@vafast/request-logger 0.3.1 → 0.3.3

package/dist/index.d.mts

@@ -88,6 +88,8 @@ interface RequestLoggerOptions {
   onError?: (error: Error) => void;
   /** 是否启用 @default true */
   enabled?: boolean;
+  /** 排除的路径列表（精确匹配或正则），这些路径不记录日志 */
+  excludePaths?: (string | RegExp)[];
 }
 /**
  * 请求日志中间件

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/sanitize.ts","../src/index.ts"],"sourcesContent":[],"mappings":";;;;;;;AAQA;AA+DA;AAAkC,UA/DjB,cAAA,CA+DiB;EAAY;EAA4B,YAAA,CAAA,EAAA,MAAA,EAAA;EAAC;EA+D3D,UAAA,CAAA,EAAA,MAAe,EAAA;EACpB;EACA,WAAA,CAAA,EAAA,MAAA;EACR;EAAM,QAAA,CAAA,EAAA,MAAA;;;;AC/GT;;;;;AAoBA;AAQA;AAMA;AAMY,iBDKI,QCLJ,CAAA,CAAA,CAAA,CAAA,IAAA,EDKsB,CCLtB,EAAA,MAAA,CAAA,EDKkC,cCLlC,EAAA,KAAA,CAAA,EAAA,MAAA,CAAA,EDK8D,CCL9D;;;;AA4BZ;AAgCA;;;;;;iBDQgB,eAAA,UACL,iCACA,iBACR;;;;UC/Gc,WAAA;EDlBA,MAAA,EAAA,MAAA;EA+DD,GAAA,EAAA,MAAQ;EAAU,IAAA,EAAA,MAAA;EAAY,OAAA,ECzCnC,MDyCmC,CAAA,MAAA,EAAA,MAAA,CAAA;EAA4B,IAAA,EAAA,OAAA;EAAC,KAAA,ECvClE,MDuCkE,CAAA,MAAA,EAAA,MAAA,CAAA;EA+D3D,MAAA,EAAA,MAAA;EACL,QAAA,EAAA,MAAA;EACA,MAAA,CAAA,EAAA,MAAA;EACR,KAAA,CAAA,EAAA,MAAA;EAAM,QAAA,CAAA,EAAA,MAAA;;;;EC/GQ,OAAA,CAAA,EAAA,MAAW;EAIjB,SAAA,EAYE,IAZF;;;AAYM,UAIA,YAAA,CAJA;EAIA,OAAA,CAAA,EAAA,OAAY;EAQZ,OAAA,CAAA,EAAO,MAAA;EAMP,IAAA,CAAA,EAAA,MAAA;EAML,IAAA,CAAA,EAAA,OAAA;;;AAMa,UAlBR,OAAA,CAkBQ;EAsBT,OAAA,EAvCL,WAuCkB;EAgChB,QAAA,EAtED,YAsEoC;;;UAlE/B,oBAAA;;;;;;YAML;;;;aAIC;;oBAEO;;;;;;;;;;;;;;;;;;iBAsBJ,aAAA,UAAuB,uBAAoB,OAAA,CAAA;;cAgC9C,4BAAmB"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/sanitize.ts","../src/index.ts"],"sourcesContent":[],"mappings":";;;;;;;AAQA;AA+DA;AAAkC,UA/DjB,cAAA,CA+DiB;EAAY;EAA4B,YAAA,CAAA,EAAA,MAAA,EAAA;EAAC;EA+D3D,UAAA,CAAA,EAAA,MAAe,EAAA;EACpB;EACA,WAAA,CAAA,EAAA,MAAA;EACR;EAAM,QAAA,CAAA,EAAA,MAAA;;;;AC/GT;;;;;AAoBA;AAQA;AAMA;AAMY,iBDKI,QCLJ,CAAA,CAAA,CAAA,CAAA,IAAA,EDKsB,CCLtB,EAAA,MAAA,CAAA,EDKkC,cCLlC,EAAA,KAAA,CAAA,EAAA,MAAA,CAAA,EDK8D,CCL9D;;;;;AA8BZ;AAkCA;;;;;iBDIgB,eAAA,UACL,iCACA,iBACR;;;;UC/Gc,WAAA;EDlBA,MAAA,EAAA,MAAA;EA+DD,GAAA,EAAA,MAAQ;EAAU,IAAA,EAAA,MAAA;EAAY,OAAA,ECzCnC,MDyCmC,CAAA,MAAA,EAAA,MAAA,CAAA;EAA4B,IAAA,EAAA,OAAA;EAAC,KAAA,ECvClE,MDuCkE,CAAA,MAAA,EAAA,MAAA,CAAA;EA+D3D,MAAA,EAAA,MAAA;EACL,QAAA,EAAA,MAAA;EACA,MAAA,CAAA,EAAA,MAAA;EACR,KAAA,CAAA,EAAA,MAAA;EAAM,QAAA,CAAA,EAAA,MAAA;;;;EC/GQ,OAAA,CAAA,EAAA,MAAW;EAIjB,SAAA,EAYE,IAZF;;;AAYM,UAIA,YAAA,CAJA;EAIA,OAAA,CAAA,EAAA,OAAY;EAQZ,OAAA,CAAA,EAAO,MAAA;EAMP,IAAA,CAAA,EAAA,MAAA;EAML,IAAA,CAAA,EAAA,OAAA;;;AAUe,UAtBV,OAAA,CAsBU;EAAM,OAAA,EArBtB,WAqBsB;EAoBjB,QAAA,EAxCJ,YAwCiB;AAkC7B;;UAtEiB,oBAAA;;;;;;YAML;;;;aAIC;;oBAEO;;;;2BAIO;;;;;;;;;;;;;;;;iBAoBX,aAAA,UAAuB,uBAAoB,OAAA,CAAA;;cAkC9C,4BAAmB"}

package/dist/index.mjs

@@ -139,7 +139,7 @@ function sanitizeHeaders(headers, config) {
 * ```
 */
 function requestLogger(options) {
-	const { url, service, headers = {}, timeout = 5e3, sanitize: sanitizeConfig, onError = console.error, enabled = true } = options;
+	const { url, service, headers = {}, timeout = 5e3, sanitize: sanitizeConfig, onError = console.error, enabled = true, excludePaths = [] } = options;
 	return defineMiddleware(async (req, next) => {
 		if (!enabled) return next();
 		const startTime = Date.now();
@@ -150,7 +150,8 @@ function requestLogger(options) {
 			headers,
 			timeout,
 			sanitizeConfig,
-			onError
+			onError,
+			excludePaths
 		}).catch(onError);
 		return response;
 	});
@@ -165,6 +166,13 @@ function shouldSkipLog(method, path) {
 		return false;
 	}
 }
+/** 检查路径是否在排除列表中 */
+function isPathExcluded(path, excludePaths) {
+	return excludePaths.some((pattern) => {
+		if (typeof pattern === "string") return path === pattern || path.startsWith(pattern + "/");
+		return pattern.test(path);
+	});
+}
 /** 带超时的 fetch */
 async function fetchWithTimeout(targetUrl, options, timeout) {
 	const controller = new AbortController();
@@ -179,9 +187,10 @@ async function fetchWithTimeout(targetUrl, options, timeout) {
 	}
 }
 async function recordLog(req, response, startTime, options) {
-	const { url: logUrl, service, headers: customHeaders, timeout, sanitizeConfig, onError } = options;
