@sonisoft/now-sdk-ext-core 5.0.1 → 5.2.0

package/dist/util/redact.js

@@ -0,0 +1,228 @@
+/**
+ * Removes credential material from values before they are logged or thrown.
+ *
+ * The failure this exists for is not hypothetical. `RequestHandler.getRequestConfig`
+ * builds `{auth: this._session, ...}` and the next line logs that whole object at
+ * debug level, so every request wrote a live session — cookies, user token, or an
+ * OAuth access token — into `logs/app-debug.log`. That is what forced the `^logs/`
+ * allowlist in `.gitleaks.toml`.
+ *
+ * Redaction is by KEY, not by value. A value-based approach needs a registry of the
+ * secrets currently in play, which does not exist at the point a Winston format runs.
+ * Key-based matching costs nothing and catches the shape of the problem: secrets in
+ * this codebase always arrive under a recognisable name (`auth`, `cookie`,
+ * `access_token`, …) because they come from the SDK's own session objects.
+ */
+export const REDACTED = "[redacted]";
+/**
+ * Keys whose values must never be logged. Matched case-insensitively against the
+ * whole key, plus a substring pass for compound names like `sessionToken`.
+ */
+const SECRET_KEYS = [
+    "auth",
+    "authorization",
+    "session",
+    "credential",
+    "credentials",
+    "password",
+    "passwd",
+    "secret",
+    "client_secret",
+    "clientsecret",
+    "token",
+    "access_token",
+    "refresh_token",
+    "id_token",
+    "usertoken",
+    "cookie",
+    "cookies",
+    "set-cookie",
+    "csrftoken",
+    "sysparm_ck",
+    "apikey",
+    "api_key",
+];
+/** Substrings that make a key secret regardless of what surrounds them. */
+const SECRET_FRAGMENTS = [
+    "password",
+    "secret",
+    "token",
+    "cookie",
+    "credential",
+];
+/** Depth cap. Session and response graphs are deep; nothing useful lives past this. */
+const MAX_DEPTH = 8;
+export function isSecretKey(key) {
+    if (!key) {
+        return false;
+    }
+    const lowered = key.toLowerCase();
+    if (SECRET_KEYS.includes(lowered)) {
+        return true;
+    }
+    return SECRET_FRAGMENTS.some((fragment) => lowered.includes(fragment));
+}
+/**
+ * Returns a copy of `value` with every secret-shaped key replaced by `[redacted]`.
+ *
+ * Never mutates the input — callers are logging live objects that the rest of the
+ * request still depends on. Cycles, depth overruns, and unserializable values all
+ * degrade to a placeholder string rather than throwing: a logger that throws is worse
+ * than one that omits a field.
+ */
+export function redactValue(value, depth = 0, seen) {
+    if (value === null || value === undefined) {
+        return value;
+    }
+    const primitive = typeof value !== "object" && typeof value !== "function";
+    if (primitive) {
+        return value;
+    }
+    if (depth >= MAX_DEPTH) {
+        return "[truncated]";
+    }
+    const tracker = seen ?? new WeakSet();
+    if (tracker.has(value)) {
+        return "[circular]";
+    }
+    tracker.add(value);
+    if (typeof value === "function") {
+        return "[function]";
+    }
+    if (value instanceof Error) {
+        return redactError(value, depth, tracker);
+    }
+    if (value instanceof Date) {
+        return value;
+    }
+    // tough-cookie CookieJar and similar: walking them yields the cookie values we are
+    // trying to suppress, and their internals are not useful in a log line anyway.
