@voxgig/sdkgen 4.32.1 → 4.33.0

package/project/.sdk/tm/ocaml/sdk_types.ml

@@ -130,6 +130,7 @@ and utility = {
   mutable u_struct : struct_api;
   mutable u_fetcher : ctx -> string -> value -> (value * sdk_error option);
   mutable u_clean : ctx -> value -> value;
+  mutable u_clean_add : ctx -> string -> unit;
   mutable u_done : ctx -> value;
   mutable u_make_error : ctx -> sdk_error option -> value;
   mutable u_feature_add : ctx -> feature -> unit;

package/project/.sdk/tm/ocaml/test/feature/secrets/t_secrets.ml

@@ -752,8 +752,10 @@ let () =
       (* A non-live client: the credential becomes the deterministic
        * `test-<response>` and no purchase is attempted. Observed through
        * ctrl.explain, which records the live fetchdef whose headers map
-       * the wrapper rewrites in place. *)
+       * the wrapper rewrites in place. The explain record is cleaned, so
+       * clean is off for the header to read raw. *)
       let client = Sdk_client.test_with Noval (jo [
+          ("clean", jo [("active", Bool false)]);
           ("feature", jo [("secrets", jo [("active", Bool true); refresh_chain "R1";
                                           ("name", Str "refresh_token"); xchg []])])]) in
       let explain = empty_map () in

package/project/.sdk/tm/ocaml/test/t_feature.ml

@@ -339,7 +339,7 @@ let () =
         ignore (op h ~op:"list" ());
         check_int "entries" (size (getp (track h "debug") "entries")) 1;
         check_int "seen" (List.length !seen) 2;
-        check_vstr "redacted" (getp (getp (List.nth !seen 0) "headers") "authorization") "<redacted>");
+        check_vstr "redacted" (getp (getp (List.nth !seen 0) "headers") "authorization") "[redacted]");
     test "debug.captures_failures" (fun () ->
         let h = make_client [("netsim", jo [("failTimes", Num 1.); ("failStatus", Num 500.)]); ("debug", empty_map ())] in
         ignore (op h ~op:"load" ());
@@ -350,7 +350,7 @@ let () =
         let h = make_client [("debug", jo [("now", vfunc0 (fun () -> Num 7.)); ("redact", ja [Str "x-secret"])])] in
         ignore (op h ~op:"load" ~headers:[("x-secret", Str "hide"); ("x-ok", Str "show")] ());
         let e0 = getelem (getp (track h "debug") "entries") (Num 0.) in
-        check_vstr "secret" (getp (getp e0 "headers") "x-secret") "<redacted>";
+        check_vstr "secret" (getp (getp e0 "headers") "x-secret") "[redacted]";
         check_vstr "ok hdr" (getp (getp e0 "headers") "x-ok") "show";
         check_vnum "duration" (getp e0 "durationMs") 0.);
     test "debug.inactive" (fun () ->

package/project/.sdk/tm/perl/core/context.pm

@@ -136,4 +136,31 @@ sub make_error {
   return ProjectNameError->new($code, $msg, $self);
 }
 
+# The serialised context leaves the pipeline (a logger, an error dump), so
+# it is cleaned; the live fields stay raw for the pipeline's own use. The
+# entity goes in as its own record: it holds the client, and the struct's
+# serialisers walk a blessed hash whole.
+sub TO_JSON {
+  my ($self) = @_;
+  my $entity = $self->{entity};
+  $entity = $entity->TO_JSON
+    if Scalar::Util::blessed($entity) && $entity->can('TO_JSON');
+  my $record = {
+    'id'       => $self->{id},
+    'op'       => $self->{op},
+    'spec'     => $self->{spec},
+    'entity'   => $entity,
+    'result'   => $self->{result},
+    'response' => $self->{response},
+    'meta'     => $self->{meta},
+  };
+  my $clean = $self->{utility} ? $self->{utility}{clean} : undef;
+  return ref $clean eq 'CODE' ? $clean->($self, $record) : $record;
+}
+
+sub to_string {
+  my ($self) = @_;
+  return 'Context ' . Voxgig::Struct::jsonify($self->TO_JSON);
+}
+
 1;

package/project/.sdk/tm/perl/core/error.pm

@@ -3,6 +3,8 @@
 use strict;
 use warnings;
 
+use Scalar::Util ();
+
 package ProjectNameError;
 
 use overload
@@ -10,21 +12,66 @@ use overload
   'bool'   => sub { 1 },
   fallback => 1;
 