+	const { url: logUrl, service, headers: customHeaders, timeout, sanitizeConfig, onError, excludePaths } = options;
 	const reqUrl = new URL(req.url);
 	const path = reqUrl.pathname;
+	if (isPathExcluded(path, excludePaths)) return;
 	if (shouldSkipLog(req.method, path)) return;
 	let body = null;
 	try {

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../src/sanitize.ts","../src/index.ts"],"sourcesContent":["/**\n * 敏感数据清洗工具\n * \n * 用于在记录日志前移除或脱敏敏感信息\n */\n\n// ============ Types ============\n\nexport interface SanitizeConfig {\n  /** 需要完全移除的字段（小写） */\n  removeFields?: string[]\n  /** 需要脱敏的字段（小写，部分匹配） */\n  maskFields?: string[]\n  /** 脱敏占位符 @default '[REDACTED]' */\n  placeholder?: string\n  /** 最大递归深度 @default 10 */\n  maxDepth?: number\n}\n\n// ============ Default Config ============\n\n/** 默认需要完全移除的敏感字段 */\nconst DEFAULT_REMOVE_FIELDS = [\n  'password',\n  'newpassword',\n  'oldpassword',\n  'confirmpassword',\n  'secret',\n  'secretkey',\n  'privatekey',\n  'apisecret',\n  'clientsecret',\n]\n\n/** 默认需要脱敏的字段（保留部分信息） */\nconst DEFAULT_MASK_FIELDS = [\n  'token',\n  'accesstoken',\n  'refreshtoken',\n  'authorization',\n  'apikey',\n  'api_key',\n  'x-api-key',\n  'idtoken',\n  'sessiontoken',\n  'bearer',\n]\n\nconst DEFAULT_PLACEHOLDER = '[REDACTED]'\nconst DEFAULT_MAX_DEPTH = 10\n\n// ============ Sanitize Functions ============\n\n/**\n * 部分脱敏（保留前4后4位）\n */\nfunction partialMask(value: string, placeholder: string): string {\n  if (value.length <= 8) return placeholder\n  return value.slice(0, 4) + '****' + value.slice(-4)\n}\n\n/**\n * 深度清洗对象中的敏感数据\n * \n * @example\n * ```typescript\n * const data = { password: '123456', token: 'eyJhbG...' }\n * const sanitized = sanitize(data)\n * // { password: '[REDACTED]', token: 'eyJh****...' }\n * ```\n */\nexport function sanitize<T>(data: T, config?: SanitizeConfig, depth = 0): T {\n  const {\n    removeFields = DEFAULT_REMOVE_FIELDS,\n    maskFields = DEFAULT_MASK_FIELDS,\n    placeholder = DEFAULT_PLACEHOLDER,\n    maxDepth = DEFAULT_MAX_DEPTH,\n  } = config ?? {}\n\n  // 防止无限递归\n  if (depth > maxDepth) return data\n  \n  if (data === null || data === undefined) {\n    return data\n  }\n\n  // 处理数组\n  if (Array.isArray(data)) {\n    return data.map(item => sanitize(item, config, depth + 1)) as T\n  }\n\n  // 处理对象\n  if (typeof data === 'object') {\n    const result: Record<string, unknown> = {}\n    \n    for (const [key, value] of Object.entries(data)) {\n      const lowerKey = key.toLowerCase()\n      \n      // 完全移除的字段\n      if (removeFields.some(field => lowerKey === field)) {\n        result[key] = placeholder\n        continue\n      }\n      \n      // 部分脱敏的字段\n      if (maskFields.some(field => lowerKey.includes(field))) {\n        if (typeof value === 'string') {\n          result[key] = partialMask(value, placeholder)\n        } else {\n          result[key] = placeholder\n        }\n        continue\n      }\n      \n      // 递归处理嵌套对象\n      result[key] = sanitize(value, config, depth + 1)\n    }\n    \n    return result as T\n  }\n\n  return data\n}\n\n/**\n * 清洗 HTTP 请求头\n * \n * @example\n * ```typescript\n * const headers = { Authorization: 'Bearer eyJhbG...', Cookie: 'session=xxx' }\n * const sanitized = sanitizeHeaders(headers)\n * // { Authorization: 'Bearer eyJh****...', Cookie: '[REDACTED]' }\n * ```\n */\nexport function sanitizeHeaders(\n  headers: Record<string, string>,\n  config?: SanitizeConfig\n): Record<string, string> {\n  const {\n    maskFields = DEFAULT_MASK_FIELDS,\n    placeholder = DEFAULT_PLACEHOLDER,\n  } = config ?? {}\n\n  const result: Record<string, string> = {}\n  \n  for (const [key, value] of Object.entries(headers)) {\n    const lowerKey = key.toLowerCase()\n    \n    // Authorization 头部分脱敏\n    if (lowerKey === 'authorization') {\n      if (value.startsWith('Bearer ')) {\n        result[key] = 'Bearer ' + partialMask(value.slice(7), placeholder)\n      } else {\n        result[key] = partialMask(value, placeholder)\n      }\n      continue\n    }\n    \n    // Cookie 完全脱敏\n    if (lowerKey === 'cookie' || lowerKey === 'set-cookie') {\n      result[key] = placeholder\n      continue\n    }\n    \n    // API Key 相关头脱敏\n    if (maskFields.some(field => lowerKey.includes(field))) {\n      result[key] = partialMask(value, placeholder)\n      continue\n    }\n    \n    result[key] = value\n  }\n  \n  return result\n}\n\n/**\n * 检查值是否为敏感字段\n */\nexport function isSensitiveField(fieldName: string, config?: SanitizeConfig): boolean {\n  const {\n    removeFields = DEFAULT_REMOVE_FIELDS,\n    maskFields = DEFAULT_MASK_FIELDS,\n  } = config ?? {}\n\n  const lowerName = fieldName.toLowerCase()\n  \n  return (\n    removeFields.some(field => lowerName === field) ||\n    maskFields.some(field => lowerName.includes(field))\n  )\n}\n\n","/**\n * @vafast/request-logger - API 请求日志中间件\n * \n * 特性：\n * - 自动敏感数据脱敏\n * - HTTP 远程日志服务\n * - 异步非阻塞记录\n * - 路由级别日志控制（路由定义中设置 log: false）\n * \n * @example\n * ```typescript\n * import { requestLogger } from '@vafast/request-logger'\n * \n * server.use(requestLogger({\n *   url: 'http://log-server:9005/api/logs/ingest',\n *   service: 'auth-server',\n *   getUserId: (req) => req.__locals?.userInfo?.id,\n * }))\n * ```\n */\nimport { defineMiddleware, getRoute } from 'vafast'\nimport { sanitize, sanitizeHeaders, type SanitizeConfig } from './sanitize'\n\n// ============ Types ============\n\n/** 请求信息 */\nexport interface RequestData {\n  method: string\n  url: string\n  path: string\n  headers: Record<string, string>\n  body: unknown\n  query: Record<string, string>\n  status: number\n  duration: number\n  userId?: string\n  appId?: string\n  authType?: string\n  service?: string\n  ip?: string\n  userAgent?: string\n  traceId?: string\n  createdAt: Date\n}\n\n/** 响应信息 */\nexport interface ResponseData {\n  success?: boolean\n  message?: string\n  code?: number\n  data?: unknown\n}\n\n/** 完整日志数据 */\nexport interface LogData {\n  request: RequestData\n  response: ResponseData\n}\n\n/** 请求日志配置 */\nexport interface RequestLoggerOptions {\n  /** 日志服务 URL */\n  url: string\n  /** 服务标识（如 auth-server、ones-server） */\n  service: string\n  /** 自定义请求头（如认证信息） */\n  headers?: Record<string, string>\n  /** 超时时间（毫秒），默认 5000 */\n  timeout?: number\n  /** 敏感数据清洗配置 */\n  sanitize?: SanitizeConfig\n  /** 错误回调 */\n  onError?: (error: Error) => void\n  /** 是否启用 @default true */\n  enabled?: boolean\n}\n\n\n// ============ Middleware ============\n\n/**\n * 请求日志中间件\n * \n * @example\n * ```typescript\n * import { requestLogger } from '@vafast/request-logger'\n * \n * server.use(requestLogger({\n *   url: 'http://log-server:9005/api/logs/ingest',\n *   service: 'auth-server',\n *   auth: { apiKeyId: 'xxx', apiKeySecret: 'yyy' },\n * }))\n * ```\n */\nexport function requestLogger(options: RequestLoggerOptions) {\n  const {\n    url,\n    service,\n    headers = {},\n    timeout = 5000,\n    sanitize: sanitizeConfig,\n    onError = console.error,\n    enabled = true,\n  } = options\n\n  return defineMiddleware(async (req, next) => {\n    if (!enabled) return next()\n\n    const startTime = Date.now()\n    const response = await next()\n\n    // 异步记录日志，不阻塞响应\n    recordLog(req, response, startTime, {\n      url,\n      service,\n      headers,\n      timeout,\n      sanitizeConfig,\n      onError,\n    }).catch(onError)\n\n    return response\n  })\n}\n\n/** @deprecated 使用 requestLogger 代替 */\nexport const createRequestLogger = requestLogger\n\n// ============ Internal ============\n\ninterface RecordLogOptions {\n  url: string\n  service: string\n  headers: Record<string, string>\n  timeout: number\n  sanitizeConfig?: SanitizeConfig\n  onError: (error: Error) => void\n}\n\n/** 检查路由是否配置了 log: false */\nfunction shouldSkipLog(method: string, path: string): boolean {\n  try {\n    const route = getRoute<{ log?: boolean }>(method, path)\n    return route?.log === false\n  } catch {\n    return false\n  }\n}\n\n/** 带超时的 fetch */\nasync function fetchWithTimeout(\n  targetUrl: