@voxgig/sdkgen 4.32.1 → 4.33.0

package/project/.sdk/tm/go/core/error.go

@@ -1,25 +1,45 @@
 package core
 
+import "encoding/json"
+
 type ProjectNameError struct {
 	IsProjectNameError bool
-	Sdk              string
-	Code             string
-	Msg              string
-	Ctx              *Context
-	Result           any
-	Spec             any
+	Sdk                string
+	Code               string
+	Msg                string
+	// Reachable for a debugger, invisible to a serialiser: the context holds
+	// the live spec and options, and an error is what gets logged.
+	Ctx    *Context `json:"-"`
+	Result any
+	Spec   any
 }
 
 func NewProjectNameError(code string, msg string, ctx *Context) *ProjectNameError {
 	return &ProjectNameError{
 		IsProjectNameError: true,
-		Sdk:              "ProjectName",
-		Code:             code,
-		Msg:              msg,
-		Ctx:              ctx,
+		Sdk:                "ProjectName",
+		Code:               code,
+		Msg:                msg,
+		Ctx:                ctx,
 	}
 }
 
 func (e *ProjectNameError) Error() string {
 	return e.Msg
 }
+
+// What makeError attached is already cleaned; the context is not part of
+// the record.
+func (e *ProjectNameError) Record() map[string]any {
+	return map[string]any{
+		"sdk":     e.Sdk,
+		"code":    e.Code,
+		"message": e.Msg,
+		"result":  e.Result,
+		"spec":    e.Spec,
+	}
+}
+
+func (e *ProjectNameError) MarshalJSON() ([]byte, error) {
+	return json.Marshal(e.Record())
+}

package/project/.sdk/tm/go/core/utility_type.go

@@ -2,6 +2,8 @@ package core
 
 type Utility struct {
 	Clean             func(ctx *Context, val any) any
+	CleanAdd          func(ctx *Context, val any)
+	CleanExplain      func(ctx *Context)
 	Done              func(ctx *Context) (any, error)
 	MakeError         func(ctx *Context, err error) (any, error)
 	FeatureAdd        func(ctx *Context, f Feature)

package/project/.sdk/tm/go/feature/audit_feature.go

@@ -88,6 +88,7 @@ func (f *AuditFeature) emit(ctx *core.Context, outcome string) {
 	if ctx.Result != nil {
 		record["status"] = ctx.Result.Status
 	}
+	record = fclean(ctx, record)
 
 	f.Records = append(f.Records, record)
 	max := foptInt(f.options, "max", 1000)

package/project/.sdk/tm/go/feature/base_feature.go

@@ -26,6 +26,18 @@ func NewBaseFeature() *BaseFeature {
 	}
 }
 
+// A record on its way to a sink, a buffer or a logger leaves the pipeline,
+// so it is cleaned through the utility slot.
+func fclean(ctx *core.Context, record map[string]any) map[string]any {
+	if ctx == nil || ctx.Utility == nil || ctx.Utility.Clean == nil {
+		return record
+	}
+	if out, ok := ctx.Utility.Clean(ctx, record).(map[string]any); ok {
+		return out
+	}
+	return record
+}
+
 func (f *BaseFeature) GetVersion() string { return f.Version }
 func (f *BaseFeature) GetName() string    { return f.Name }
 func (f *BaseFeature) GetActive() bool    { return f.Active }

package/project/.sdk/tm/go/feature/cost_feature.go

@@ -233,7 +233,7 @@ func (f *CostFeature) commit(ctx *core.Context, pending *costPending, entity, op
 	f.bump(f.Actors, actor, amount)
 
 	f.seq++
-	record := map[string]any{
+	record := fclean(ctx, map[string]any{
 		"seq":      f.seq,
 		"entity":   entity,
 		"op":       opname,
@@ -242,7 +242,7 @@ func (f *CostFeature) commit(ctx *core.Context, pending *costPending, entity, op
 		"currency": f.Currency,
 		"source":   source,
 		"attempts": pending.attempts,
-	}
+	})
 	f.Last = record
 
 	if sink, ok := f.options["sink"].(func(map[string]any)); ok {

package/project/.sdk/tm/go/feature/debug_feature.go

@@ -17,11 +17,6 @@ type DebugFeature struct {
 
 const debugEntryKey = "debug_entry"
 
-var debugDefaultRedact = []string{
-	"authorization", "cookie", "set-cookie", "api-key", "apikey",
-	"x-api-key", "idempotency-key",
-}
-
 func NewDebugFeature() *DebugFeature {
 	return &DebugFeature{
 		BaseFeature: BaseFeature{
@@ -61,7 +56,7 @@ func (f *DebugFeature) PreRequest(ctx *core.Context) {
 		} else {
 			entry["url"] = ctx.Spec.Path
 		}
-		entry["headers"] = f.redact(ctx.Spec.Headers)
+		entry["headers"] = f.redact(ctx, ctx.Spec.Headers)
 	}
 	ctx.Out[debugEntryKey] = entry
 }
@@ -115,6 +110,11 @@ func (f *DebugFeature) finish(ctx *core.Context, ok bool) {
 		entry["status"] = ctx.Result.Status
 	}
 
