@unito/integration-sdk 1.0.26 → 1.0.27

package/dist/src/index.cjs

@@ -34,6 +34,35 @@ var LogLevel;
     LogLevel["LOG"] = "log";
     LogLevel["DEBUG"] = "debug";
 })(LogLevel || (LogLevel = {}));
+/**
+ * See https://docs.datadoghq.com/logs/log_collection/?tab=host#custom-log-forwarding
+ * - Datadog Agent splits at 256kB (256000 bytes)...
+ * - ... but the same docs say that "for optimal performance, it is
+ *   recommended that an individual log be no greater than 25kB"
+ * -> Truncating at 25kB - a bit of wiggle room for metadata = 20kB.
+ */
+const MAX_LOG_MESSAGE_SIZE = parseInt(process.env.MAX_LOG_MESSAGE_SIZE ?? '20000', 10);
+const LOG_LINE_TRUNCATED_SUFFIX = ' - LOG LINE TRUNCATED';
+/**
+ * For *LogMeta* sanitization, we let in anything that was passed, except for clearly-problematic keys
+ */
+const LOGMETA_BLACKLIST = [
+    // Security
+    'access_token',
+    'bot_auth_code',
+    'client_secret',
+    'jwt',
+    'oauth_token',
+    'password',
+    'refresh_token',
+    'shared_secret',
+    'token',
+    // Privacy
+    'billing_email',
+    'email',
+    'first_name',
+    'last_name',
+];
 /**
  * Logger class that can be configured with metadata add creation and when logging to add additional context to your logs.
  */
@@ -113,20 +142,27 @@ class Logger {
         this.metadata = {};
     }
     send(logLevel, message, metadata) {
-        const processedMessage = this.snakifyKeys({
-            ...this.metadata,
-            ...metadata,
+        // We need to provide the date to Datadog. Otherwise, the date is set to when they receive the log.
+        const date = Date.now();
+        if (message.length > MAX_LOG_MESSAGE_SIZE) {
+            message = `${message.substring(0, MAX_LOG_MESSAGE_SIZE)}${LOG_LINE_TRUNCATED_SUFFIX}`;
+        }
+        let processedMetadata = Logger.snakifyKeys({ ...this.metadata, ...metadata, logMessageSize: message.length });
+        processedMetadata = Logger.pruneSensitiveMetadata(processedMetadata);
+        const processedLogs = {
+            ...processedMetadata,
             message,
+            date,
             status: logLevel,
-        });
+        };
         if (process.env.NODE_ENV === 'development') {
-            console[logLevel](JSON.stringify(processedMessage, null, 2));
+            console[logLevel](JSON.stringify(processedLogs, null, 2));
         }
         else {
-            console[logLevel](JSON.stringify(processedMessage));
+            console[logLevel](JSON.stringify(processedLogs));
         }
     }
-    snakifyKeys(value) {
+    static snakifyKeys(value) {
         const result = {};
         for (const key in value) {
             const deepValue = typeof value[key] === 'object' ? this.snakifyKeys(value[key]) : value[key];
@@ -135,6 +171,22 @@ class Logger {
         }
         return result;
     }
+    static pruneSensitiveMetadata(metadata, topLevelMeta) {
+        const prunedMetadata = {};
+        for (const key in metadata) {
+            if (LOGMETA_BLACKLIST.includes(key)) {
+                prunedMetadata[key] = '[REDACTED]';
+                (topLevelMeta ?? prunedMetadata).has_sensitive_attribute = true;
+            }
+            else if (typeof metadata[key] === 'object') {
+                prunedMetadata[key] = Logger.pruneSensitiveMetadata(metadata[key], topLevelMeta ?? prunedMetadata);
+            }
+            else {
+                prunedMetadata[key] = metadata[key];
+            }
+        }
+        return prunedMetadata;
+    }
 }
 
