@ttt-productions/ttt-core 0.79.21 → 0.79.22
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"safety-telemetry-patterns.d.ts","sourceRoot":"","sources":["../../src/constants/safety-telemetry-patterns.ts"],"names":[],"mappings":"AAoBA,mFAAmF;AACnF,eAAO,MAAM,qBAAqB,iJAKxB,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,
|
|
1
|
+
{"version":3,"file":"safety-telemetry-patterns.d.ts","sourceRoot":"","sources":["../../src/constants/safety-telemetry-patterns.ts"],"names":[],"mappings":"AAoBA,mFAAmF;AACnF,eAAO,MAAM,qBAAqB,iJAKxB,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAqC/D,CAAC"}
|
|
@@ -41,6 +41,15 @@ export const TTT_FORBIDDEN_TELEMETRY_PATTERNS = [
|
|
|
41
41
|
/\bnciiEvidence\/[^\s"']+/gi,
|
|
42
42
|
/\bnciiAuthorityEvidence\/[^\s"']+/gi,
|
|
43
43
|
/\bevidence\/[a-zA-Z0-9._-]+\/[a-f0-9]{16,}[^\s"']*/gi,
|
|
44
|
+
// --- Restricted SAFETY DOCUMENT paths carrying a statutory request id. ---
|
|
45
|
+
// A take-it-down request id and its request-scoped removal-deadline monitor id are
|
|
46
|
+
// restricted identifiers: Cloud Logging keeps them (the operator-only triage surface),
|
|
47
|
+
// Sentry never does. The app's own emit points are minimized by construction, but a
|
|
48
|
+
// THIRD-PARTY error message routinely embeds the document path it failed on — a Firestore
|
|
49
|
+
// NOT_FOUND names `safetySlaMonitors/{requestId}__nciiRemovalDeadline` verbatim — and that
|
|
50
|
+
// is precisely what this defense-in-depth layer exists to catch.
|
|
51
|
+
/\bsafetySlaMonitors\/[^\s"']+/gi,
|
|
52
|
+
/\btakeItDownRequests\/[^\s"']+/gi,
|
|
44
53
|
// --- PhotoDNA detector-hash shape: a 64-hex string (sha256 / detector hash). ---
|
|
45
54
|
/\b[a-f0-9]{64}\b/gi,
|
|
46
55
|
// --- NCMEC credential markers. ---
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"safety-telemetry-patterns.js","sourceRoot":"","sources":["../../src/constants/safety-telemetry-patterns.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,gFAAgF;AAChF,yEAAyE;AACzE,8EAA8E;AAC9E,4EAA4E;AAC5E,oEAAoE;AACpE,+EAA+E;AAC/E,qEAAqE;AACrE,uEAAuE;AACvE,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAChF,iEAAiE;AACjE,sEAAsE;AACtE,4EAA4E;AAC5E,0EAA0E;AAC1E,gFAAgF;AAChF,+EAA+E;AAE/E,mFAAmF;AACnF,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,mCAAmC;IACnC,oCAAoC;IACpC,2BAA2B;IAC3B,4BAA4B;CACpB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAwB;IACnE,uFAAuF;IACvF,4EAA4E;IAC5E,GAAG,qBAAqB,CAAC,GAAG,CAC1B,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,MAAM,CACR,qBAAqB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAC1D,IAAI,CACL,CACJ;IACD,uFAAuF;IACvF,sFAAsF;IAEtF,sEAAsE;IACtE,6FAA6F;IAC7F,gGAAgG;IAChG,4BAA4B;IAC5B,qCAAqC;IACrC,sDAAsD;IAEtD,kFAAkF;IAClF,oBAAoB;IAEpB,oCAAoC;IACpC,sFAAsF;IACtF,+CAA+C;IAC/C,qFAAqF;CACtF,CAAC","sourcesContent":["// ============================================================================\n// SAFETY TELEMETRY FORBIDDEN PATTERNS — the ONE declaration of the TTT-specific\n// forbidden-pattern set for the CSAM/NCII subsystem, injected into every\n// `createTelemetryScrubber({ patterns })` call (frontend client + nodejs/edge\n// inits AND the backend Sentry init). Consolidated here 2026-07-13 from the\n// former duplicate pair (functions/src/shared/safety-telemetry.ts ↔\n// src/lib/safety-telemetry-patterns.ts). Deliberately dependency-free: entries\n// are `RegExp | string`, structurally identical to monitoring-core's\n// `ForbiddenPattern`, so ttt-core needs no monitoring-core dependency.\n//\n// The patterns are SPECIFIC (→ low collateral on ordinary errors) and reference\n// the real storage prefixes + default project bucket hostnames used by the app:\n// - `nciiEvidence/`, `nciiAuthorityEvidence/` (public evidence key prefixes),\n// - `evidence/` (the SAFETY_EVIDENCE_BUCKET vault key prefix),\n// - the dev + prod default Firebase Storage buckets plus the legacy\n// `.appspot.com` form and the raw `storage.googleapis.com` object host.