+	// The whole entry leaves through the buffer and the callback: the url
+	// and the error message can carry a query credential the header mask
+	// above never saw.
+	entry = fclean(ctx, entry)
+
 	f.Entries = append(f.Entries, entry)
 	max := foptInt(f.options, "max", 100)
 	for len(f.Entries) > max {
@@ -126,14 +126,16 @@ func (f *DebugFeature) finish(ctx *core.Context, ok bool) {
 	}
 }
 
-func (f *DebugFeature) redact(headers map[string]any) map[string]any {
+// The core clean rules apply (clean.keys, every registered value); the
+// feature's own `redact` list ADDS header names on top of them.
+func (f *DebugFeature) redact(ctx *core.Context, headers map[string]any) map[string]any {
 	out := map[string]any{}
 	if headers == nil {
 		return out
 	}
-	patterns := foptStrList(f.options, "redact")
-	if patterns == nil {
-		patterns = debugDefaultRedact
+	patterns := []string{}
+	for _, p := range foptStrList(f.options, "redact") {
+		patterns = append(patterns, strings.ToLower(p))
 	}
 	for k, v := range headers {
 		masked := false
@@ -144,10 +146,10 @@ func (f *DebugFeature) redact(headers map[string]any) map[string]any {
 			}
 		}
 		if masked {
-			out[k] = "<redacted>"
+			out[k] = "[redacted]"
 		} else {
 			out[k] = v
 		}
 	}
-	return out
+	return fclean(ctx, out)
 }

package/project/.sdk/tm/go/feature/log_feature.go

@@ -108,16 +108,21 @@ func (f *LogFeature) loghook(hook string, ctx *core.Context, level string) {
 		level = "info"
 	}
 
+	// A log line leaves the pipeline, so it carries the cleaned record: the
+	// spec after auth holds the credential, and a logger serialises whatever
+	// it is handed.
+	record := fclean(ctx, map[string]any{
+		"hook": hook,
+		"op":   ctx.Op,
+		"spec": ctx.Spec,
+		"ctx":  ctx.Record(),
+	})
+
 	attrs := []any{
 		"hook", hook,
-	}
-
-	if ctx.Op != nil {
-		attrs = append(attrs, "op", ctx.Op.Name)
-	}
-
-	if ctx.Spec != nil {
-		attrs = append(attrs, "spec", ctx.Spec.Method+" "+ctx.Spec.Path)
+		"op", record["op"],
+		"spec", record["spec"],
+		"ctx", record["ctx"],
 	}
 
 	switch level {

package/project/.sdk/tm/go/feature/proxy_feature.go

@@ -1,6 +1,7 @@
 package feature
 
 import (
+	neturl "net/url"
 	"os"
 	"regexp"
 	"strings"
@@ -13,8 +14,10 @@ type ProxyFeature struct {
 	client  *core.ProjectNameSDK
 	options map[string]any
 	noProxy []string
+	url     string
 
-	// Activity tracking (mirrors the ts client._proxy record).
+	// Activity tracking (mirrors the ts client._proxy record); the url here
+	// is the cleaned one, the routing target keeps its userinfo.
 	Routed int
 	Url    string
 }
@@ -40,12 +43,12 @@ func (f *ProxyFeature) Init(ctx *core.Context, options map[string]any) {
 		return
 	}
 
-	f.Url = foptStr(f.options, "url", "")
+	f.url = foptStr(f.options, "url", "")
 	noProxy := foptStrList(f.options, "noProxy")
 
 	if foptBool(f.options, "fromEnv", false) {
-		if f.Url == "" {
-			f.Url = firstEnv("HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy")
+		if f.url == "" {
+			f.url = firstEnv("HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy")
 		}
 		if noProxy == nil {
 			if np := firstEnv("NO_PROXY", "no_proxy"); np != "" {
@@ -62,6 +65,23 @@ func (f *ProxyFeature) Init(ctx *core.Context, options map[string]any) {
 		}
 	}
 