+# The context stays reachable for a debugger (`$err->ctx`) and is part of
+# no dump: a blessed hash hides nothing from Data::Dumper or the struct's
+# own serialiser, so it lives in an inside-out slot beside the object,
+# weakened so an error never keeps a finished operation alive.
+my %CTX;
+
 sub new {
   my ($class, $code, $msg, $ctx) = @_;
-  return bless {
+  my $self = bless {
     is_sdk_error => 1,
     sdk          => 'ProjectName',
     code         => (defined $code ? $code : ''),
     msg          => (defined $msg ? $msg : ''),
-    ctx          => $ctx,
     result       => undef,
     spec         => undef,
+    # make_error promotes the HTTP status here (-1 when there was no
+    # response), so a consumer never reaches into `result` for it.
+    status       => -1,
   }, $class;
+  $self->ctx($ctx) if defined $ctx;
+  return $self;
+}
+
+sub ctx {
+  my $self = shift;
+  my $addr = Scalar::Util::refaddr($self);
+  if (@_) {
+    $CTX{$addr} = $_[0];
+    Scalar::Util::weaken($CTX{$addr}) if ref $_[0];
+  }
+  return $CTX{$addr};
+}
+
+sub DESTROY {
+  delete $CTX{ Scalar::Util::refaddr($_[0]) };
+  return;
 }
 
-sub code  { $_[0]->{code} }
-sub msg   { $_[0]->{msg} }
-sub error { $_[0]->{msg} }
+sub code   { $_[0]->{code} }
+sub msg    { $_[0]->{msg} }
+sub error  { $_[0]->{msg} }
+sub status { $_[0]->{status} }
+
+# What make_error attached is already cleaned; the context is not part of
+# the record.
+sub to_h {
+  my ($self) = @_;
+  return {
+    'sdk'     => $self->{sdk},
+    'code'    => $self->{code},
+    'message' => $self->{msg},
+    'status'  => $self->{status},
+    'result'  => $self->{result},
+    'spec'    => $self->{spec},
+  };
+}
+
+sub TO_JSON {
+  my ($self) = @_;
+  return $self->to_h;
+}
 
 1;

package/project/.sdk/tm/perl/feature/audit_feature.pm

@@ -82,7 +82,7 @@ sub _emit {
   $self->{seen}{$addr} = 1;
   $self->{seq} += 1;
 
-  my $record = {
+  my $record = $ctx->{utility}{clean}->($ctx, {
     'seq' => $self->{seq},
     'ts' => $self->_now,
     'actor' => $self->_actor($ctx),
@@ -91,7 +91,7 @@ sub _emit {
     'outcome' => $outcome,
     'status' => ($ctx->{result} ? $ctx->{result}{status} : undef),
     'correlationId' => $ctx->{id},
-  };
+  });
 
   my $track = $self->{client}{_audit};
   if (!$track) {

package/project/.sdk/tm/perl/feature/cost_feature.pm

@@ -283,7 +283,7 @@ sub _commit {
   $self->_bump($cost->{actors}, $actor, $amount);
 
   $self->{seq} += 1;
-  my $record = {
+  my $record = $ctx->{utility}{clean}->($ctx, {
     'seq' => $self->{seq},
     'entity' => $entity,
     'op' => $opname,
@@ -292,7 +292,7 @@ sub _commit {
     'currency' => $cost->{currency},
     'source' => $source,
     'attempts' => $entry->{attempts},
-  };
+  });
   $cost->{last} = $record;
 
   my $sink = $self->{options}{sink};

package/project/.sdk/tm/perl/feature/debug_feature.pm

@@ -2,8 +2,9 @@
 #
 # Request/response capture for debugging. Records a bounded ring buffer of
 # per-operation traces - method, URL, redacted headers, response status and
-# timing. Sensitive header values (matching "redact", default
-# authorization/cookie/api-key style names) are masked. An optional
+# timing. The SDK's own clean rules (clean.keys and every registered secret
+# value) apply to the whole entry, and the "redact" option ADDS header names
+# on top of them. An optional
 # "on_entry" callback receives each finished entry (e.g. to stream to a
 # console). "max" caps the buffer (default 100). The clock is injectable
 # ("now", ms) for deterministic tests.
@@ -25,11 +26,6 @@ package ProjectNameDebugFeature;
 
 our @ISA = ('ProjectNameBaseFeature');
 