 /**

package/dist/src/resources/logger.d.ts

@@ -65,6 +65,7 @@ export default class Logger {
      */
     clearMetadata(): void;
     private send;
-    private snakifyKeys;
+    private static snakifyKeys;
+    private static pruneSensitiveMetadata;
 }
 export {};

package/dist/src/resources/logger.js

@@ -6,6 +6,35 @@ var LogLevel;
     LogLevel["LOG"] = "log";
     LogLevel["DEBUG"] = "debug";
 })(LogLevel || (LogLevel = {}));
+/**
+ * See https://docs.datadoghq.com/logs/log_collection/?tab=host#custom-log-forwarding
+ * - Datadog Agent splits at 256kB (256000 bytes)...
+ * - ... but the same docs say that "for optimal performance, it is
+ *   recommended that an individual log be no greater than 25kB"
+ * -> Truncating at 25kB - a bit of wiggle room for metadata = 20kB.
+ */
+const MAX_LOG_MESSAGE_SIZE = parseInt(process.env.MAX_LOG_MESSAGE_SIZE ?? '20000', 10);
+const LOG_LINE_TRUNCATED_SUFFIX = ' - LOG LINE TRUNCATED';
+/**
+ * For *LogMeta* sanitization, we let in anything that was passed, except for clearly-problematic keys
+ */
+const LOGMETA_BLACKLIST = [
+    // Security
+    'access_token',
+    'bot_auth_code',
+    'client_secret',
+    'jwt',
+    'oauth_token',
+    'password',
+    'refresh_token',
+    'shared_secret',
+    'token',
+    // Privacy
+    'billing_email',
+    'email',
+    'first_name',
+    'last_name',
+];
 /**
  * Logger class that can be configured with metadata add creation and when logging to add additional context to your logs.
  */
@@ -85,20 +114,27 @@ export default class Logger {
         this.metadata = {};
     }
     send(logLevel, message, metadata) {
-        const processedMessage = this.snakifyKeys({
-            ...this.metadata,
-            ...metadata,
+        // We need to provide the date to Datadog. Otherwise, the date is set to when they receive the log.
+        const date = Date.now();
+        if (message.length > MAX_LOG_MESSAGE_SIZE) {
+            message = `${message.substring(0, MAX_LOG_MESSAGE_SIZE)}${LOG_LINE_TRUNCATED_SUFFIX}`;
+        }
+        let processedMetadata = Logger.snakifyKeys({ ...this.metadata, ...metadata, logMessageSize: message.length });
+        processedMetadata = Logger.pruneSensitiveMetadata(processedMetadata);
+        const processedLogs = {
+            ...processedMetadata,
             message,
+            date,
             status: logLevel,
-        });
+        };
         if (process.env.NODE_ENV === 'development') {
-            console[logLevel](JSON.stringify(processedMessage, null, 2));
+            console[logLevel](JSON.stringify(processedLogs, null, 2));
         }
         else {
-            console[logLevel](JSON.stringify(processedMessage));
+            console[logLevel](JSON.stringify(processedLogs));
         }
     }
-    snakifyKeys(value) {
+    static snakifyKeys(value) {
         const result = {};
         for (const key in value) {
             const deepValue = typeof value[key] === 'object' ? this.snakifyKeys(value[key]) : value[key];
@@ -107,4 +143,20 @@ export default class Logger {
         }
         return result;
     }
+    static pruneSensitiveMetadata(metadata, topLevelMeta) {
+        const prunedMetadata = {};
+        for (const key in metadata) {
+            if (LOGMETA_BLACKLIST.includes(key)) {
+                prunedMetadata[key] = '[REDACTED]';
+                (topLevelMeta ?? prunedMetadata).has_sensitive_attribute = true;
+            }
+            else if (typeof metadata[key] === 'object') {
+                prunedMetadata[key] = Logger.pruneSensitiveMetadata(metadata[key], topLevelMeta ?? prunedMetadata);
+            }
+            else {
+                prunedMetadata[key] = metadata[key];
+            }
+        }
+        return prunedMetadata;
+    }
 }

