@takosjp/yurucommu-core 3.0.0

package/src/backend/lib/log-mask.ts

@@ -0,0 +1,213 @@
+/**
+ * PII / Secret masking for structured logging.
+ *
+ * Ported from `takos/app/packages/control/src/shared/utils/logger.ts`.
+ * Duplicated locally per F26 scope (extraction to a shared package is
+ * tracked as a follow-up).
+ *
+ * Two public helpers:
+ *  - `maskSensitiveData(value)`   recursively walks objects/arrays/strings
+ *    and returns a masked clone. Object keys matching the SENSITIVE_KEY
+ *    regex are replaced with `[redacted]`. Strings are pattern-masked.
+ *  - `maskSensitiveString(s)`     pattern-masks a single string.
+ *
+ * Both helpers are pure and never mutate the input.
+ *
+ * NOTE: This module deliberately uses `[redacted]` (lowercase) per the
+ * F26 spec. Some patterns retain the upstream `[REDACTED_*]` tokens to
+ * preserve information about the redacted *kind* (JWT, GHP, PEM, etc).
+ */
+
+interface SensitivePattern {
+  pattern: RegExp;
+  replacement: string;
+}
+
+const SENSITIVE_KEY_RE =
+  /password|secret|token|apikey|api_key|credential|private|cookie|authorization/i;
+
+const SENSITIVE_PATTERNS: ReadonlyArray<SensitivePattern> = [
+  // JWT (header.payload.signature, base64url segments)
+  {
+    pattern:
+      /\beyJ[A-Za-z0-9_-]{1,2048}\.eyJ[A-Za-z0-9_-]{1,2048}\.[A-Za-z0-9_-]{1,512}/g,
+    replacement: "[REDACTED_JWT]",
+  },
+  // Bearer / token prefixes
+  {
+    pattern: /\b(Bearer|token)\s+([A-Za-z0-9_.\-+/=]{16,512})/gi,
+    replacement: "$1 [redacted]",
+  },
+  // Stripe live / test secret keys
+  {
+    pattern: /\bsk_live_[A-Za-z0-9]{16,256}/g,
+    replacement: "[REDACTED_STRIPE_LIVE]",
+  },
+  {
+    pattern: /\bsk_test_[A-Za-z0-9]{16,256}/g,
+    replacement: "[REDACTED_STRIPE_TEST]",
+  },
+  // OpenAI-style sk- tokens
+  { pattern: /\bsk-[A-Za-z0-9]{20,256}/g, replacement: "[REDACTED_SK]" },
+  // GitHub personal access tokens
+  { pattern: /\bghp_[A-Za-z0-9]{20,256}/g, replacement: "[REDACTED_GHP]" },
+  { pattern: /\bgho_[A-Za-z0-9]{20,256}/g, replacement: "[REDACTED_GHO]" },
+  // AWS access key id
+  { pattern: /\bAKIA[0-9A-Z]{16}/g, replacement: "[REDACTED_AWS_ACCESS_KEY]" },
+  // PEM private key bodies
+  {
+    pattern:
+      /-----BEGIN\s+(?:RSA\s+|EC\s+|OPENSSH\s+|DSA\s+|PGP\s+)?PRIVATE KEY-----[\s\S]{1,16384}?-----END\s+(?:RSA\s+|EC\s+|OPENSSH\s+|DSA\s+|PGP\s+)?PRIVATE KEY-----/g,
+    replacement: "[REDACTED_PRIVATE_KEY]",
+  },
+  // password=foo / passwd: bar / secret="baz"
+  {
+    pattern:
+      /\b(password|passwd|pwd|secret|api[_-]?key|apikey|api_token|auth[_-]?token|session[_-]?id|sessionid)\s*[=:]\s*"?([^"\s,}{]{1,256})"?/gi,
+    replacement: "$1=[redacted]",
+  },
+  // Email addresses
+  {
+    pattern:
+      /([A-Za-z0-9._%+\-]{1,64})@([A-Za-z0-9.\-]{1,255}\.[A-Za-z]{2,10})/g,
+    replacement: "***@$2",
+  },
+];
+
+/** Test whether `value` looks like a real credit card via Luhn. */
+function isValidLuhn(digits: string): boolean {
+  let sum = 0;
+  let alt = false;
+  for (let i = digits.length - 1; i >= 0; i--) {
+    const ch = digits.charCodeAt(i) - 48;
+    if (ch < 0 || ch > 9) return false;
+    let n = ch;
+    if (alt) {
+      n *= 2;
+      if (n > 9) n -= 9;
+    }
+    sum += n;
+    alt = !alt;
+  }
+  return sum > 0 && sum % 10 === 0;
+}
+
+/** Mask 13-19 digit numbers that pass Luhn (credit card). */
+function maskCreditCards(input: string): string {
+  return input.replace(/\b(?:\d[ -]?){13,19}\b/g, (match) => {
+    const digits = match.replace(/[ \-]/g, "");
+    if (digits.length < 13 || digits.length > 19) return match;
+    if (!isValidLuhn(digits)) return match;
+    return "[REDACTED_CC]";
+  });
+}
+
+/**
+ * Pattern-mask a single string.
