@transcommerce/cwm-shared 1.1.82 → 1.1.83

package/fesm2022/transcommerce-cwm-shared.mjs

@@ -803,6 +803,51 @@ class Utilities {
             return aKeys;
         }
     };
+    /** Scrubs sensitive information from logs, such as email addresses, JWTs, tokens, GUIDs, credit card numbers, SSNs, phone numbers, and common password/username patterns.
+     * This helps prevent accidental exposure of sensitive data in logs while still allowing useful information to be retained for debugging purposes.
+     *
+     * @param input The input string or object to be scrubbed for logging. If an object is provided, it will be stringified before scrubbing.
+     * @returns A scrubbed string with sensitive information redacted.
+     * @remarks The method uses regular expressions to identify and redact various types of sensitive information. It is designed to be robust and will return a placeholder if any errors occur during the scrubbing process.
+     * @example
+     * const userData = {
+     *   email: 'user@example.com',
+     *   password: 'supersecret'
+     * };
+     * const scrubbedData = Utilities.scrubForLog(userData);
+     * console.log(scrubbedData);
+     */
+    static scrubForLog(input) {
+        try {
+            let s = typeof input === 'string' ? input : JSON.stringify(input, null, 2);
+            // redact email addresses
+            s = s.replace(/([a-zA-Z0-9._%+-]+)@([a-zA-Z0-9.-]+\.[a-zA-Z]{2,})/g, '[REDACTED_EMAIL]');
+            // redact JWTs (three dot-separated base64url segments starting with eyJ)
+            s = s.replace(/eyJ[\w-]*\.[\w-]*\.[\w-]*/g, '[REDACTED_JWT]');
+            // redact long base64-like strings ( > 40 chars of base64url) - likely tokens
+            s = s.replace(/([A-Za-z0-9_\-]{40,})/g, '[REDACTED_TOKEN]');
+            // redact GUIDs
+            s = s.replace(/\b[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\b/g, '[REDACTED_GUID]');
+            // redact credit card numbers (Visa, Mastercard, Amex, Discover)
+            s = s.replace(/\b(?:\d[ -]*?){13,19}\b/g, '[REDACTED_CC]');
+            // redact social security numbers
+            s = s.replace(/\b\d{3}-\d{2}-\d{4}\b/g, '[REDACTED_SSN]');
+            // redact phone numbers
+            s = s.replace(/\b(?:\+?1[-.\s]?)?\(?([0-9]{3})\)?[-.\s]?([0-9]{3})[-.\s]?([0-9]{4})\b/g, '[REDACTED_PHONE]');
+            // redact common password patterns (password, passwd, pwd fields with values)
+            s = s.replace(/(["\']?(?:password|passwd|pwd|secret|api[_-]?key)["\']?\s*[:=]\s*)["\']?[^\s"\']*["\']?/gi, '$1[REDACTED_PASSWORD]');
+            // redact common username patterns (username, user_name, user fields with values)
+            s = s.replace(/(["\']?(?:username|user_name|user|login)["\']?\s*[:=]\s*)["\']?[^\s"\']*["\']?/gi, '$1[REDACTED_USERNAME]');
+            // redact IP addresses
+            s = s.replace(/\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b/g, '[REDACTED_IP]');
+            // redact common ID patterns (userId, user_id, accountId, etc with values)
+            s = s.replace(/(["\']?(?:id|user_?id|account_?id|customer_?id|employee_?id)["\']?\s*[:=]\s*)["\']?[^\s"\']*["\']?/gi, '$1[REDACTED_ID]');
+            return s;
+        }
+        catch (ex) {
+            return '[UNABLE_TO_SCRUB]';
+        }
+    }
     static getHttpResponseMessages(data) {
         const responses = [];
         if (data instanceof HttpResponseBase) {