package/dist/test/resources/logger.test.js

@@ -32,86 +32,112 @@ describe('Logger', () => {
         assert.strictEqual(logSpy.mock.calls.length, 0);
         logger.log('test');
         assert.strictEqual(logSpy.mock.calls.length, 1);
-        assert.deepEqual(logSpy.mock.calls[0]?.arguments, [
-            JSON.stringify({ correlation_id: '123456789', message: 'test', status: 'log' }),
-        ]);
+        let actual = JSON.parse(logSpy.mock.calls[0]?.arguments[0]);
+        assert.ok(actual['date']);
+        assert.equal(actual['correlation_id'], '123456789');
+        assert.equal(actual['message'], 'test');
+        assert.equal(actual['status'], 'log');
         const errorSpy = testContext.mock.method(global.console, 'error', () => { });
         assert.strictEqual(errorSpy.mock.calls.length, 0);
         logger.error('test');
         assert.strictEqual(errorSpy.mock.calls.length, 1);
-        assert.deepEqual(errorSpy.mock.calls[0]?.arguments, [
-            JSON.stringify({ correlation_id: '123456789', message: 'test', status: 'error' }),
-        ]);
+        actual = JSON.parse(errorSpy.mock.calls[0]?.arguments[0]);
+        assert.ok(actual['date']);
+        assert.equal(actual['correlation_id'], '123456789');
+        assert.equal(actual['message'], 'test');
+        assert.equal(actual['status'], 'error');
         const warnSpy = testContext.mock.method(global.console, 'warn', () => { });
         assert.strictEqual(warnSpy.mock.calls.length, 0);
         logger.warn('test');
         assert.strictEqual(warnSpy.mock.calls.length, 1);
-        assert.deepEqual(warnSpy.mock.calls[0]?.arguments, [
-            JSON.stringify({ correlation_id: '123456789', message: 'test', status: 'warn' }),
-        ]);
+        actual = JSON.parse(warnSpy.mock.calls[0]?.arguments[0]);
+        assert.ok(actual['date']);
+        assert.equal(actual['correlation_id'], '123456789');
+        assert.equal(actual['message'], 'test');
+        assert.equal(actual['status'], 'warn');
         const infoSpy = testContext.mock.method(global.console, 'info', () => { });
         assert.strictEqual(infoSpy.mock.calls.length, 0);
         logger.info('test');
         assert.strictEqual(infoSpy.mock.calls.length, 1);
-        assert.deepEqual(infoSpy.mock.calls[0]?.arguments, [
-            JSON.stringify({ correlation_id: '123456789', message: 'test', status: 'info' }),
-        ]);
+        actual = JSON.parse(infoSpy.mock.calls[0]?.arguments[0]);
+        assert.ok(actual['date']);
+        assert.equal(actual['correlation_id'], '123456789');
+        assert.equal(actual['message'], 'test');
+        assert.equal(actual['status'], 'info');
         const debugSpy = testContext.mock.method(global.console, 'debug', () => { });
         assert.strictEqual(debugSpy.mock.calls.length, 0);
         logger.debug('test');
         assert.strictEqual(debugSpy.mock.calls.length, 1);
-        assert.deepEqual(debugSpy.mock.calls[0]?.arguments, [
-            JSON.stringify({ correlation_id: '123456789', message: 'test', status: 'debug' }),
-        ]);
+        actual = JSON.parse(debugSpy.mock.calls[0]?.arguments[0]);
+        assert.ok(actual['date']);
+        assert.equal(actual['correlation_id'], '123456789');
+        assert.equal(actual['message'], 'test');
+        assert.equal(actual['status'], 'debug');
     });
     it('merges message payload with metadata', testContext => {
-        const metadata = { correlation_id: '123456789', http: { method: 'GET' } };
-        const logger = new Logger(metadata);
         const logSpy = testContext.mock.method(global.console, 'log', () => { });
         assert.strictEqual(logSpy.mock.calls.length, 0);
+        const metadata = { correlation_id: '123456789', http: { method: 'GET' } };
+        const logger = new Logger(metadata);
         logger.log('test', { error: { code: '200', message: 'Page Not Found' } });
         assert.strictEqual(logSpy.mock.calls.length, 1);
-        assert.deepEqual(logSpy.mock.calls[0]?.arguments, [
-            JSON.stringify({
-                correlation_id: '123456789',
-                http: { method: 'GET' },
-                error: { code: '200', message: 'Page Not Found' },
-                message: 'test',
-                status: 'log',
-            }),
-        ]);
+        const actual = JSON.parse(logSpy.mock.calls[0]?.arguments[0]);
+        assert.ok(actual['date']);