+ *
+ * Replaces JWT, Bearer tokens, Stripe / OpenAI / GitHub / AWS secrets,
+ * PEM private keys, password/secret/key=value pairs, email addresses,
+ * and Luhn-valid credit card numbers.
+ */
+export function maskSensitiveString(input: string): string {
+  if (typeof input !== "string" || input.length === 0) return input;
+  let result = input;
+  for (const { pattern, replacement } of SENSITIVE_PATTERNS) {
+    result = result.replace(pattern, replacement);
+  }
+  result = maskCreditCards(result);
+  return result;
+}
+
+/**
+ * Recursively mask `value`. Returns a masked clone (input is not mutated).
+ *
+ *  - `string`        -> pattern-masked
+ *  - `Array`         -> mapped element-wise
+ *  - `Object`        -> key/value walked; values for sensitive keys are
+ *                       replaced with `"[redacted]"`
+ *  - Other primitives are returned unchanged.
+ *
+ * Cycle-safe via a WeakSet on the walk path.
+ */
+export function maskSensitiveData(value: unknown): unknown {
+  return walk(value, new WeakSet<object>());
+}
+
+function walk(value: unknown, seen: WeakSet<object>): unknown {
+  try {
+    return walkInner(value, seen);
+  } catch {
+    // Masking must NEVER throw — a single un-serializable field would
+    // otherwise crash the entire log call (and the request that triggered
+    // it). Fall back to an opaque placeholder for any value we cannot walk.
+    return "[unserializable]";
+  }
+}
+
+function walkInner(value: unknown, seen: WeakSet<object>): unknown {
+  if (value === null || value === undefined) return value;
+  if (typeof value === "string") return maskSensitiveString(value);
+  // `bigint` is not JSON-serializable: `JSON.stringify` throws on it, which
+  // would crash the log call. Coerce to a string with the canonical `n`
+  // suffix so the value (and its bigint-ness) survives in the log.
+  if (typeof value === "bigint") return maskSensitiveString(`${value}n`);
+  // `symbol` / `function` are not JSON-serializable either; stringify them
+  // rather than letting them silently disappear or throw.
+  if (typeof value === "symbol") return value.toString();
+  if (typeof value === "function") return "[function]";
+  if (typeof value !== "object") return value;
+
+  if (seen.has(value as object)) return "[circular]";
+  seen.add(value as object);
+
+  if (Array.isArray(value)) {
+    return value.map((entry) => walk(entry, seen));
+  }
+
+  // Preserve Error shape (name/message/stack) but mask string fields.
+  if (value instanceof Error) {
+    return {
+      name: value.name,
+      message: maskSensitiveString(value.message),
+      stack: value.stack ? maskSensitiveString(value.stack) : undefined,
+    };
+  }
+
+  // `Date` JSON-serializes to its ISO string already, but going through the
+  // object branch below would flatten it to `{}`. Keep the ISO string.
+  if (value instanceof Date) {
+    return Number.isNaN(value.getTime())
+      ? "[invalid-date]"
+      : value.toISOString();
+  }
+
+  // `Map` / `Set` have no enumerable own properties, so the object branch
+  // would silently flatten them to `{}` (fidelity loss). Represent them as
+  // their entry/value collections with masked contents.