\n// Merged AFTER monitoring-core's generic DEFAULT_FORBIDDEN_PATTERNS (IPs,\n// bearer/authorization tokens, credential assignments) at every injection site.\n// ============================================================================\n\n/** The dev + prod default Firebase Storage bucket hostnames (apphosting*.yaml). */\nexport const EVIDENCE_BUCKET_HOSTS = [\n 'ttt-dev-cfb70.firebasestorage.app',\n 'ttt-prod-cfaf3.firebasestorage.app',\n 'ttt-dev-cfb70.appspot.com',\n 'ttt-prod-cfaf3.appspot.com',\n] as const;\n\n/**\n * TTT-specific forbidden patterns for the telemetry scrubber. `string` entries are\n * treated as literals by monitoring-core (no escaping needed); `RegExp` entries are\n * matched globally against every string in the event.\n */\nexport const TTT_FORBIDDEN_TELEMETRY_PATTERNS: (RegExp | string)[] = [\n // --- Evidence-bucket URL prefixes (dev + prod), any evidence/authority-proof key. ---\n // A fully-qualified evidence object URL: <host>/<...>/nciiEvidence/... etc.\n ...EVIDENCE_BUCKET_HOSTS.map(\n (host) =>\n new RegExp(\n `https?://[^\\\\s\"']*${host.replace(/\\./g, '\\\\.')}[^\\\\s\"']*`,\n 'gi',\n ),\n ),\n // The raw GCS object host, regardless of bucket (catches storage.googleapis.com URLs).\n /https?:\\/\\/(?:storage\\.googleapis\\.com|firebasestorage\\.googleapis\\.com)\\/[^\\s\"']*/gi,\n\n // --- Evidence storage KEY prefixes (bare object paths, no host). ---\n // nciiEvidence/{requestReference}/{fileId}, nciiAuthorityEvidence/{reservationKey}/{fileId},\n // and the vault key prefix evidence/{caseId}/{digest}. Match the prefix + the rest of the path.\n /\\bnciiEvidence\\/[^\\s\"']+/gi,\n /\\bnciiAuthorityEvidence\\/[^\\s\"']+/gi,\n /\\bevidence\\/[a-zA-Z0-9._-]+\\/[a-f0-9]{16,}[^\\s\"']*/gi,\n\n // --- PhotoDNA detector-hash shape: a 64-hex string (sha256 / detector hash). ---\n /\\b[a-f0-9]{64}\\b/gi,\n\n // --- NCMEC credential markers. ---\n // The PhotoDNA subscription-key header value + any NCMEC-credential-style assignment.\n /Ocp-Apim-Subscription-Key\\s*[:=]\\s*[^\\s\"']+/gi,\n /\\bncmec[_-]?(?:api[_-]?key|secret|password|credential|token)\\b\\s*[:=]?\\s*[^\\s\"']*/gi,\n];\n"]}
|
|
1
|
+
{"version":3,"file":"safety-telemetry-patterns.js","sourceRoot":"","sources":["../../src/constants/safety-telemetry-patterns.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,gFAAgF;AAChF,yEAAyE;AACzE,8EAA8E;AAC9E,4EAA4E;AAC5E,oEAAoE;AACpE,+EAA+E;AAC/E,qEAAqE;AACrE,uEAAuE;AACvE,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAChF,iEAAiE;AACjE,sEAAsE;AACtE,4EAA4E;AAC5E,0EAA0E;AAC1E,gFAAgF;AAChF,+EAA+E;AAE/E,mFAAmF;AACnF,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,mCAAmC;IACnC,oCAAoC;IACpC,2BAA2B;IAC3B,4BAA4B;CACpB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAwB;IACnE,uFAAuF;IACvF,4EAA4E;IAC5E,GAAG,qBAAqB,CAAC,GAAG,CAC1B,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,MAAM,CACR,qBAAqB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAC1D,IAAI,CACL,CACJ;IACD,uFAAuF;IACvF,sFAAsF;IAEtF,sEAAsE;IACtE,6FAA6F;IAC7F,gGAAgG;IAChG,4BAA4B;IAC5B,qCAAqC;IACrC,sDAAsD;IAEtD,4EAA4E;IAC5E,mFAAmF;IACnF,uFAAuF;IACvF,oFAAoF;IACpF,0FAA0F;IAC1F,2FAA2F;IAC3F,iEAAiE;IACjE,iCAAiC;IACjC,kCAAkC;IAElC,kFAAkF;IAClF,oBAAoB;IAEpB,oCAAoC;IACpC,sFAAsF;IACtF,+CAA+C;IAC/C,qFAAqF;CACtF,CAAC","sourcesContent":["// ============================================================================\n// SAFETY TELEMETRY FORBIDDEN PATTERNS — the ONE declaration of the TTT-specific\n// forbidden-pattern set for the CSAM/NCII subsystem, injected into every\n// `createTelemetryScrubber({ patterns })` call (frontend client + nodejs/edge\n// inits AND the backend Sentry init). Consolidated here 2026-07-13 from the\n// former duplicate pair (functions/src/shared/safety-telemetry.ts ↔\n// src/lib/safety-telemetry-patterns.ts). Deliberately dependency-free: entries\n// are `RegExp | string`, structurally identical to monitoring-core's\n// `ForbiddenPattern`, so ttt-core needs no monitoring-core dependency.