+        assert.equal(actual['correlation_id'], '123456789');
+        assert.equal(actual['message'], 'test');
+        assert.equal(actual['status'], 'log');
+        assert.deepEqual(actual['http'], { method: 'GET' });
+        assert.deepEqual(actual['error'], { code: '200', message: 'Page Not Found' });
     });
     it('overwrites conflicting metadata keys (1st level) with message payload', testContext => {
-        const metadata = { correlation_id: '123456789', http: { method: 'GET' } };
-        const logger = new Logger(metadata);
         const logSpy = testContext.mock.method(global.console, 'log', () => { });
         assert.strictEqual(logSpy.mock.calls.length, 0);
+        const metadata = { correlation_id: '123456789', http: { method: 'GET' } };
+        const logger = new Logger(metadata);
         logger.log('test', { http: { status_code: 200 } });
         assert.strictEqual(logSpy.mock.calls.length, 1);
-        assert.deepEqual(logSpy.mock.calls[0]?.arguments, [
-            JSON.stringify({
-                correlation_id: '123456789',
-                http: { status_code: 200 },
-                message: 'test',
-                status: 'log',
-            }),
-        ]);
+        const actual = JSON.parse(logSpy.mock.calls[0]?.arguments[0]);
+        assert.ok(actual['date']);
+        assert.equal(actual['correlation_id'], '123456789');
+        assert.equal(actual['message'], 'test');
+        assert.equal(actual['status'], 'log');
+        assert.deepEqual(actual['http'], { status_code: 200 });
     });
     it('snakify keys of Message and Metadata', testContext => {
+        const logSpy = testContext.mock.method(global.console, 'log', () => { });
+        assert.strictEqual(logSpy.mock.calls.length, 0);
         const metadata = { correlationId: '123456789', http: { method: 'GET', statusCode: 200 } };
         const logger = new Logger(metadata);
+        logger.log('test', { errorContext: { errorCode: 200, errorMessage: 'Page Not Found' } });
+        assert.strictEqual(logSpy.mock.calls.length, 1);
+        const actual = JSON.parse(logSpy.mock.calls[0]?.arguments[0]);
+        assert.ok(actual['date']);
+        assert.equal(actual['correlation_id'], '123456789');
+        assert.equal(actual['message'], 'test');
+        assert.equal(actual['status'], 'log');
+        assert.deepEqual(actual['http'], { method: 'GET', status_code: 200 });
+        assert.deepEqual(actual['error_context'], { error_code: 200, error_message: 'Page Not Found' });
+    });
+    it('prunes sensitive Metadata', testContext => {
         const logSpy = testContext.mock.method(global.console, 'log', () => { });
         assert.strictEqual(logSpy.mock.calls.length, 0);
+        const metadata = {
+            correlationId: '123456789',
+            http: { method: 'GET', statusCode: 200, jwt: 'deepSecret' },
+            user: { contact: { email: 'deep_deep_deep@email.address', firstName: 'should be snakify then hidden' } },
+            access_token: 'secret',
+        };
+        const logger = new Logger(metadata);
         logger.log('test', { errorContext: { errorCode: 200, errorMessage: 'Page Not Found' } });
         assert.strictEqual(logSpy.mock.calls.length, 1);
-        assert.deepEqual(logSpy.mock.calls[0]?.arguments, [
-            JSON.stringify({
-                correlation_id: '123456789',
-                http: { method: 'GET', status_code: 200 },
-                error_context: { error_code: 200, error_message: 'Page Not Found' },
-                message: 'test',
-                status: 'log',
-            }),
-        ]);
+        const actual = JSON.parse(logSpy.mock.calls[0]?.arguments[0]);
+        assert.ok(actual['date']);
+        assert.equal(actual['correlation_id'], '123456789');
+        assert.equal(actual['message'], 'test');
+        assert.equal(actual['status'], 'log');
+        assert.equal(actual['has_sensitive_attribute'], true);
+        assert.equal(actual['access_token'], '[REDACTED]');
+        assert.deepEqual(actual['http'], { method: 'GET', status_code: 200, jwt: '[REDACTED]' });
+        assert.deepEqual(actual['user']['contact'], { email: '[REDACTED]', first_name: '[REDACTED]' });
     });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unito/integration-sdk",
-  "version": "1.0.26",
+  "version": "1.0.27",
   "description": "Integration SDK",
   "type": "module",
   "types": "dist/src/index.d.ts",