+    const constructorName = value?.constructor?.name ?? "";
+    if (/cookiejar|cookie/i.test(constructorName)) {
+        return REDACTED;
+    }
+    if (Array.isArray(value)) {
+        return value.map((entry) => redactValue(entry, depth + 1, tracker));
+    }
+    if (value instanceof Map) {
+        const out = {};
+        for (const [key, entry] of value.entries()) {
+            const name = String(key);
+            out[name] = isSecretKey(name) ? REDACTED : redactValue(entry, depth + 1, tracker);
+        }
+        return out;
+    }
+    if (value instanceof Set) {
+        return [...value].map((entry) => redactValue(entry, depth + 1, tracker));
+    }
+    const record = value;
+    const out = {};
+    for (const key of Object.keys(record)) {
+        if (isSecretKey(key)) {
+            out[key] = REDACTED;
+            continue;
+        }
+        try {
+            out[key] = redactValue(record[key], depth + 1, tracker);
+        }
+        catch {
+            // A throwing getter must not take the log line down with it.
+            out[key] = "[unreadable]";
+        }
+    }
+    return out;
+}
+/**
+ * Strips credential material from an error **in place** and returns it.
+ *
+ * Used before rethrowing, so the error that reaches a consumer carries nothing
+ * sensitive. Deliberately mutates rather than returning a replacement: consumers do
+ * `instanceof` checks against it (StaleInstanceError, and the CLI's remediation
+ * duck-typing), and rebuilding the error would break both and discard the stack.
+ *
+ * This matters more since sessions stopped being flattened at the throw sites: an
+ * error now reaches callers with `config` and `response` intact, and their loggers do
+ * not have core's redaction format.
+ */
+export function stripSecretsFromError(error) {
+    if (!error || typeof error !== "object") {
+        return error;
+    }
+    const err = error;
+    for (const key of Object.keys(err)) {
+        if (isSecretKey(key)) {
+            err[key] = REDACTED;
+            continue;
+        }
+        const child = err[key];
+        if (child && typeof child === "object") {
+            try {
+                err[key] = redactValue(child);
+            }
+            catch {
+                err[key] = "[unreadable]";
+            }
+        }
+    }
+    // `cause` has to be handled by name. `new Error(msg, {cause})` installs it as a
+    // NON-ENUMERABLE own property, so the Object.keys loop above never sees it — and
+    // a wrapped network or auth failure is exactly the shape that carries a
+    // credential-bearing cause. Reassigned through the same descriptor so it stays
+    // non-enumerable and does not start showing up in JSON.stringify output.
+    if ("cause" in err) {
+        try {
+            const redactedCause = isSecretKey("cause") ? REDACTED : redactValue(err.cause);
+            Object.defineProperty(err, "cause", {
+                value: redactedCause,
+                writable: true,
+                enumerable: false,
+                configurable: true,
+            });
+        }
+        catch {
+            // A non-configurable cause cannot be replaced; leave it rather than throw
+            // from inside a function whose whole job is to make rethrowing safe.
+        }
+    }
+    return error;
+}
+/**
+ * Returns a plain object describing `error` with credential material removed.
+ *
+ * Kept structural rather than returning a rebuilt Error: this is for logging and for
+ * handing to a consumer, and a plain object cannot be mistaken for something throwable
+ * that has lost its prototype.
+ */
+export function redactError(error, depth = 0, seen) {
+    const tracker = seen ?? new WeakSet();
+    const err = error;
+    const out = {
+        name: err?.name,
+        message: typeof err?.message === "string" ? err.message : String(err?.message ?? ""),
+    };
+    if (typeof err?.stack === "string") {
+        out.stack = err.stack;
+    }
+    // Everything else an error may be carrying — axios-style `config`, a fetch
+    // `request`, a `response`, a `cause` — is where credentials actually hide.
