@steve31415/baselib 3.0.1 → 3.0.2

package/dist/s2s.d.ts

@@ -1,5 +1,5 @@
 import { OAuth2Client } from 'google-auth-library';
-import type { Logger } from './log-core.js';
+import { type Logger } from './log-core.js';
 /** The fleet coding agent's service-account email, read from AGENT_SA — set at
  * deploy time by each service (SECURITY.md: agents have full access, so
  * grantAllows always admits this identity). Env-driven rather than a baked-in
@@ -45,6 +45,10 @@ export interface ResolvedCaller {
         error: string;
     };
 }
+/** `message` with every occurrence of `token` — and of each of its
+ *  dot-separated segments of 8+ chars, since some verifier messages quote a
+ *  single segment — replaced by `<token>`, then truncated. */
+export declare function redactToken(message: string, token: string): string;
 /** Resolve and authorize an s2s caller from a request's Authorization header.
  *  Shared by s2sAuth() and auth.ts's requireIdentity(). */
 export declare function resolveS2sCaller(opts: S2sOptions & {

package/dist/s2s.js

@@ -14,7 +14,9 @@
 // allowed (SECURITY.md: agents have full access).
 import { createMiddleware } from 'hono/factory';
 import { OAuth2Client } from 'google-auth-library';
+import { createHash } from 'node:crypto';
 import { authMode } from './config.js';
+import { truncate } from './log-core.js';
 /** The fleet coding agent's service-account email, read from AGENT_SA — set at
  * deploy time by each service (SECURITY.md: agents have full access, so
  * grantAllows always admits this identity). Env-driven rather than a baked-in
@@ -60,6 +62,16 @@ export class RateLimiter {
         return w.count <= this.perMinute;
     }
 }
+/** `message` with every occurrence of `token` — and of each of its
+ *  dot-separated segments of 8+ chars, since some verifier messages quote a
+ *  single segment — replaced by `<token>`, then truncated. */
+export function redactToken(message, token) {
+    const parts = [token, ...token.split('.')].filter((p) => p.length >= 8);
+    let out = message;
+    for (const p of parts)
+        out = out.split(p).join('<token>');
+    return truncate(out, 300);
+}
 /** Resolve and authorize an s2s caller from a request's Authorization header.
  *  Shared by s2sAuth() and auth.ts's requireIdentity(). */
 export async function resolveS2sCaller(opts, headers, method, path) {
@@ -83,7 +95,17 @@ export async function resolveS2sCaller(opts, headers, method, path) {
             email = payload.email;
         }
         catch (err) {
-            opts.logger?.warn('s2s token verification failed', { error: err, path });
+            // google-auth-library quotes the presented token in its error messages
+            // ("Wrong number of segments in token: <jwt>", "Invalid token signature:
+            // <jwt>"), so the error is never logged as-is: the token's shape and a
+            // redacted message only (PW LESSONS 2026-09-02 — log the shape, never
+            // the credential). Found by Mirror2's device-key design review.
+            opts.logger?.warn('s2s token verification failed', {
+                path,
+                reason: redactToken(err instanceof Error ? err.message : String(err), m[1]),
+                tokenLength: m[1].length,
+                tokenHashPrefix: createHash('sha256').update(m[1]).digest('hex').slice(0, 8),
+            });
             return { failure: { status: 401, error: 'invalid token' } };
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steve31415/baselib",
-  "version": "3.0.1",
+  "version": "3.0.2",
   "description": "Plasticine new-world shared platform library: logging, auth, service-to-service auth, db, HTTP, sync, app updates",
   "type": "module",
   "license": "MIT",