@sudobility/sider_lib 0.0.8 → 0.0.10

package/dist/correlation.d.ts

@@ -0,0 +1,2 @@
+/** Whether a header names request tracing that can be dropped rather than resolved. */
+export declare function isCorrelationHeader(name: string): boolean;

package/dist/correlation.js

@@ -0,0 +1,28 @@
+// Headers that identify a REQUEST, not a person.
+//
+// `x-ebay-c-correlation-session` is a per-page correlation id: it ties a page's
+// calls together in eBay's own logs and carries no authority whatsoever. It was
+// treated as a credential because its name ends in "session", and the fallout
+// was worse than noise — nothing local holds such a value, so egress could not
+// resolve it, the call was blocked, and the agent told a signed-in user to sign
+// in. The actual eBay session is a cookie the browser attaches by itself.
+//
+// A correlation header is safe to omit. The server mints its own when it is
+// missing, which is exactly what happens on a request the site makes itself.
+/** Names that mark a header as request-scoped tracing rather than a credential. */
+const CORRELATION_RE = /correlation|traceparent|tracestate|\btrace\b|request[-_]?id|\breq[-_]?id\b|\bspan\b|\bray\b|\bb3\b/i;
+/**
+ * Names that are unambiguously credentials, whatever else they contain.
+ *
+ * Checked first so a hypothetical `x-csrf-correlation` stays a secret. Weak
+ * words like "session", "token" and "id" are deliberately NOT here: those are
+ * the ones correlation headers routinely contain, and treating them as decisive
+ * is the mistake being fixed.
+ */
+const CREDENTIAL_RE = /authorization|bearer|csrf|xsrf|api[-_]?key|apikey|secret|password/i;
+/** Whether a header names request tracing that can be dropped rather than resolved. */
+export function isCorrelationHeader(name) {
+    if (CREDENTIAL_RE.test(name))
+        return false;
+    return CORRELATION_RE.test(name);
+}

package/dist/execute.js

@@ -4,6 +4,7 @@
 // TokenMap) and substitutes it into the sentinel positions the gates already
 // proved are confined to the declared location.
 import { compileRecipe, secretSentinel } from "./recipe";
+import { isCorrelationHeader } from "./correlation";
 import { evaluateGates } from "./gates";
 export function detokenizeRequest(req, resolve, slotsById) {
     let url = req.url;
@@ -15,8 +16,21 @@ export function detokenizeRequest(req, resolve, slotsById) {
         if (slot && (slot.role === "auto_cookie" || slot.injectionLocation.at === "cookie"))
             continue;
         const value = resolve(slotId);
-        if (value === undefined)
+        if (value === undefined) {
+            // A correlation header that cannot be resolved is dropped, not fatal.
+            // Slots minted before these were recognised still sit in the registry,
+            // and every one of them would otherwise block a call the user's own
+            // session can make — the site issues a fresh id when the header is absent.
+            if (slot && slot.injectionLocation.at === "header" && isCorrelationHeader(slot.injectionLocation.name)) {
+                delete headers[slot.injectionLocation.name];
+                const sen = secretSentinel(slotId);
+                url = url.split(sen).join("");
+                if (bodyStr !== undefined)
+                    bodyStr = bodyStr.split(sen).join("");
+                continue;
+            }
             throw new Error(`Unresolved secret slot at egress: ${slotId}`);
+        }
         const sen = secretSentinel(slotId);
         url = url.split(sen).join(value);
         for (const k of Object.keys(headers))