+    for (const key of Object.keys(err ?? {})) {
+        if (key === "name" || key === "message" || key === "stack") {
+            continue;
+        }
+        if (isSecretKey(key)) {
+            out[key] = REDACTED;
+            continue;
+        }
+        try {
+            out[key] = redactValue(err[key], depth + 1, tracker);
+        }
+        catch {
+            out[key] = "[unreadable]";
+        }
+    }
+    if (err?.cause !== undefined && out.cause === undefined) {
+        out.cause = redactValue(err.cause, depth + 1, tracker);
+    }
+    return out;
+}
+//# sourceMappingURL=redact.js.map

package/dist/util/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/util/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AAErC;;;GAGG;AACH,MAAM,WAAW,GAAsB;IACnC,MAAM;IACN,eAAe;IACf,SAAS;IACT,YAAY;IACZ,aAAa;IACb,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,eAAe;IACf,cAAc;IACd,OAAO;IACP,cAAc;IACd,eAAe;IACf,UAAU;IACV,WAAW;IACX,QAAQ;IACR,SAAS;IACT,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,SAAS;CACZ,CAAC;AAEF,2EAA2E;AAC3E,MAAM,gBAAgB,GAAsB;IACxC,UAAU;IACV,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,YAAY;CACf,CAAC;AAEF,uFAAuF;AACvF,MAAM,SAAS,GAAG,CAAC,CAAC;AAEpB,MAAM,UAAU,WAAW,CAAC,GAAW;IACnC,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAClC,IAAI,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC,EAAE,IAAsB;IACzE,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,UAAU,CAAC;IAC3E,IAAI,SAAS,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;QACrB,OAAO,aAAa,CAAC;IACzB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,IAAI,IAAI,OAAO,EAAU,CAAC;IAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,YAAY,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAEnB,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QAC9B,OAAO,YAAY,CAAC;IACxB,CAAC;IAED,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QACzB,OAAO,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,mFAAmF;IACnF,+EAA+E;IAC/E,MAAM,eAAe,GAAG,KAAK,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC;IACvD,IAAI,mBAAmB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5C,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;YACpB,SAAS;QACb,CAAC;QACD,IAAI,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACL,6DAA6D;YAC7D,GAAG,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC;QAC9B,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CAAI,KAAQ;IAC7C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,GAAG,GAAG,KAA2C,CAAC;IACxD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;YACpB,SAAS;QACb,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACrC,IAAI,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACL,GAAG,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC;YAC9B,CAAC;QACL,CAAC;IACL,CAAC;IAED,gFAAgF;IAChF,iFAAiF;IACjF,wEAAwE;IACxE,+EAA+E;IAC/E,yEAAyE;IACzE,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC;YACD,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/E,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE;gBAChC,KAAK,EAAE,aAAa;gBACpB,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,KAAK;gBACjB,YAAY,EAAE,IAAI;aACrB,CAAC,CAAC;QACP,CAAC;QAAC,MAAM,CAAC;YACL,0EAA0E;YAC1E,qEAAqE;QACzE,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACvB,KAAc,EACd,KAAK,GAAG,CAAC,EACT,IAAsB;IAEtB,MAAM,OAAO,GAAG,IAAI,IAAI,IAAI,OAAO,EAAU,CAAC;IAC9C,MAAM,GAAG,GAAG,KAAwC,CAAC;IAErD,MAAM,GAAG,GAA4B;QACjC,IAAI,EAAE,GAAG,EAAE,IAAI;QACf,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC;KACvF,CAAC;IAEF,IAAI,OAAO,GAAG,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IAC1B,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;QACvC,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACzD,SAAS;QACb,CAAC;QACD,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;YACpB,SAAS;QACb,CAAC;QACD,IAAI,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACL,GAAG,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC;QAC9B,CAAC;IACL,CAAC;IAED,IAAI,GAAG,EAAE,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACtD,GAAG,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,GAAG,CAAC;AACf,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sonisoft/now-sdk-ext-core",
-  "version": "5.0.1",
+  "version": "5.2.0",
   "description": "Comprehensive TypeScript library extending ServiceNow SDK with application management, ATF testing, real-time log monitoring, AMB event subscriptions, and automation tools",
   "keywords": [
     "servicenow",
@@ -144,5 +144,8 @@
   },
   "engines": {
     "node": ">=26.0.0"
+  },
+  "optionalDependencies": {
+    "@sonisoft/sn-credstore": "^1.0.0"
   }
 }