+  if (value instanceof Map) {
+    const out: Record<string, unknown> = {};
+    for (const [k, v] of value.entries()) {
+      const key = typeof k === "string" ? k : String(k);
+      if (SENSITIVE_KEY_RE.test(key)) {
+        out[key] = "[redacted]";
+        continue;
+      }
+      out[key] = walk(v, seen);
+    }
+    return out;
+  }
+  if (value instanceof Set) {
+    return Array.from(value, (entry) => walk(entry, seen));
+  }
+
+  const out: Record<string, unknown> = {};
+  for (const [key, child] of Object.entries(value as Record<string, unknown>)) {
+    if (SENSITIVE_KEY_RE.test(key)) {
+      out[key] = "[redacted]";
+      continue;
+    }
+    out[key] = walk(child, seen);
+  }
+  return out;
+}

package/src/backend/lib/logger.ts

@@ -0,0 +1,285 @@
+/**
+ * Structured Logger for Yurucommu
+ *
+ * Zero-dependency structured logging compatible with all runtimes
+ * (Cloudflare Workers, Node.js, Bun).
+ *
+ * - JSON output in production for observability pipelines
+ * - Human-readable output in development
+ * - Uses console.warn/console.error (ESLint-allowed) for warn/error levels
+ * - Uses console.log (with eslint-disable) only for debug/info levels
+ * - All emitted payloads pass through `maskSensitiveData` so JWTs,
+ *   bearer tokens, password/secret/token/cookie/authorization-keyed
+ *   fields, PEM keys, AWS access keys, emails, and Luhn credit cards
+ *   are redacted before they reach stdout.
+ */
+
+import { maskSensitiveData, maskSensitiveString } from "./log-mask.ts";
+
+// ---------------------------------------------------------------------------
+// Types
+// ---------------------------------------------------------------------------
+
+export type LogLevel = "debug" | "info" | "warn" | "error";
+
+const LEVEL_ORDER: Record<LogLevel, number> = {
+  debug: 0,
+  info: 1,
+  warn: 2,
+  error: 3,
+};
+
+const LEVEL_NAMES = Object.fromEntries(
+  Object.entries(LEVEL_ORDER).map(([k, v]) => [v, k]),
+) as Record<number, LogLevel>;
+
+interface LogEntry {
+  level: LogLevel;
+  msg: string;
+  ts: string;
+  service?: string;
+  [key: string]: unknown;
+}
+
+export interface LoggerOptions {
+  /** Service / component name attached to every entry */
+  service?: string;
+  /** Minimum log level (default: "debug") */
+  level?: LogLevel;
+  /** Extra fields merged into every entry */
+  defaultFields?: Record<string, unknown>;
+  /**
+   * Output format.
+   *  - "json"   : one JSON object per line (default, best for prod)
+   *  - "pretty" : human-readable coloured output (best for dev)
+   */
+  format?: "json" | "pretty";
+}
+
+export interface Logger {
+  debug(msg: string, data?: Record<string, unknown>): void;
+  info(msg: string, data?: Record<string, unknown>): void;
+  warn(msg: string, data?: Record<string, unknown>): void;
+  error(msg: string, data?: Record<string, unknown>): void;
+  /** Create a child logger that inherits settings and merges extra fields */
+  child(fields: Record<string, unknown>): Logger;
+}
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function assertNever(x: never): never {
+  throw new Error(`Unhandled log level: ${JSON.stringify(x)}`);
+}
+
+function normalizeError(value: unknown): Record<string, unknown> {
+  if (value instanceof Error) {
+    return {
+      name: value.name,
+      message: value.message,
+      stack: value.stack,
+    };
+  }
+  return { message: String(value) };
+}
+
+function formatData(
+  data?: Record<string, unknown>,
+): Record<string, unknown> | undefined {
+  if (!data) return undefined;
+  const result: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(data)) {
+    result[key] = value instanceof Error ? normalizeError(value) : value;
+  }
+  return result;
+}
+
+/** Detect whether we are likely running in a production environment. */
+function detectProduction(): boolean {
+  // Cloudflare Workers have no Node process; treat that path as production by
+  // default.