package/dist/gates.test.js

@@ -109,3 +109,24 @@ test("cookie-borne slot is refused (must be auto-attached, never injected)", ()
     if (!out.ok)
         expect(out.gate).toBe("injection_location");
 });
+// --- correlation headers ----------------------------------------------------
+import { isCorrelationHeader } from "./correlation";
+test("a correlation id is not a credential", () => {
+    // The header that blocked a signed-in user's call: it ends in "session", so
+    // the name rule claimed it, and no local store holds a per-page trace id.
+    expect(isCorrelationHeader("x-ebay-c-correlation-session")).toBe(true);
+    expect(isCorrelationHeader("x-request-id")).toBe(true);
+    expect(isCorrelationHeader("traceparent")).toBe(true);
+});
+test("real credentials are still credentials, whatever else the name says", () => {
+    expect(isCorrelationHeader("authorization")).toBe(false);
+    expect(isCorrelationHeader("cookie")).toBe(false);
+    expect(isCorrelationHeader("x-csrf-token")).toBe(false);
+    expect(isCorrelationHeader("x-api-key")).toBe(false);
+    // Contains a correlation word AND an unambiguous credential word: the
+    // credential wins, because dropping it would send an unauthenticated call.
+    expect(isCorrelationHeader("x-csrf-correlation")).toBe(false);
+});
+test("a session header with no correlation marker stays a secret", () => {
+    expect(isCorrelationHeader("x-session-id")).toBe(false);
+});

package/dist/tokenize.js

@@ -10,6 +10,7 @@
 //   3. Body fields whose KEY looks credential-bearing (e.g. access_token).
 //   4. JWT-shaped strings anywhere in a body.
 // Bias is conservative-for-privacy: over-mask rather than leak.
+import { isCorrelationHeader } from "./correlation";
 export function samplePlaceholder(slotId) {
     return `{{secret:${slotId}}}`;
 }
@@ -78,6 +79,11 @@ export function tokenizeObservation(raw, known) {
             continue;
         if (!SECRET_HEADER_RE.test(name))
             continue;
+        // A correlation id is not a credential. Minting a slot for one guarantees a
+        // block later: no local store holds a per-page trace id, so the call dies
+        // at egress for want of a value the site does not need sent.
+        if (isCorrelationHeader(name))
+            continue;
         const lname = name.toLowerCase();
         const slotId = `slot:${host}:${normalize(name)}`;
         headers[name] = samplePlaceholder(slotId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sudobility/sider_lib",
-  "version": "0.0.8",
+  "version": "0.0.10",
   "description": "Sider business logic — recipe compiler, egress gates, tokenizer, clustering. Pure, no Chrome/DOM/server.",
   "license": "BUSL-1.1",
   "publishConfig": {
@@ -19,7 +19,7 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@sudobility/sider_types": "^0.0.10"
+    "@sudobility/sider_types": "^0.0.11"
   },
   "devDependencies": {
     "@types/bun": "^1.3.14",

package/src/correlation.ts

@@ -0,0 +1,30 @@
+// Headers that identify a REQUEST, not a person.
+//
+// `x-ebay-c-correlation-session` is a per-page correlation id: it ties a page's
+// calls together in eBay's own logs and carries no authority whatsoever. It was
+// treated as a credential because its name ends in "session", and the fallout
+// was worse than noise — nothing local holds such a value, so egress could not
+// resolve it, the call was blocked, and the agent told a signed-in user to sign
+// in. The actual eBay session is a cookie the browser attaches by itself.
+//
+// A correlation header is safe to omit. The server mints its own when it is
+// missing, which is exactly what happens on a request the site makes itself.
+
+/** Names that mark a header as request-scoped tracing rather than a credential. */
+const CORRELATION_RE = /correlation|traceparent|tracestate|\btrace\b|request[-_]?id|\breq[-_]?id\b|\bspan\b|\bray\b|\bb3\b/i;
+
+/**
+ * Names that are unambiguously credentials, whatever else they contain.
+ *
+ * Checked first so a hypothetical `x-csrf-correlation` stays a secret. Weak
+ * words like "session", "token" and "id" are deliberately NOT here: those are
+ * the ones correlation headers routinely contain, and treating them as decisive
+ * is the mistake being fixed.
+ */
+const CREDENTIAL_RE = /authorization|bearer|csrf|xsrf|api[-_]?key|apikey|secret|password/i;
+
+/** Whether a header names request tracing that can be dropped rather than resolved. */
+export function isCorrelationHeader(name: string): boolean {
+  if (CREDENTIAL_RE.test(name)) return false;
+  return CORRELATION_RE.test(name);
+}

