-        return isThenable(result) ? result.then(scrubRecord) : scrubRecord(result);
-    };
+  return (value, hint) => {
+    const result = existing ? existing(value, hint) : value;
+    return isThenable(result) ? result.then(scrubRecord) : scrubRecord(result);
+  };
 }
-/**
- * Sentry `init` options with a redacting `beforeSend`, `beforeSendTransaction` and `beforeBreadcrumb`. Those three
- * are where an event's `request.url`, `request.query_string`, `transaction`, spans, breadcrumbs, `extra` and
- * `contexts` pass last, so redacting the whole record there needs no list of fields and covers one added later.
- * An existing hook runs FIRST and keeps its say (it can still drop the record, change it, or be asynchronous);
- * what it returns is scrubbed after it, so nothing it adds escapes. The options object passed in is not modified.
- * Every `Sentry.init` in this repository goes through this, and an architecture spec fails if one is added without.
- */
 function withPreviewTokenRedaction(options) {
-    const hooks = options;
-    return {
-        ...options,
-        beforeSend: guard(hooks.beforeSend),
-        beforeSendTransaction: guard(hooks.beforeSendTransaction),
-        beforeBreadcrumb: guard(hooks.beforeBreadcrumb),
-    };
+  const hooks = options;
+  return {
+    ...options,
+    beforeSend: guard(hooks.beforeSend),
+    beforeSendTransaction: guard(hooks.beforeSendTransaction),
+    beforeBreadcrumb: guard(hooks.beforeBreadcrumb)
+  };
 }
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  PREVIEW_TOKEN_REDACTION,
+  QR_SIGN_IN_REDACTION,
+  isQrSignInSecretField,
+  redactPreviewTokens,
+  redactPreviewTokensDeep,
+  withPreviewTokenRedaction
+});