+  const processEnv = (
+    globalThis as {
+      process?: { env?: Record<string, string | undefined> };
+    }
+  ).process?.env;
+  if (!processEnv) return true;
+  const env = processEnv.NODE_ENV || "";
+  return env === "production";
+}
+
+const PRETTY_LEVEL_TAG: Record<LogLevel, string> = {
+  debug: "DBG",
+  info: "INF",
+  warn: "WRN",
+  error: "ERR",
+};
+
+// ---------------------------------------------------------------------------
+// Implementation
+// ---------------------------------------------------------------------------
+
+/** @internal */
+interface InternalOptions extends LoggerOptions {
+  _fields?: Record<string, unknown>;
+}
+
+class LoggerImpl implements Logger {
+  private minLevel: number;
+  private service?: string;
+  private fields: Record<string, unknown>;
+  private useJson: boolean;
+
+  constructor(opts?: InternalOptions) {
+    this.minLevel = LEVEL_ORDER[opts?.level ?? "debug"];
+    this.service = opts?.service;
+    this.fields = { ...opts?.defaultFields, ...opts?._fields };
+
+    if (opts?.format) {
+      this.useJson = opts.format === "json";
+    } else {
+      this.useJson = detectProduction();
+    }
+  }
+
+  // ---- core emit ----------------------------------------------------------
+
+  private emit(
+    level: LogLevel,
+    msg: string,
+    data?: Record<string, unknown>,
+  ): void {
+    if (LEVEL_ORDER[level] < this.minLevel) return;
+
+    if (this.useJson) {
+      this.emitJson(level, msg, data);
+    } else {
+      this.emitPretty(level, msg, data);
+    }
+  }
+
+  // ---- JSON output --------------------------------------------------------
+
+  private emitJson(
+    level: LogLevel,
+    msg: string,
+    data?: Record<string, unknown>,
+  ): void {
+    const rawEntry: LogEntry = {
+      level,
+      msg,
+      ts: new Date().toISOString(),
+      ...(this.service ? { service: this.service } : {}),
+      ...this.fields,
+      ...formatData(data),
+    };
+    // Mask before serialization. `level` / `ts` / `service` are safe and
+    // are restored after masking so they always retain canonical shape.
+    const masked = maskSensitiveData(rawEntry) as Record<string, unknown>;
+    const entry: LogEntry = {
+      ...masked,
+      level: rawEntry.level,
+      msg: maskSensitiveString(rawEntry.msg),
+      ts: rawEntry.ts,
+      ...(rawEntry.service ? { service: rawEntry.service } : {}),
+    };
+    const line = JSON.stringify(entry);
+    this.write(level, line);
+  }
+
+  // ---- Pretty output ------------------------------------------------------
+
+  private emitPretty(
+    level: LogLevel,
+    msg: string,
+    data?: Record<string, unknown>,
+  ): void {
+    const ts = new Date().toISOString();
+    const tag = PRETTY_LEVEL_TAG[level];
+    const svc = this.service ? ` [${this.service}]` : "";
+
+    const merged = maskSensitiveData({
+      ...this.fields,
+      ...formatData(data),
+    }) as Record<string, unknown>;
+    const extra =
+      Object.keys(merged).length > 0 ? " " + JSON.stringify(merged) : "";
+
+    const line = `${ts} ${tag}${svc} ${maskSensitiveString(msg)}${extra}`;
+    this.write(level, line);
+  }
+
+  // ---- console dispatch ---------------------------------------------------
+
+  private write(level: LogLevel, line: string): void {
+    switch (level) {
+      case "debug":
+      case "info":
+        // eslint-disable-next-line no-console
+        console.log(line);
+        break;
+      case "warn":
+        console.warn(line);
+        break;
+      case "error":
+        console.error(line);
+        break;
+      default:
+        assertNever(level);
+    }
+  }
+
+  // ---- public API ---------------------------------------------------------
+
+  debug(msg: string, data?: Record<string, unknown>): void {
+    this.emit("debug", msg, data);
+  }
+
+  info(msg: string, data?: Record<string, unknown>): void {
+    this.emit("info", msg, data);
+  }
+
+  warn(msg: string, data?: Record<string, unknown>): void {
+    this.emit("warn", msg, data);
+  }
+
+  error(msg: string, data?: Record<string, unknown>): void {
+    this.emit("error", msg, data);
+  }
+
+  child(fields: Record<string, unknown>): Logger {
+    return new LoggerImpl({
+      level: LEVEL_NAMES[this.minLevel],
+      service: this.service,
+      format: this.useJson ? "json" : "pretty",
+      _fields: { ...this.fields, ...fields },
+    });
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+
+/**
+ * Create a new logger instance.