package/src/execute.ts

@@ -6,6 +6,7 @@
 
 import type { CompiledRequest, SecretSlot } from "@sudobility/sider_types";
 import { compileRecipe, secretSentinel } from "./recipe";
+import { isCorrelationHeader } from "./correlation";
 import { evaluateGates } from "./gates";
 import type { ToolSpec } from "@sudobility/sider_types";
 import type { CompileContext } from "./recipe";
@@ -37,7 +38,20 @@ export function detokenizeRequest(
     if (slot && (slot.role === "auto_cookie" || slot.injectionLocation.at === "cookie")) continue;
 
     const value = resolve(slotId);
-    if (value === undefined) throw new Error(`Unresolved secret slot at egress: ${slotId}`);
+    if (value === undefined) {
+      // A correlation header that cannot be resolved is dropped, not fatal.
+      // Slots minted before these were recognised still sit in the registry,
+      // and every one of them would otherwise block a call the user's own
+      // session can make — the site issues a fresh id when the header is absent.
+      if (slot && slot.injectionLocation.at === "header" && isCorrelationHeader(slot.injectionLocation.name)) {
+        delete headers[slot.injectionLocation.name];
+        const sen = secretSentinel(slotId);
+        url = url.split(sen).join("");
+        if (bodyStr !== undefined) bodyStr = bodyStr.split(sen).join("");
+        continue;
+      }
+      throw new Error(`Unresolved secret slot at egress: ${slotId}`);
+    }
 
     const sen = secretSentinel(slotId);
     url = url.split(sen).join(value);

package/src/gates.test.ts

@@ -122,3 +122,29 @@ test("cookie-borne slot is refused (must be auto-attached, never injected)", ()
   expect(out.ok).toBe(false);
   if (!out.ok) expect(out.gate).toBe("injection_location");
 });
+
+// --- correlation headers ----------------------------------------------------
+
+import { isCorrelationHeader } from "./correlation";
+
+test("a correlation id is not a credential", () => {
+  // The header that blocked a signed-in user's call: it ends in "session", so
+  // the name rule claimed it, and no local store holds a per-page trace id.
+  expect(isCorrelationHeader("x-ebay-c-correlation-session")).toBe(true);
+  expect(isCorrelationHeader("x-request-id")).toBe(true);
+  expect(isCorrelationHeader("traceparent")).toBe(true);
+});
+
+test("real credentials are still credentials, whatever else the name says", () => {
+  expect(isCorrelationHeader("authorization")).toBe(false);
+  expect(isCorrelationHeader("cookie")).toBe(false);
+  expect(isCorrelationHeader("x-csrf-token")).toBe(false);
+  expect(isCorrelationHeader("x-api-key")).toBe(false);
+  // Contains a correlation word AND an unambiguous credential word: the
+  // credential wins, because dropping it would send an unauthenticated call.
+  expect(isCorrelationHeader("x-csrf-correlation")).toBe(false);
+});
+
+test("a session header with no correlation marker stays a secret", () => {
+  expect(isCorrelationHeader("x-session-id")).toBe(false);
+});

package/src/tokenize.ts

@@ -11,6 +11,7 @@
 //   4. JWT-shaped strings anywhere in a body.
 // Bias is conservative-for-privacy: over-mask rather than leak.
 
+import { isCorrelationHeader } from "./correlation";
 import type {
   HttpMethod,
   InjectionLocation,
@@ -125,6 +126,10 @@ export function tokenizeObservation(raw: RawObservation, known: KnownSecret[]):
     const val = headers[name];
     if (typeof val !== "string" || !val || val.startsWith("{{secret:")) continue;
     if (!SECRET_HEADER_RE.test(name)) continue;
+    // A correlation id is not a credential. Minting a slot for one guarantees a
+    // block later: no local store holds a per-page trace id, so the call dies
+    // at egress for want of a value the site does not need sent.
+    if (isCorrelationHeader(name)) continue;
     const lname = name.toLowerCase();
     const slotId = `slot:${host}:${normalize(name)}`;
     headers[name] = samplePlaceholder(slotId);