+	// A proxy URL may carry credentials as userinfo, from the option or the
+	// environment, and neither is under a sensitive key name.
+	f.Url = f.url
+	if parsed, err := neturl.Parse(f.url); err == nil && parsed.User != nil {
+		password, _ := parsed.User.Password()
+		for _, part := range []string{parsed.User.Username(), password} {
+			if part != "" && ctx.Utility.CleanAdd != nil {
+				ctx.Utility.CleanAdd(ctx, part)
+			}
+		}
+	}
+	if ctx.Utility.Clean != nil {
+		if cleaned, ok := ctx.Utility.Clean(ctx, f.url).(string); ok {
+			f.Url = cleaned
+		}
+	}
+
 	inner := ctx.Utility.Fetcher
 
 	ctx.Utility.Fetcher = func(ctx2 *core.Context, url string, fetchdef map[string]any) (any, error) {
@@ -71,7 +91,7 @@ func (f *ProxyFeature) Init(ctx *core.Context, options map[string]any) {
 }
 
 func (f *ProxyFeature) route(url string, fetchdef map[string]any) map[string]any {
-	if f.Url == "" || f.bypass(url) {
+	if f.url == "" || f.bypass(url) {
 		return fetchdef
 	}
 
@@ -79,7 +99,7 @@ func (f *ProxyFeature) route(url string, fetchdef map[string]any) map[string]any
 	for k, v := range fetchdef {
 		out[k] = v
 	}
-	out["proxy"] = f.Url
+	out["proxy"] = f.url
 
 	f.Routed++
 	return out

package/project/.sdk/tm/go/feature/secrets_feature.go

@@ -120,6 +120,7 @@ func (f *SecretsFeature) Init(ctx *core.Context, options map[string]any) {
 	specs := []*sekreto.ProviderSpec{}
 
 	if "" != explicit {
+		f.register(explicit)
 		key, err := sekreto.EnvKey(f.secretname, "")
 		if nil == err {
 			specs = append(specs, &sekreto.ProviderSpec{
@@ -183,6 +184,18 @@ func (f *SecretsFeature) Init(ctx *core.Context, options map[string]any) {
 	}
 }
 
+// Every value this feature resolves or buys is a secret the SDK handles,
+// and none arrives under an option key the intake registration saw.
+func (f *SecretsFeature) register(value string) {
+	if "" == value || nil == f.client {
+		return
+	}
+	ctx := f.client.GetRootCtx()
+	if nil != ctx && nil != ctx.Utility && nil != ctx.Utility.CleanAdd {
+		ctx.Utility.CleanAdd(ctx, value)
+	}
+}
+
 func (f *SecretsFeature) resolve() error {
 	if nil != f.initerr {
 		return f.initerr
@@ -223,6 +236,9 @@ func (f *SecretsFeature) resolveonce() (bool, error) {
 	if nil != err {
 		return false, err
 	}
+	if has {
+		f.register(found)
+	}
 
 	if nil == f.exchange {
 		f.mu.Lock()
@@ -391,6 +407,7 @@ func (f *SecretsFeature) reauth(fetchdef map[string]any, token string) {
 func (f *SecretsFeature) buy() (string, error) {
 	if "live" != f.client.Mode {
 		token := "test-" + f.exchange.response
+		f.register(token)
 		f.mu.Lock()
 		f.cred = token
 		f.mu.Unlock()
@@ -484,6 +501,8 @@ func (f *SecretsFeature) buyonce() (string, error) {
 			"secrets: token exchange returned no '" + x.response + "' field from " + url)
 	}
 
+	f.register(token)
+
 	return token, nil
 }
 

package/project/.sdk/tm/go/feature/telemetry_feature.go

@@ -108,11 +108,13 @@ func (f *TelemetryFeature) close(ctx *core.Context, ok bool) {
 	span["durationMs"] = dur
 	span["ok"] = ok
 
+	out := fclean(ctx, span)
+
 	f.ActiveSpans--
-	f.Spans = append(f.Spans, span)
+	f.Spans = append(f.Spans, out)
 
 	if exporter, ok := f.options["exporter"].(func(map[string]any)); ok {
-		exporter(span)
+		exporter(out)
 	}
 }
 

package/project/.sdk/tm/go/test/feature_test.go

@@ -812,7 +812,7 @@ func TestFeatureDebug(t *testing.T) {
 			t.Errorf("expected onEntry for both ops, got %d", len(seen))
 		}
 		headers, _ := seen[0]["headers"].(map[string]any)
-		if headers["authorization"] != "<redacted>" {
+		if headers["authorization"] != "[redacted]" {
 			t.Errorf("expected redacted authorization, got %v", headers["authorization"])
 		}
 	})
@@ -839,7 +839,7 @@ func TestFeatureDebug(t *testing.T) {
 		}))
 		h.op(fhOpSpec{op: "load", headers: map[string]any{"x-secret": "hide", "x-ok": "show"}})
 		headers, _ := f.Entries[0]["headers"].(map[string]any)
-		if headers["x-secret"] != "<redacted>" {
+		if headers["x-secret"] != "[redacted]" {
 			t.Errorf("expected x-secret redacted, got %v", headers["x-secret"])
 		}
 		if headers["x-ok"] != "show" {