\n//\n// The patterns are SPECIFIC (→ low collateral on ordinary errors) and reference\n// the real storage prefixes + default project bucket hostnames used by the app:\n// - `nciiEvidence/`, `nciiAuthorityEvidence/` (public evidence key prefixes),\n// - `evidence/` (the SAFETY_EVIDENCE_BUCKET vault key prefix),\n// - the dev + prod default Firebase Storage buckets plus the legacy\n// `.appspot.com` form and the raw `storage.googleapis.com` object host.\n// Merged AFTER monitoring-core's generic DEFAULT_FORBIDDEN_PATTERNS (IPs,\n// bearer/authorization tokens, credential assignments) at every injection site.\n// ============================================================================\n\n/** The dev + prod default Firebase Storage bucket hostnames (apphosting*.yaml). */\nexport const EVIDENCE_BUCKET_HOSTS = [\n 'ttt-dev-cfb70.firebasestorage.app',\n 'ttt-prod-cfaf3.firebasestorage.app',\n 'ttt-dev-cfb70.appspot.com',\n 'ttt-prod-cfaf3.appspot.com',\n] as const;\n\n/**\n * TTT-specific forbidden patterns for the telemetry scrubber. `string` entries are\n * treated as literals by monitoring-core (no escaping needed); `RegExp` entries are\n * matched globally against every string in the event.\n */\nexport const TTT_FORBIDDEN_TELEMETRY_PATTERNS: (RegExp | string)[] = [\n // --- Evidence-bucket URL prefixes (dev + prod), any evidence/authority-proof key. ---\n // A fully-qualified evidence object URL: <host>/<...>/nciiEvidence/... etc.\n ...EVIDENCE_BUCKET_HOSTS.map(\n (host) =>\n new RegExp(\n `https?://[^\\\\s\"']*${host.replace(/\\./g, '\\\\.')}[^\\\\s\"']*`,\n 'gi',\n ),\n ),\n // The raw GCS object host, regardless of bucket (catches storage.googleapis.com URLs).\n /https?:\\/\\/(?:storage\\.googleapis\\.com|firebasestorage\\.googleapis\\.com)\\/[^\\s\"']*/gi,\n\n // --- Evidence storage KEY prefixes (bare object paths, no host). ---\n // nciiEvidence/{requestReference}/{fileId}, nciiAuthorityEvidence/{reservationKey}/{fileId},\n // and the vault key prefix evidence/{caseId}/{digest}. Match the prefix + the rest of the path.\n /\\bnciiEvidence\\/[^\\s\"']+/gi,\n /\\bnciiAuthorityEvidence\\/[^\\s\"']+/gi,\n /\\bevidence\\/[a-zA-Z0-9._-]+\\/[a-f0-9]{16,}[^\\s\"']*/gi,\n\n // --- Restricted SAFETY DOCUMENT paths carrying a statutory request id. ---\n // A take-it-down request id and its request-scoped removal-deadline monitor id are\n // restricted identifiers: Cloud Logging keeps them (the operator-only triage surface),\n // Sentry never does. The app's own emit points are minimized by construction, but a\n // THIRD-PARTY error message routinely embeds the document path it failed on — a Firestore\n // NOT_FOUND names `safetySlaMonitors/{requestId}__nciiRemovalDeadline` verbatim — and that\n // is precisely what this defense-in-depth layer exists to catch.\n /\\bsafetySlaMonitors\\/[^\\s\"']+/gi,\n /\\btakeItDownRequests\\/[^\\s\"']+/gi,\n\n // --- PhotoDNA detector-hash shape: a 64-hex string (sha256 / detector hash). ---\n /\\b[a-f0-9]{64}\\b/gi,\n\n // --- NCMEC credential markers. ---\n // The PhotoDNA subscription-key header value + any NCMEC-credential-style assignment.\n /Ocp-Apim-Subscription-Key\\s*[:=]\\s*[^\\s\"']+/gi,\n /\\bncmec[_-]?(?:api[_-]?key|secret|password|credential|token)\\b\\s*[:=]?\\s*[^\\s\"']*/gi,\n];\n"]}
|