package/src/resources/logger.ts

@@ -14,6 +14,37 @@ type Value = {
 export type Metadata = Value & { message?: never };
 type ForbidenMetadataKey = 'message';
 
+/**
+ * See https://docs.datadoghq.com/logs/log_collection/?tab=host#custom-log-forwarding
+ * - Datadog Agent splits at 256kB (256000 bytes)...
+ * - ... but the same docs say that "for optimal performance, it is
+ *   recommended that an individual log be no greater than 25kB"
+ * -> Truncating at 25kB - a bit of wiggle room for metadata = 20kB.
+ */
+const MAX_LOG_MESSAGE_SIZE = parseInt(process.env.MAX_LOG_MESSAGE_SIZE ?? '20000', 10);
+const LOG_LINE_TRUNCATED_SUFFIX = ' - LOG LINE TRUNCATED';
+
+/**
+ * For *LogMeta* sanitization, we let in anything that was passed, except for clearly-problematic keys
+ */
+const LOGMETA_BLACKLIST = [
+  // Security
+  'access_token',
+  'bot_auth_code',
+  'client_secret',
+  'jwt',
+  'oauth_token',
+  'password',
+  'refresh_token',
+  'shared_secret',
+  'token',
+  // Privacy
+  'billing_email',
+  'email',
+  'first_name',
+  'last_name',
+];
+
 /**
  * Logger class that can be configured with metadata add creation and when logging to add additional context to your logs.
  */
@@ -107,21 +138,31 @@ export default class Logger {
   }
 
   private send(logLevel: LogLevel, message: string, metadata?: Metadata): void {
-    const processedMessage = this.snakifyKeys({
-      ...this.metadata,
-      ...metadata,
+    // We need to provide the date to Datadog. Otherwise, the date is set to when they receive the log.
+    const date = Date.now();
+
+    if (message.length > MAX_LOG_MESSAGE_SIZE) {
+      message = `${message.substring(0, MAX_LOG_MESSAGE_SIZE)}${LOG_LINE_TRUNCATED_SUFFIX}`;
+    }
+
+    let processedMetadata = Logger.snakifyKeys({ ...this.metadata, ...metadata, logMessageSize: message.length });
+    processedMetadata = Logger.pruneSensitiveMetadata(processedMetadata);
+
+    const processedLogs = {
+      ...processedMetadata,
       message,
+      date,
       status: logLevel,
-    });
+    };
 
     if (process.env.NODE_ENV === 'development') {
-      console[logLevel](JSON.stringify(processedMessage, null, 2));
+      console[logLevel](JSON.stringify(processedLogs, null, 2));
     } else {
-      console[logLevel](JSON.stringify(processedMessage));
+      console[logLevel](JSON.stringify(processedLogs));
     }
   }
 
-  private snakifyKeys<T extends Value>(value: T): T {
+  private static snakifyKeys(value: Value): Value {
     const result: Value = {};
 
     for (const key in value) {
@@ -130,6 +171,23 @@ export default class Logger {
       result[snakifiedKey] = deepValue;
     }
 
-    return result as T;
+    return result;
+  }
+
+  private static pruneSensitiveMetadata(metadata: Value, topLevelMeta?: Value): Value {
+    const prunedMetadata: Value = {};
+
+    for (const key in metadata) {
+      if (LOGMETA_BLACKLIST.includes(key)) {
+        prunedMetadata[key] = '[REDACTED]';
+        (topLevelMeta ?? prunedMetadata).has_sensitive_attribute = true;
+      } else if (typeof metadata[key] === 'object') {
+        prunedMetadata[key] = Logger.pruneSensitiveMetadata(metadata[key] as Value, topLevelMeta ?? prunedMetadata);
+      } else {
+        prunedMetadata[key] = metadata[key];
+      }
+    }
+
+    return prunedMetadata;
   }
 }

package/test/resources/logger.test.ts

@@ -41,96 +41,131 @@ describe('Logger', () => {
     assert.strictEqual(logSpy.mock.calls.length, 0);
     logger.log('test');
     assert.strictEqual(logSpy.mock.calls.length, 1);
-    assert.deepEqual(logSpy.mock.calls[0]?.arguments, [
-      JSON.stringify({ correlation_id: '123456789', message: 'test', status: 'log' }),
-    ]);
+    let actual = JSON.parse(logSpy.mock.calls[0]?.arguments[0]);
+    assert.ok(actual['date']);
+    assert.equal(actual['correlation_id'], '123456789');
+    assert.equal(actual['message'], 'test');
+    assert.equal(actual['status'], 'log');
 