string,\n  options: RequestInit,\n  timeout: number\n): Promise<Response> {\n  const controller = new AbortController()\n  const timeoutId = setTimeout(() => controller.abort(), timeout)\n\n  try {\n    return await fetch(targetUrl, { ...options, signal: controller.signal })\n  } finally {\n    clearTimeout(timeoutId)\n  }\n}\n\nasync function recordLog(\n  req: Request,\n  response: Response,\n  startTime: number,\n  options: RecordLogOptions\n) {\n  const { url: logUrl, service, headers: customHeaders, timeout, sanitizeConfig, onError } = options\n\n  const reqUrl = new URL(req.url)\n  const path = reqUrl.pathname\n\n  // 检查路由是否禁用日志\n  if (shouldSkipLog(req.method, path)) return\n\n  // 解析请求体\n  let body: unknown = null\n  try {\n    const contentType = req.headers.get('content-type') || ''\n    if (contentType.includes('application/json')) {\n      body = await req.clone().json()\n    }\n  } catch {\n    // 忽略\n  }\n\n  // 解析响应体\n  let responseData: ResponseData = {}\n  try {\n    responseData = await response.clone().json()\n  } catch {\n    // 忽略\n  }\n\n  // 提取请求头\n  const headers: Record<string, string> = {}\n  req.headers.forEach((value, key) => {\n    headers[key] = value\n  })\n\n  // 清洗敏感数据\n  const sanitizedHeaders = sanitizeHeaders(headers, sanitizeConfig)\n  const sanitizedBody = sanitize(body, sanitizeConfig)\n  const sanitizedResponseData = sanitize(responseData.data, sanitizeConfig)\n\n  // 构建日志数据（业务字段由 log-server 从 headers 解析）\n  const logBody = {\n    method: req.method,\n    url: req.url,\n    path,\n    headers: sanitizedHeaders,\n    body: sanitizedBody,\n    query: Object.fromEntries(reqUrl.searchParams),\n    status: response.status,\n    duration: Date.now() - startTime,\n    service,\n    createdAt: new Date().toISOString(),\n    response: {\n      success: responseData.success,\n      message: responseData.message,\n      code: responseData.code,\n    },\n    responseData: sanitizedResponseData,\n  }\n\n  // 发送到日志服务\n  try {\n    const res = await fetchWithTimeout(\n      logUrl,\n      {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json', ...customHeaders },\n        body: JSON.stringify(logBody),\n      },\n      timeout\n    )\n\n    if (!res.ok) {\n      throw new Error(`HTTP ${res.status}: ${res.statusText}`)\n    }\n  } catch (error) {\n    onError(error as Error)\n  }\n}\n\n// ============ Re-exports ============\n\nexport { sanitize, sanitizeHeaders, type SanitizeConfig } from './sanitize'\nexport default requestLogger\n"],"mappings":";;;;AAsBA,MAAM,wBAAwB;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;;AAGD,MAAM,sBAAsB;CAC1B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;AAED,MAAM,sBAAsB;AAC5B,MAAM,oBAAoB;;;;AAO1B,SAAS,YAAY,OAAe,aAA6B;AAC/D,KAAI,MAAM,UAAU,EAAG,QAAO;AAC9B,QAAO,MAAM,MAAM,GAAG,EAAE,GAAG,SAAS,MAAM,MAAM,GAAG;;;;;;;;;;;;AAarD,SAAgB,SAAY,MAAS,QAAyB,QAAQ,GAAM;CAC1E,MAAM,EACJ,eAAe,uBACf,aAAa,qBACb,cAAc,qBACd,WAAW,sBACT,UAAU,EAAE;AAGhB,KAAI,QAAQ,SAAU,QAAO;AAE7B,KAAI,SAAS,QAAQ,SAAS,OAC5B,QAAO;AAIT,KAAI,MAAM,QAAQ,KAAK,CACrB,QAAO,KAAK,KAAI,SAAQ,SAAS,MAAM,QAAQ,QAAQ,EAAE,CAAC;AAI5D,KAAI,OAAO,SAAS,UAAU;EAC5B,MAAM,SAAkC,EAAE;AAE1C,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,EAAE;GAC/C,MAAM,WAAW,IAAI,aAAa;AAGlC,OAAI,aAAa,MAAK,UAAS,aAAa,MAAM,EAAE;AAClD,WAAO,OAAO;AACd;;AAIF,OAAI,WAAW,MAAK,UAAS,SAAS,SAAS,MAAM,CAAC,EAAE;AACtD,QAAI,OAAO,UAAU,SACnB,QAAO,OAAO,YAAY,OAAO,YAAY;QAE7C,QAAO,OAAO;AAEhB;;AAIF,UAAO,OAAO,SAAS,OAAO,QAAQ,QAAQ,EAAE;;AAGlD,SAAO;;AAGT,QAAO;;;;;;;;;;;;AAaT,SAAgB,gBACd,SACA,QACwB;CACxB,MAAM,EACJ,aAAa,qBACb,cAAc,wBACZ,UAAU,EAAE;CAEhB,MAAM,SAAiC,EAAE;AAEzC,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,EAAE;EAClD,MAAM,WAAW,IAAI,aAAa;AAGlC,MAAI,aAAa,iBAAiB;AAChC,OAAI,MAAM,WAAW,UAAU,CAC7B,QAAO,OAAO,YAAY,YAAY,MAAM,MAAM,EAAE,EAAE,YAAY;OAElE,QAAO,OAAO,YAAY,OAAO,YAAY;AAE/C;;AAIF,MAAI,aAAa,YAAY,aAAa,cAAc;AACtD,UAAO,OAAO;AACd;;AAIF,MAAI,WAAW,MAAK,UAAS,SAAS,SAAS,MAAM,CAAC,EAAE;AACtD,UAAO,OAAO,YAAY,OAAO,YAAY;AAC7C;;AAGF,SAAO,OAAO;;AAGhB,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC/ET,SAAgB,cAAc,SAA+B;CAC3D,MAAM,EACJ,KACA,SACA,UAAU,EAAE,EACZ,UAAU,KACV,UAAU,gBACV,UAAU,QAAQ,OAClB,UAAU,SACR;AAEJ,QAAO,iBAAiB,OAAO,KAAK,SAAS;AAC3C,MAAI,CAAC,QAAS,QAAO,MAAM;EAE3B,MAAM,YAAY,KAAK,KAAK;EAC5B,MAAM,WAAW,MAAM,MAAM;AAG7B,YAAU,KAAK,UAAU,WAAW;GAClC;GACA;GACA;GACA;GACA;GACA;GACD,CAAC,CAAC,MAAM,QAAQ;AAEjB,SAAO;GACP;;;AAIJ,MAAa,sBAAsB;;AAcnC,SAAS,cAAc,QAAgB,MAAuB;AAC5D,KAAI;AAEF,SADc,SAA4B,QAAQ,KAAK,EACzC,QAAQ;SAChB;AACN,SAAO;;;;AAKX,eAAe,iBACb,WACA,SACA,SACmB;CACnB,MAAM,aAAa,IAAI,iBAAiB;CACxC,MAAM,YAAY,iBAAiB,WAAW,OAAO,EAAE,QAAQ;AAE/D,KAAI;AACF,SAAO,MAAM,MAAM,WAAW;GAAE,GAAG;GAAS,QAAQ,WAAW;GAAQ,CAAC;WAChE;AACR,eAAa,UAAU;;;AAI3B,eAAe,UACb,KACA,UACA,WACA,SACA;CACA,MAAM,EAAE,KAAK,QAAQ,SAAS,SAAS,eAAe,SAAS,gBAAgB,YAAY;CAE3F,MAAM,SAAS,IAAI,IAAI,IAAI,IAAI;CAC/B,MAAM,OAAO,OAAO;AAGpB,KAAI,cAAc,IAAI,QAAQ,KAAK,CAAE;CAGrC,IAAI,OAAgB;AACpB,KAAI;AAEF,OADoB,IAAI,QAAQ,IAAI,eAAe,IAAI,IACvC,SAAS,mBAAmB,CAC1C,QAAO,MAAM,IAAI,OAAO,CAAC,MAAM;SAE3B;CAKR,IAAI,eAA6B,EAAE;AACnC,KAAI;AACF,iBAAe,MAAM,SAAS,OAAO,CAAC,MAAM;SACtC;CAKR,MAAM,UAAkC,EAAE;AAC1C,KAAI,QAAQ,SAAS,OAAO,QAAQ;AAClC,UAAQ,OAAO;GACf;CAGF,MAAM,mBAAmB,gBAAgB,SAAS,eAAe;CACjE,MAAM,gBAAgB,SAAS,MAAM,eAAe;CACpD,MAAM,wBAAwB,SAAS,aAAa,MAAM,eAAe;CAGzE,MAAM,UAAU;EACd,QAAQ,IAAI;EACZ,KAAK,IAAI;EACT;EACA,SAAS;EACT,MAAM;EACN,OAAO,OAAO,YAAY,OAAO,aAAa;EAC9C,QAAQ,SAAS;EACjB,UAAU,KAAK,KAAK,GAAG;EACvB;EACA,4BAAW,IAAI,MAAM,EAAC,aAAa;EACnC,UAAU;GACR,SAAS,aAAa;GACtB,SAAS,aAAa;GACtB,MAAM,aAAa;GACpB;EACD,cAAc;EACf;AAGD,KAAI;EACF,MAAM,MAAM,MAAM,iBAChB,QACA;GACE,QAAQ;GACR,SAAS;IAAE,gBAAgB;IAAoB,GAAG;IAAe;GACjE,MAAM,KAAK,UAAU,QAAQ;GAC9B,EACD,QACD;AAED,MAAI,CAAC,IAAI,GACP,OAAM,IAAI,MAAM,QAAQ,IAAI,OAAO,IAAI,IAAI,aAAa;UAEnD,OAAO;AACd,UAAQ,MAAe;;;AAO3B,kBAAe"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/sanitize.ts","../src/index.ts"],"sourcesContent":["/**\n * 敏感数据清洗工具\n * \n * 用于在记录日志前移除或脱敏敏感信息\n */\n\n// ============ Types ============\n\nexport interface SanitizeConfig {\n  /** 需要完全移除的字段（小写） */\n  removeFields?: string[]\n  /** 需要脱敏的字段（小写，部分匹配） */\n  maskFields?: string[]\n  /** 脱敏占位符 @default '[REDACTED]' */\n  placeholder?: string\n  /** 最大递归深度 @default 10 */\n  maxDepth?: number\n}\n\n// ============ Default Config ============\n\n/** 默认需要完全移除的敏感字段 */\nconst DEFAULT_REMOVE_FIELDS = [\n  'password',\n  'newpassword',\n  'oldpassword',\n  'confirmpassword',\n  'secret',\n  'secretkey',\n  'privatekey',\n  'apisecret',\n  'clientsecret',\n]\n\n/** 默认需要脱敏的字段（保留部分信息） */\nconst DEFAULT_MASK_FIELDS = [\n  'token',\n  'accesstoken',\n  'refreshtoken',\n  'authorization',\n  'apikey',\n  'api_key',\n  'x-api-key',\n  'idtoken',\n  'sessiontoken',\n  'bearer',\n]\n\nconst DEFAULT_PLACEHOLDER = '[REDACTED]'\nconst DEFAULT_MAX_DEPTH = 10\n\n// ============ Sanitize Functions ============\n\n/**\n * 部分脱敏（保留前4后4位）\n */\nfunction partialMask(value: string, placeholder: string): string {\n  if (value.length <= 8) return placeholder\n  return value.slice(0, 4) + '****' + value.slice(-4)\n}\n\n/**\n * 深度清洗对象中的敏感数据\n * \n * @example\n * ```typescript\n * const data = { password: '123456', token: 'eyJhbG...' }\n * const sanitized = sanitize(data)\n * // { password: '[REDACTED]', token: 'eyJh****...' }\n * ```\n */\nexport function sanitize<T>(data: T, config?: SanitizeConfig, depth = 0): T {\n  const {\n    removeFields = DEFAULT_REMOVE_FIELDS,\n    maskFields = DEFAULT_MASK_FIELDS,\n    placeholder = DEFAULT_PLACEHOLDER,\n    maxDepth = DEFAULT_MAX_DEPTH,\n  } = config ?? {}\n\n  // 防止无限递归\n  if (depth > maxDepth) return data\n  \n  if (data === null || data === undefined) {\n    return data\n  }\n\n  // 处理数组\n  if (Array.isArray(data)) {\n    return data.map(item => sanitize(item, config, depth + 1)) as T\n  }\n\n  // 处理对象\n  if (typeof data === 'object') {\n    const result: Record<string, unknown> = {}\n    \n    for (const [key, value] of Object.entries(data)) {\n      const lowerKey = key.toLowerCase()\n      \n      // 完全移除的字段\n      if (removeFields.some(field => lowerKey === field)) {\n        result[key] = placeholder\n        