+ *
+ * @example
+ * ```ts
+ * const log = createLogger({ service: 'activitypub', level: 'info' });
+ * log.info('inbox received', { actorId: '...' });
+ *
+ * const childLog = log.child({ requestId: crypto.randomUUID() });
+ * childLog.warn('signature verification slow', { durationMs: 430 });
+ * ```
+ */
+export function createLogger(opts?: LoggerOptions): Logger {
+  return new LoggerImpl(opts);
+}
+
+/**
+ * Default logger instance for quick usage.
+ * Service name defaults to "yurucommu".
+ */
+export const logger: Logger = createLogger({ service: "yurucommu" });

package/src/backend/lib/mobile-contract.ts

@@ -0,0 +1,137 @@
+export const MOBILE_PUSH_REGISTRATION_PATH =
+  "/api/mobile/push-registrations" as const;
+
+export const SOCIAL_CLIENT_KINDS = ["yurucommu", "yurume"] as const;
+
+export type SocialClientKind = (typeof SOCIAL_CLIENT_KINDS)[number];
+export type MobileProductKind = SocialClientKind;
+
+export interface MobilePushHostRegistrationRequest {
+  readonly product: MobileProductKind;
+  readonly token: string;
+  readonly environment?: string;
+  readonly host_url?: string | null;
+}
+
+export interface ParsedMobilePushHostRegistrationRequest {
+  readonly product: MobileProductKind;
+  readonly token: string;
+  readonly environment: string;
+  readonly hostUrl: string | null;
+}
+
+export interface MobilePushHostRegistration {
+  readonly id: string;
+  readonly product: MobileProductKind;
+  readonly environment: string;
+  readonly host_url: string | null;
+  readonly registered_at: string;
+  readonly last_seen_at: string;
+}
+
+export interface MobilePushHostUnregistrationResponse {
+  readonly unregistered: true;
+}
+
+export interface MobilePushHostRegistrationParseError {
+  readonly code: "BAD_REQUEST";
+  readonly error: string;
+  readonly field?: keyof MobilePushHostRegistrationRequest;
+}
+
+export type MobilePushHostRegistrationParseResult =
+  | {
+      readonly ok: true;
+      readonly value: ParsedMobilePushHostRegistrationRequest;
+    }
+  | {
+      readonly ok: false;
+      readonly error: MobilePushHostRegistrationParseError;
+    };
+
+export function parseMobilePushHostRegistrationRequest(
+  body: unknown,
+): MobilePushHostRegistrationParseResult {
+  if (!isRecord(body)) {
+    return badRequest("body must be an object");
+  }
+
+  const product = parseMobileProductKind(body.product);
+  if (!product) {
+    return badRequest("product must be yurucommu or yurume", "product");
+  }
+
+  const token = parseNonEmptyString(body.token);
+  if (!token || token.length > 4096) {
+    return badRequest("token is invalid", "token");
+  }
+
+  const environment =
+    body.environment == null
+      ? "production"
+      : parseShortIdentifier(body.environment);
+  if (!environment) {
+    return badRequest("environment is invalid", "environment");
+  }
+
+  const hostUrl = parseOptionalHttpUrl(body.host_url);
+  if (hostUrl === undefined) {
+    return badRequest("host_url is invalid", "host_url");
+  }
+
+  return {
+    ok: true,
+    value: {
+      product,
+      token,
+      environment,
+      hostUrl,
+    },
+  };
+}
+
+function badRequest(
+  error: string,
+  field?: keyof MobilePushHostRegistrationRequest,
+): MobilePushHostRegistrationParseResult {
+  return { ok: false, error: { code: "BAD_REQUEST", error, field } };
+}
+
+function parseShortIdentifier(value: unknown): string | null {
+  const text = parseNonEmptyString(value);
+  if (!text || text.length > 64) return null;
+  return /^[a-z0-9._:-]+$/i.test(text) ? text : null;
+}
+
+function parseNonEmptyString(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+
+function parseMobileProductKind(value: unknown): MobileProductKind | null {
+  if (typeof value !== "string") return null;
+  return SOCIAL_CLIENT_KINDS.includes(value as SocialClientKind)
+    ? (value as SocialClientKind)
+    : null;
+}
+
+function parseOptionalHttpUrl(value: unknown): string | null | undefined {
+  if (value == null) return null;
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  if (!trimmed || trimmed.length > 2048) return undefined;
+  try {
+    const parsed = new URL(trimmed);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      return undefined;
+    }
+    return parsed.toString().replace(/\/$/, "");
+  } catch {
+    return undefined;
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}