-my @REDACT_DEFAULT = (
-  'authorization', 'cookie', 'set-cookie', 'api-key', 'apikey',
-  'x-api-key', 'idempotency-key',
-);
-
 sub new {
   my ($class) = @_;
   my $self = ProjectNameBaseFeature::new($class);
@@ -73,7 +69,7 @@ sub PreRequest {
       . ($ctx->{op} ? $ctx->{op}{name} : '_'),
     'method' => $method,
     'url' => $url,
-    'headers' => $self->_redact($headers),
+    'headers' => $self->_redact($ctx, $headers),
     'start' => $self->_now,
     'status' => undef,
     'ok' => undef,
@@ -129,6 +125,11 @@ sub _finish {
     $entry->{status} = $ctx->{result}{status};
   }
 
+  # The whole entry leaves through the buffer and the callback: the url
+  # and the error message can carry a query credential the header mask
+  # above never saw.
+  $entry = $ctx->{utility}{clean}->($ctx, $entry);
+
   my $track = $self->{client}{_debug};
   if (!$track) {
     $track = { 'entries' => [] };
@@ -146,16 +147,19 @@ sub _finish {
   return;
 }
 
+# The core clean rules apply (clean.keys, every registered value); the
+# feature's own `redact` list ADDS header names on top of them.
 sub _redact {
-  my ($self, $headers) = @_;
+  my ($self, $ctx, $headers) = @_;
   return {} unless defined $headers;
-  my $patterns = $self->{options}{redact} || \@REDACT_DEFAULT;
+  my $patterns = Voxgig::Struct::islist($self->{options}{redact})
+    ? [ map { lc("$_") } @{ $self->{options}{redact} } ] : [];
   my $out = {};
   for my $k (keys %$headers) {
-    $out->{$k} = (grep { "$_" eq lc("$k") } @$patterns)
-      ? '<redacted>' : $headers->{$k};
+    $out->{$k} = (grep { $_ eq lc("$k") } @$patterns)
+      ? '[redacted]' : $headers->{$k};
   }
-  return $out;
+  return $ctx->{utility}{clean}->($ctx, $out);
 }
 
 sub _now {

package/project/.sdk/tm/perl/feature/log_feature.pm

@@ -45,12 +45,14 @@ sub init {
   return;
 }
 
+# A log line leaves the pipeline, so it is cleaned before the logger sees
+# it, as every emitted record is.
 sub _loghook {
   my ($self, $hook, $ctx, $level) = @_;
   return unless $self->{logger};
   $level = 'info' unless defined $level;
   my $opname = $ctx->{op} ? $ctx->{op}{name} : '';
-  my $msg = "hook=$hook op=$opname";
+  my $msg = $ctx->{utility}{clean}->($ctx, "hook=$hook op=$opname");
   my $line = '[' . uc($level) . "] $msg";
   my $logger = $self->{logger};
   if (ref $logger eq 'CODE') {

package/project/.sdk/tm/perl/feature/proxy_feature.pm

@@ -36,6 +36,7 @@ sub new {
   $self->{options} = {};
   $self->{url} = undef;
   $self->{no_proxy} = [];
+  $self->{ctx} = undef;
   return $self;
 }
 
@@ -66,6 +67,21 @@ sub init {
   }
   $self->{no_proxy} = [grep { defined $_ && '' ne $_ } @np];
 
+  # A proxy URL may carry credentials as userinfo, from the option or the
+  # environment, and neither is under a sensitive key name.
+  $self->{ctx} = $ctx;
+  if (defined $self->{url} && !ref $self->{url}
+    && "$self->{url}" =~ m{\A[A-Za-z][A-Za-z0-9+.-]*://([^/?#@]*)@}) {
+    my $userinfo = $1;
+    for my $part (split /:/, $userinfo, 2) {
+      next unless defined $part && '' ne $part;
+      $ctx->{utility}{clean_add}->($ctx, $part);
+      my $decoded = $part;
+      $decoded =~ s/%([0-9A-Fa-f]{2})/chr(hex($1))/ge;
+      $ctx->{utility}{clean_add}->($ctx, $decoded);
+    }
+  }
+
   my $feature = $self;
   my $utility = $ctx->{utility};
   my $inner = $utility->{fetcher};
@@ -118,7 +134,11 @@ sub _track {
   my ($self, $url) = @_;
   my $track = $self->{client}{_proxy};
   if (!$track) {
-    $track = { 'routed' => 0, 'url' => $self->{url} };
+    my $ctx = $self->{ctx};
+    $track = {
+      'routed' => 0,
+      'url' => $ctx ? $ctx->{utility}{clean}->($ctx, $self->{url}) : $self->{url},
+    };
     $self->{client}{_proxy} = $track;
   }
   $track->{routed} += 1;

package/project/.sdk/tm/perl/feature/secrets_feature.pm

@@ -117,6 +117,9 @@ sub new {
   # chain is fail-closed, never silently unauthenticated.
   $self->{initerr} = undef;
 