continue\n      }\n      \n      // 部分脱敏的字段\n      if (maskFields.some(field => lowerKey.includes(field))) {\n        if (typeof value === 'string') {\n          result[key] = partialMask(value, placeholder)\n        } else {\n          result[key] = placeholder\n        }\n        continue\n      }\n      \n      // 递归处理嵌套对象\n      result[key] = sanitize(value, config, depth + 1)\n    }\n    \n    return result as T\n  }\n\n  return data\n}\n\n/**\n * 清洗 HTTP 请求头\n * \n * @example\n * ```typescript\n * const headers = { Authorization: 'Bearer eyJhbG...', Cookie: 'session=xxx' }\n * const sanitized = sanitizeHeaders(headers)\n * // { Authorization: 'Bearer eyJh****...', Cookie: '[REDACTED]' }\n * ```\n */\nexport function sanitizeHeaders(\n  headers: Record<string, string>,\n  config?: SanitizeConfig\n): Record<string, string> {\n  const {\n    maskFields = DEFAULT_MASK_FIELDS,\n    placeholder = DEFAULT_PLACEHOLDER,\n  } = config ?? {}\n\n  const result: Record<string, string> = {}\n  \n  for (const [key, value] of Object.entries(headers)) {\n    const lowerKey = key.toLowerCase()\n    \n    // Authorization 头部分脱敏\n    if (lowerKey === 'authorization') {\n      if (value.startsWith('Bearer ')) {\n        result[key] = 'Bearer ' + partialMask(value.slice(7), placeholder)\n      } else {\n        result[key] = partialMask(value, placeholder)\n      }\n      continue\n    }\n    \n    // Cookie 完全脱敏\n    if (lowerKey === 'cookie' || lowerKey === 'set-cookie') {\n      result[key] = placeholder\n      continue\n    }\n    \n    // API Key 相关头脱敏\n    if (maskFields.some(field => lowerKey.includes(field))) {\n      result[key] = partialMask(value, placeholder)\n      continue\n    }\n    \n    result[key] = value\n  }\n  \n  return result\n}\n\n/**\n * 检查值是否为敏感字段\n */\nexport function isSensitiveField(fieldName: string, config?: SanitizeConfig): boolean {\n  const {\n    removeFields = DEFAULT_REMOVE_FIELDS,\n    maskFields = DEFAULT_MASK_FIELDS,\n  } = config ?? {}\n\n  const lowerName = fieldName.toLowerCase()\n  \n  return (\n    removeFields.some(field => lowerName === field) ||\n    maskFields.some(field => lowerName.includes(field))\n  )\n}\n\n","/**\n * @vafast/request-logger - API 请求日志中间件\n * \n * 特性：\n * - 自动敏感数据脱敏\n * - HTTP 远程日志服务\n * - 异步非阻塞记录\n * - 路由级别日志控制（路由定义中设置 log: false）\n * \n * @example\n * ```typescript\n * import { requestLogger } from '@vafast/request-logger'\n * \n * server.use(requestLogger({\n *   url: 'http://log-server:9005/api/logs/ingest',\n *   service: 'auth-server',\n *   getUserId: (req) => req.__locals?.userInfo?.id,\n * }))\n * ```\n */\nimport { defineMiddleware, getRoute } from 'vafast'\nimport { sanitize, sanitizeHeaders, type SanitizeConfig } from './sanitize'\n\n// ============ Types ============\n\n/** 请求信息 */\nexport interface RequestData {\n  method: string\n  url: string\n  path: string\n  headers: Record<string, string>\n  body: unknown\n  query: Record<string, string>\n  status: number\n  duration: number\n  userId?: string\n  appId?: string\n  authType?: string\n  service?: string\n  ip?: string\n  userAgent?: string\n  traceId?: string\n  createdAt: Date\n}\n\n/** 响应信息 */\nexport interface ResponseData {\n  success?: boolean\n  message?: string\n  code?: number\n  data?: unknown\n}\n\n/** 完整日志数据 */\nexport interface LogData {\n  request: RequestData\n  response: ResponseData\n}\n\n/** 请求日志配置 */\nexport interface RequestLoggerOptions {\n  /** 日志服务 URL */\n  url: string\n  /** 服务标识（如 auth-server、ones-server） */\n  service: string\n  /** 自定义请求头（如认证信息） */\n  headers?: Record<string, string>\n  /** 超时时间（毫秒），默认 5000 */\n  timeout?: number\n  /** 敏感数据清洗配置 */\n  sanitize?: SanitizeConfig\n  /** 错误回调 */\n  onError?: (error: Error) => void\n  /** 是否启用 @default true */\n  enabled?: boolean\n  /** 排除的路径列表（精确匹配或正则），这些路径不记录日志 */\n  excludePaths?: (string | RegExp)[]\n}\n\n\n// ============ Middleware ============\n\n/**\n * 请求日志中间件\n * \n * @example\n * ```typescript\n * import { requestLogger } from '@vafast/request-logger'\n * \n * server.use(requestLogger({\n *   url: 'http://log-server:9005/api/logs/ingest',\n *   service: 'auth-server',\n *   auth: { apiKeyId: 'xxx', apiKeySecret: 'yyy' },\n * }))\n * ```\n */\nexport function requestLogger(options: RequestLoggerOptions) {\n  const {\n    url,\n    service,\n    headers = {},\n    timeout = 5000,\n    sanitize: sanitizeConfig,\n    onError = console.error,\n    enabled = true,\n    excludePaths = [],\n  } = options\n\n  return defineMiddleware(async (req, next) => {\n    if (!enabled) return next()\n\n    const startTime = Date.now()\n    const response = await next()\n\n    // 异步记录日志，不阻塞响应\n    recordLog(req, response, startTime, {\n      url,\n      service,\n      headers,\n      timeout,\n      sanitizeConfig,\n      onError,\n      excludePaths,\n    }).catch(onError)\n\n    return response\n  })\n}\n\n/** @deprecated 使用 requestLogger 代替 */\nexport const createRequestLogger = requestLogger\n\n// ============ Internal ============\n\ninterface RecordLogOptions {\n  url: string\n  service: string\n  headers: Record<string, string>\n  timeout: number\n  sanitizeConfig?: SanitizeConfig\n  onError: (error: Error) => void\n  excludePaths: (string | RegExp)[]\n}\n\n/** 检查路由是否配置了 log: false */\nfunction shouldSkipLog(method: string, path: string): boolean {\n  try {\n    const route = getRoute<{ log?: boolean }>(method, path)\n    return route?.log === false\n  } catch {\n    return false\n  }\n}\n\n/** 检查路径是否在排除列表中 */\nfunction isPathExcluded(path: string, excludePaths: (string | RegExp)[]): boolean {\n  return excludePaths.some(pattern => {\n    if (typeof pattern === 'string') {\n      return path === pattern || path.startsWith(pattern + '/')\n    }\n    return pattern.test(path)\n  })\n}\n\n/** 带超时的 fetch */\nasync function fetchWithTimeout(\n  targetUrl: string,\n  options: RequestInit,\n  timeout: number\n): Promise<Response> {\n  const controller = new AbortController()\n  const timeoutId = setTimeout(() => controller.abort(), timeout)\n\n  try {\n    return await fetch(targetUrl, { ...options, signal: controller.signal })\n  } finally {\n    clearTimeout(timeoutId)\n  }\n}\n\nasync function recordLog(\n  req: Request,\n  response: Response,\n  startTime: number,\n  options: RecordLogOptions\n) {\n  const { url: logUrl, service, headers: customHeaders, timeout, sanitizeConfig, onError, excludePaths } = options\n\n  const reqUrl = new URL(req.url)\n  const path = reqUrl.pathname\n\n  // 检查路径是否在排除列表中\n  if (isPathExcluded(path, excludePaths)) return\n\n  // 检查路由是否禁用日志\n  if (shouldSkipLog(req.method, path)) return\n\n  // 解析请求体\n  let body: unknown = null\n  try {\n    const contentType = req.headers.get('content-type') || ''\n    if (contentType.includes('application/json')) {\n      body = await req.clone().json()\n    }\n  } catch {\n    // 忽略\n  }\n\n  // 解析响应体\n  let responseData: ResponseData = {}\n  try {\n    responseData = await response.clone().json()\n  } catch {\n    // 忽略\n  }\n\n  // 提取请求头\n  const headers: Record<string, string> = {}\n  req.headers.forEach((value, key) => {\n    headers[key] = value\n  })\n\n  // 清洗敏感数据\n  const sanitizedHeaders = sanitizeHeaders(headers, sanitizeConfig)\n  const sanitizedBody = sanitize(body, sanitizeConfig)\n  const sanitizedResponseData = sanitize(responseData.data, sanitizeConfig)\n\n  // 构建日志数据（业务字段由 log-server 从 headers 解析）\n  const logBody = {\n    method: req.method,\n    url: req.url,\n    path,\n    headers: sanitizedHeaders,\n    body: sanitizedBody,\n    query: Object.fromEntries(reqUrl.searchParams),\n    status: response.status,\n    duration: Date.now() - startTime,\n    service,\n    createdAt: new Date().toISOString(),\n    response: {\n      success: responseData.success,\n      message: responseData.message,\n      code: responseData.code,\n    },\n    responseData: sanitizedResponseData,\n  }\n\n  // 发送到日志服务\n  try {\n    const res = await fetchWithTimeout(\n      logUrl,\n      {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json', ...customHeaders },\n        body: JSON.stringify(logBody),\n      },\n      timeout\n    )\n\n    if (!res.ok) {\n      throw new Error(`HTTP ${res.status}: ${res.statusText}`)\n    }\n  } catch (error) {\n    onError(error as Error)\n  }\n}\n\n// ============ Re-exports ============\n\nexport { sanitize, sanitizeHeaders, type SanitizeConfig } from './sanitize'\nexport default requestLogger\n"],"mappings":";;;;AAsBA,MAAM,wBAAwB;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;;AAGD,MAAM,sBAAsB;CAC1B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;AAED,MAAM,sBAAsB;AAC5B,MAAM,oBAAoB;;;;AAO1B,SAAS,YAAY,OAAe,aAA6B;AAC/D,KAAI,MAAM,UAAU,EAAG,QAAO;AAC9B,QAAO,MAAM,MAAM,GAAG,EAAE,GAAG,SAAS,MAAM,MAAM,GAAG;;;;;;;;;;;;AAarD,SAAgB,SAAY,MAAS,QAAyB,QAAQ,GAAM;CAC1E,MAAM,EACJ,eAAe,uBACf,aAAa,qBACb,cAAc,qBACd,WAAW,sBACT,UAAU,EAAE;AAGhB,KAAI,QAAQ,SAAU,QAAO;AAE7B,KAAI,SAAS,QAAQ,SAAS,OAC5B,QAAO;AAIT,KAAI,MAAM,QAAQ,KAAK,CACrB,QAAO,KAAK,KAAI,SAAQ,SAAS,MAAM,QAAQ,QAAQ,EAAE,CAAC;AAI5D,KAAI,OAAO,SAAS,UAAU;EAC5B,MAAM,SAAkC,EAAE;AAE1C,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,EAAE;GAC/C,MAAM,WAAW,IAAI,aAAa;AAGlC,OAAI,aAAa,MAAK,UAAS,aAAa,MAAM,EAAE;AAClD,WAAO,OAAO;AACd;;AAIF,OAAI,WAAW,MAAK,UAAS,SAAS,SAAS,MAAM,CAAC,EAAE;AACtD,QAAI,OAAO,UAAU,SACnB,QAAO,OAAO,YAAY,OAAO,YAAY;QAE7C,QAAO,OAAO;AAEhB;;AAIF,UAAO,OAAO,SAAS,OAAO,QAAQ,QAAQ,EAAE;;AAGlD,SAAO;;AAGT,QAAO;;;;;;;;;;;;AAaT,SAAgB,gBACd,SACA,QACwB;CACxB,MAAM,EACJ,aAAa,qBACb,cAAc,wBACZ,UAAU,EAAE;CAEhB,MAAM,SAAiC,EAAE;AAEzC,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,EAAE;EAClD,MAAM,WAAW,IAAI,aAAa;AAGlC,MAAI,aAAa,iBAAiB;AAChC,OAAI,MAAM,WAAW,UAAU,CAC7B,QAAO,OAAO,YAAY,YAAY,MAAM,MAAM,EAAE,EAAE,YAAY;OAElE,QAAO,OAAO,YAAY,OAAO,YAAY;AAE/C;;AAIF,MAAI,aAAa,YAAY,aAAa,cAAc;AACtD,UAAO,OAAO;AACd;;AAIF,MAAI,WAAW,MAAK,UAAS,SAAS,SAAS,MAAM,CAAC,EAAE;AACtD,UAAO,OAAO,YAAY,OAAO,YAAY;AAC7C;;AAGF,SAAO,OAAO;;AAGhB,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC7ET,SAAgB,cAAc,SAA+B;CAC3D,MAAM,EACJ,KACA,SACA,UAAU,EAAE,EACZ,UAAU,KACV,UAAU,gBACV,UAAU,QAAQ,OAClB,UAAU,MACV,eAAe,EAAE,KACf;AAEJ,QAAO,iBAAiB,OAAO,KAAK,SAAS;AAC3C,MAAI,CAAC,QAAS,QAAO,MAAM;EAE3B,MAAM,YAAY,KAAK,KAAK;EAC5B,MAAM,WAAW,MAAM,MAAM;AAG7B,YAAU,KAAK,UAAU,WAAW;GAClC;GACA;GACA;GACA;GACA;GACA;GACA;GACD,CAAC,CAAC,MAAM,QAAQ;AAEjB,SAAO;GACP;;;AAIJ,MAAa,sBAAsB;;AAenC,SAAS,cAAc,QAAgB,MAAuB;AAC5D,KAAI;AAEF,SADc,SAA4B,QAAQ,KAAK,EACzC,QAAQ;SAChB;AACN,SAAO;;;;AAKX,SAAS,eAAe,MAAc,cAA4C;AAChF,QAAO,aAAa,MAAK,YAAW;AAClC,MAAI,OAAO,YAAY,SACrB,QAAO,SAAS,WAAW,KAAK,WAAW,UAAU,IAAI;AAE3D,SAAO,QAAQ,KAAK,KAAK;GACzB;;;AAIJ,eAAe,iBACb,WACA,SACA,SACmB;CACnB,MAAM,aAAa,IAAI,iBAAiB;CACxC,MAAM,YAAY,iBAAiB,WAAW,OAAO,EAAE,QAAQ;AAE/D,KAAI;AACF,SAAO,MAAM,MAAM,WAAW;GAAE,GAAG;GAAS,QAAQ,WAAW;GAAQ,CAAC;WAChE;AACR,eAAa,UAAU;;;AAI3B,eAAe,UACb,KACA,UACA,WACA,SACA;CACA,MAAM,EAAE,KAAK,QAAQ,SAAS,SAAS,eAAe,SAAS,gBAAgB,SAAS,iBAAiB;CAEzG,MAAM,SAAS,IAAI,IAAI,IAAI,IAAI;CAC/B,MAAM,OAAO,OAAO;AAGpB,KAAI,eAAe,MAAM,aAAa,CAAE;AAGxC,KAAI,cAAc,IAAI,QAAQ,KAAK,CAAE;CAGrC,IAAI,OAAgB;AACpB,KAAI;AAEF,OADoB,IAAI,QAAQ,IAAI,eAAe,IAAI,IACvC,SAAS,mBAAmB,CAC1C,QAAO,MAAM,IAAI,OAAO,CAAC,MAAM;SAE3B;CAKR,IAAI,eAA6B,EAAE;AACnC,KAAI;AACF,iBAAe,MAAM,SAAS,OAAO,CAAC,MAAM;SACtC;CAKR,MAAM,UAAkC,EAAE;AAC1C,KAAI,QAAQ,SAAS,OAAO,QAAQ;AAClC,UAAQ,OAAO;GACf;CAGF,MAAM,mBAAmB,gBAAgB,SAAS,eAAe;CACjE,MAAM,gBAAgB,SAAS,MAAM,eAAe;CACpD,MAAM,wBAAwB,SAAS,aAAa,MAAM,eAAe;CAGzE,MAAM,UAAU;EACd,QAAQ,IAAI;EACZ,KAAK,IAAI;EACT;EACA,SAAS;EACT,MAAM;EACN,OAAO,OAAO,YAAY,OAAO,aAAa;EAC9C,QAAQ,SAAS;EACjB,UAAU,KAAK,KAAK,GAAG;EACvB;EACA,4BAAW,IAAI,MAAM,EAAC,aAAa;EACnC,UAAU;GACR,SAAS,aAAa;GACtB,SAAS,aAAa;GACtB,MAAM,aAAa;GACpB;EACD,cAAc;EACf;AAGD,KAAI;EACF,MAAM,MAAM,MAAM,iBAChB,QACA;GACE,QAAQ;GACR,SAAS;IAAE,gBAAgB;IAAoB,GAAG;IAAe;GACjE,MAAM,KAAK,UAAU,QAAQ;GAC9B,EACD,QACD;AAED,MAAI,CAAC,IAAI,GACP,OAAM,IAAI,MAAM,QAAQ,IAAI,OAAO,IAAI,IAAI,aAAa;UAEnD,OAAO;AACd,UAAQ,MAAe;;;AAO3B,kBAAe"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vafast/request-logger",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "API request logging middleware for Vafast",
   "type": "module",
   "main": "./dist/index.mjs",