     const errorSpy = testContext.mock.method(global.console, 'error', () => {});
     assert.strictEqual(errorSpy.mock.calls.length, 0);
     logger.error('test');
     assert.strictEqual(errorSpy.mock.calls.length, 1);
-    assert.deepEqual(errorSpy.mock.calls[0]?.arguments, [
-      JSON.stringify({ correlation_id: '123456789', message: 'test', status: 'error' }),
-    ]);
+    actual = JSON.parse(errorSpy.mock.calls[0]?.arguments[0]);
+    assert.ok(actual['date']);
+    assert.equal(actual['correlation_id'], '123456789');
+    assert.equal(actual['message'], 'test');
+    assert.equal(actual['status'], 'error');
 
     const warnSpy = testContext.mock.method(global.console, 'warn', () => {});
     assert.strictEqual(warnSpy.mock.calls.length, 0);
     logger.warn('test');
     assert.strictEqual(warnSpy.mock.calls.length, 1);
-    assert.deepEqual(warnSpy.mock.calls[0]?.arguments, [
-      JSON.stringify({ correlation_id: '123456789', message: 'test', status: 'warn' }),
-    ]);
+    actual = JSON.parse(warnSpy.mock.calls[0]?.arguments[0]);
+    assert.ok(actual['date']);
+    assert.equal(actual['correlation_id'], '123456789');
+    assert.equal(actual['message'], 'test');
+    assert.equal(actual['status'], 'warn');
 
     const infoSpy = testContext.mock.method(global.console, 'info', () => {});
     assert.strictEqual(infoSpy.mock.calls.length, 0);
     logger.info('test');
     assert.strictEqual(infoSpy.mock.calls.length, 1);
-    assert.deepEqual(infoSpy.mock.calls[0]?.arguments, [
-      JSON.stringify({ correlation_id: '123456789', message: 'test', status: 'info' }),
-    ]);
+    actual = JSON.parse(infoSpy.mock.calls[0]?.arguments[0]);
+    assert.ok(actual['date']);
+    assert.equal(actual['correlation_id'], '123456789');
+    assert.equal(actual['message'], 'test');
+    assert.equal(actual['status'], 'info');
 
     const debugSpy = testContext.mock.method(global.console, 'debug', () => {});
     assert.strictEqual(debugSpy.mock.calls.length, 0);
     logger.debug('test');
     assert.strictEqual(debugSpy.mock.calls.length, 1);
-    assert.deepEqual(debugSpy.mock.calls[0]?.arguments, [
-      JSON.stringify({ correlation_id: '123456789', message: 'test', status: 'debug' }),
-    ]);
+    actual = JSON.parse(debugSpy.mock.calls[0]?.arguments[0]);
+    assert.ok(actual['date']);
+    assert.equal(actual['correlation_id'], '123456789');
+    assert.equal(actual['message'], 'test');
+    assert.equal(actual['status'], 'debug');
   });
 
   it('merges message payload with metadata', testContext => {
-    const metadata = { correlation_id: '123456789', http: { method: 'GET' } };
-    const logger = new Logger(metadata);
-
     const logSpy = testContext.mock.method(global.console, 'log', () => {});
     assert.strictEqual(logSpy.mock.calls.length, 0);
+
+    const metadata = { correlation_id: '123456789', http: { method: 'GET' } };
+    const logger = new Logger(metadata);
     logger.log('test', { error: { code: '200', message: 'Page Not Found' } });
     assert.strictEqual(logSpy.mock.calls.length, 1);
-    assert.deepEqual(logSpy.mock.calls[0]?.arguments, [
-      JSON.stringify({
-        correlation_id: '123456789',
-        http: { method: 'GET' },
-        error: { code: '200', message: 'Page Not Found' },
-        message: 'test',
-        status: 'log',
-      }),
-    ]);
+
+    const actual = JSON.parse(logSpy.mock.calls[0]?.arguments[0]);
+
+    assert.ok(actual['date']);
+    assert.equal(actual['correlation_id'], '123456789');
+    assert.equal(actual['message'], 'test');
+    assert.equal(actual['status'], 'log');
+    assert.deepEqual(actual['http'], { method: 'GET' });
+    assert.deepEqual(actual['error'], { code: '200', message: 'Page Not Found' });
   });
 