+  # The root context, for registering what this feature resolves.
+  $self->{ctx} = undef;
+
   return $self;
 }
 
@@ -127,6 +130,7 @@ sub init {
   my ($self, $ctx, $options) = @_;
 
   $self->{client} = $ctx->{client};
+  $self->{ctx} = $ctx;
   $self->{options} = Voxgig::Struct::ismap($options) ? $options : {};
   $self->{active} = ProjectNameHelpers::is_true($self->{options}{active});
   $self->{liveopts} = Voxgig::Struct::ismap($ctx->{options}) ? $ctx->{options} : {};
@@ -219,6 +223,7 @@ sub _build {
   my @providers;
 
   if ('' ne $explicit) {
+    $self->_register($explicit);
     my $key = eval { Voxgig::Sekreto::envkey($self->{secretname}, '') };
     return _trim("$@") if !defined $key;
     push @providers, {
@@ -366,6 +371,7 @@ sub _resolve_once {
   my $ok = eval { $found = $self->{sek}->try($self->{secretname}); 1 };
   return (_trim(defined $@ && '' ne "$@" ? "$@" : 'secrets: provider failed'), 0)
     if !$ok;
+  $self->_register($found);
 
   if (!defined $self->{exchange}) {
     # An UNCACHED miss after an earlier hit is a REVOCATION: the chain now
@@ -529,7 +535,20 @@ sub _buy {
   $mode = '' unless defined $mode;
   return ('test-' . $self->{exchange}{response}, undef) if 'live' ne $mode;
 
-  return $self->_buy_once();
+  my ($token, $err) = $self->_buy_once();
+  $self->_register($token);
+  return ($token, $err);
+}
+
+
+# Every value this feature resolves or buys is a secret the SDK handles,
+# and none arrives under an option key the intake registration saw.
+sub _register {
+  my ($self, $value) = @_;
+  my $ctx = $self->{ctx};
+  return unless $ctx && $ctx->{utility} && ref $ctx->{utility}{clean_add} eq 'CODE';
+  $ctx->{utility}{clean_add}->($ctx, $value);
+  return;
 }
 
 

package/project/.sdk/tm/perl/feature/telemetry_feature.pm

@@ -115,15 +115,17 @@ sub _close {
   $span->{durationMs} = $dur > 0 ? $dur : 0;
   $span->{ok} = $ok ? Voxgig::Struct::JTRUE() : Voxgig::Struct::JFALSE();
 
+  my $out = $ctx->{utility}{clean}->($ctx, $span);
+
   my $t = $self->_telemetry;
   if ($t) {
     $t->{active} -= 1;
-    push @{ $t->{spans} }, $span;
+    push @{ $t->{spans} }, $out;
   }
 
   my $exporter = $self->{options}{exporter};
   if (ref $exporter eq 'CODE') {
-    eval { $exporter->($span) };
+    eval { $exporter->($out) };
   }
   return;
 }

package/project/.sdk/tm/perl/t/feature.t

@@ -791,7 +791,9 @@ if (has_feature('debug')) {
     my $entries = $h->track('_debug')->{entries};
     is(scalar @$entries, 1, 'debug ring buffer capped at max');
     is(scalar @$seen, 2, 'debug on_entry saw each op');
-    is($seen->[0]{headers}{authorization}, '<redacted>', 'debug redacts authorization');
+    # Masked by the SDK's own clean rule (authorization is a clean.keys
+    # name), which the feature's redact list now sits on top of.
+    is($seen->[0]{headers}{authorization}, '[redacted]', 'debug redacts authorization');
   }
 
   if (has_feature('netsim')) {
@@ -809,7 +811,7 @@ if (has_feature('debug')) {
     my $h = harness([fspec('debug', 'now' => sub { 7 }, 'redact' => ['x-secret'])]);
     $h->op('headers' => { 'x-secret' => 'hide', 'x-ok' => 'show' });
     my $entry = $h->track('_debug')->{entries}[0];
-    is($entry->{headers}{'x-secret'}, '<redacted>', 'debug custom redact');
+    is($entry->{headers}{'x-secret'}, '[redacted]', 'debug custom redact');
     is($entry->{headers}{'x-ok'}, 'show', 'debug leaves other headers');
   }
 }