   it('overwrites conflicting metadata keys (1st level) with message payload', testContext => {
-    const metadata = { correlation_id: '123456789', http: { method: 'GET' } };
-    const logger = new Logger(metadata);
-
     const logSpy = testContext.mock.method(global.console, 'log', () => {});
     assert.strictEqual(logSpy.mock.calls.length, 0);
+
+    const metadata = { correlation_id: '123456789', http: { method: 'GET' } };
+    const logger = new Logger(metadata);
     logger.log('test', { http: { status_code: 200 } });
     assert.strictEqual(logSpy.mock.calls.length, 1);
-    assert.deepEqual(logSpy.mock.calls[0]?.arguments, [
-      JSON.stringify({
-        correlation_id: '123456789',
-        http: { status_code: 200 },
-        message: 'test',
-        status: 'log',
-      }),
-    ]);
+
+    const actual = JSON.parse(logSpy.mock.calls[0]?.arguments[0]);
+
+    assert.ok(actual['date']);
+    assert.equal(actual['correlation_id'], '123456789');
+    assert.equal(actual['message'], 'test');
+    assert.equal(actual['status'], 'log');
+    assert.deepEqual(actual['http'], { status_code: 200 });
   });
 
   it('snakify keys of Message and Metadata', testContext => {
+    const logSpy = testContext.mock.method(global.console, 'log', () => {});
+    assert.strictEqual(logSpy.mock.calls.length, 0);
+
     const metadata = { correlationId: '123456789', http: { method: 'GET', statusCode: 200 } };
     const logger = new Logger(metadata);
+    logger.log('test', { errorContext: { errorCode: 200, errorMessage: 'Page Not Found' } });
+    assert.strictEqual(logSpy.mock.calls.length, 1);
 
+    const actual = JSON.parse(logSpy.mock.calls[0]?.arguments[0]);
+
+    assert.ok(actual['date']);
+    assert.equal(actual['correlation_id'], '123456789');
+    assert.equal(actual['message'], 'test');
+    assert.equal(actual['status'], 'log');
+    assert.deepEqual(actual['http'], { method: 'GET', status_code: 200 });
+    assert.deepEqual(actual['error_context'], { error_code: 200, error_message: 'Page Not Found' });
+  });
+
+  it('prunes sensitive Metadata', testContext => {
     const logSpy = testContext.mock.method(global.console, 'log', () => {});
     assert.strictEqual(logSpy.mock.calls.length, 0);
+
+    const metadata = {
+      correlationId: '123456789',
+      http: { method: 'GET', statusCode: 200, jwt: 'deepSecret' },
+      user: { contact: { email: 'deep_deep_deep@email.address', firstName: 'should be snakify then hidden' } },
+      access_token: 'secret',
+    };
+    const logger = new Logger(metadata);
     logger.log('test', { errorContext: { errorCode: 200, errorMessage: 'Page Not Found' } });
     assert.strictEqual(logSpy.mock.calls.length, 1);
-    assert.deepEqual(logSpy.mock.calls[0]?.arguments, [
-      JSON.stringify({
-        correlation_id: '123456789',
-        http: { method: 'GET', status_code: 200 },
-        error_context: { error_code: 200, error_message: 'Page Not Found' },
-        message: 'test',
-        status: 'log',
-      }),
-    ]);
+
+    const actual = JSON.parse(logSpy.mock.calls[0]?.arguments[0]);
+    assert.ok(actual['date']);
+    assert.equal(actual['correlation_id'], '123456789');
+    assert.equal(actual['message'], 'test');
+    assert.equal(actual['status'], 'log');
+    assert.equal(actual['has_sensitive_attribute'], true);
+    assert.equal(actual['access_token'], '[REDACTED]');
+    assert.deepEqual(actual['http'], { method: 'GET', status_code: 200, jwt: '[REDACTED]' });
+    assert.deepEqual(actual['user']['contact'], { email: '[REDACTED]', first_name: '[REDACTED]' });
   });
 });