@voxgig/sdkgen 4.32.1 → 4.34.0

package/project/.sdk/tm/lua/core/error.lua

@@ -1,8 +1,14 @@
 -- ProjectName SDK error
 
+local json = require("dkjson")
+
 local ProjectNameError = {}
 ProjectNameError.__index = ProjectNameError
 
+-- Reachable for a debugger, absent from the table itself: the context holds
+-- the live spec and options, and an error is what gets dumped or encoded.
+local CONTEXT = setmetatable({}, { __mode = "k" })
+
 
 function ProjectNameError.new(code, msg, ctx)
   local self = setmetatable({}, ProjectNameError)
@@ -10,21 +16,50 @@ function ProjectNameError.new(code, msg, ctx)
   self.sdk = "ProjectName"
   self.code = code or ""
   self.msg = msg or ""
-  self.ctx = ctx
   self.result = nil
   self.spec = nil
+  CONTEXT[self] = ctx
   return self
 end
 
 
+function ProjectNameError:context()
+  return CONTEXT[self]
+end
+
+
 function ProjectNameError:error()
   return self.msg
 end
 
 
+-- What make_error attached is already cleaned; the context is not part of
+-- the record.
+function ProjectNameError:to_table()
+  return {
+    sdk = self.sdk,
+    code = self.code,
+    msg = self.msg,
+    status = self.status,
+    result = self.result,
+    spec = self.spec,
+  }
+end
+
+
+function ProjectNameError:to_json()
+  return json.encode(self:to_table())
+end
+
+
 function ProjectNameError:__tostring()
   return self.msg
 end
 
 
+function ProjectNameError.__tojson(self)
+  return self:to_json()
+end
+
+
 return ProjectNameError

package/project/.sdk/tm/lua/core/utility_type.lua

@@ -10,6 +10,8 @@ function Utility.new()
 
   -- All utility functions are set by the register module
   self.clean = nil
+  self.clean_add = nil
+  self.clean_explain = nil
   self.done = nil
   self.make_error = nil
   self.feature_add = nil
@@ -51,6 +53,8 @@ end
 function Utility.copy(src)
   local u = Utility.new()
   u.clean = src.clean
+  u.clean_add = src.clean_add
+  u.clean_explain = src.clean_explain
   u.done = src.done
   u.make_error = src.make_error
   u.feature_add = src.feature_add

package/project/.sdk/tm/lua/feature/audit_feature.lua

@@ -94,7 +94,7 @@ function AuditFeature:_emit(ctx, outcome)
     actor = "anonymous"
   end
 
-  local record = {
+  local record = ctx.utility.clean(ctx, {
     seq = self.seq,
     ts = self:_now(),
     actor = actor,
@@ -103,7 +103,7 @@ function AuditFeature:_emit(ctx, outcome)
     outcome = outcome,
     status = ctx.result ~= nil and ctx.result.status or nil,
     correlationId = ctx.id,
-  }
+  })
 
   local client = self.client
   local recs = client._audit.records

package/project/.sdk/tm/lua/feature/cost_feature.lua

@@ -301,7 +301,7 @@ function CostFeature:_commit(ctx, pending, entity, opname)
   self:_bump(cost.actors, actor, amount)
 
   self.seq = self.seq + 1
-  local record = {
+  local record = ctx.utility.clean(ctx, {
     seq = self.seq,
     entity = entity,
     op = opname,
@@ -310,7 +310,7 @@ function CostFeature:_commit(ctx, pending, entity, opname)
     currency = cost.currency,
     source = source,
     attempts = pending.attempts,
-  }
+  })
   cost.last = record
 
   local sink = self.options["sink"]

package/project/.sdk/tm/lua/feature/debug_feature.lua

@@ -2,12 +2,12 @@
 --
 -- Request/response capture for debugging. Records a bounded ring buffer
 -- of per-operation traces — op, method, URL, redacted headers, response
--- status and timing — on `client._debug.entries`. Sensitive header values
--- (names matching `redact`, default authorization/cookie/api-key style
--- names) are masked as `<redacted>`. An optional `on_entry` callback
--- (camelCase `onEntry` also accepted, matching the other targets)
--- receives each finished entry. `max` caps the buffer (default 100). The
--- clock is injectable (`now`) for deterministic tests.
+-- status and timing — on `client._debug.entries`. Every entry passes
+-- through the SDK's clean rules (clean.keys and every registered secret);
+-- the `redact` option ADDS header names on top of them. An optional
+-- `on_entry` callback (camelCase `onEntry` also accepted, matching the
+-- other targets) receives each finished entry. `max` caps the buffer
+-- (default 100). The clock is injectable (`now`) for deterministic tests.
 
 local BaseFeature = require("feature.base_feature")
 
@@ -16,12 +16,6 @@ DebugFeature.__index = DebugFeature
 setmetatable(DebugFeature, { __index = BaseFeature })
 
 
-local REDACT = {
-  "authorization", "cookie", "set-cookie", "api-key", "apikey",
-  "x-api-key", "idempotency-key",
-}
-
-
 function DebugFeature.new()
   local self = setmetatable(BaseFeature.new(), DebugFeature)
   self.version = "0.0.1"
@@ -76,7 +70,7 @@ function DebugFeature:PreRequest(ctx)
       ((ctx.op ~= nil and ctx.op.name) or "_"),
     method = method,
     url = url,
-    headers = self:_redact(headers),
+    headers = self:_redact(ctx, headers),
     start = self:_now(),
   }
   self.entries[ctx] = entry
@@ -140,6 +134,11 @@ function DebugFeature:_finish(ctx, ok)
     entry.status = ctx.result.status
   end
 
+  -- The whole entry leaves through the buffer and the callback: the url
+  -- and the error message can carry a query credential the header mask
+  -- above never saw.
+  entry = ctx.utility.clean(ctx, entry)
+
   local client = self.client
   local buf = client._debug.entries
   table.insert(buf, entry)
@@ -155,11 +154,16 @@ function DebugFeature:_finish(ctx, ok)
 end
 
 
-function DebugFeature:_redact(headers)
+-- The core clean rules apply (clean.keys, every registered value); the
+-- feature's own `redact` list ADDS header names on top of them.
+function DebugFeature:_redact(ctx, headers)
   if headers == nil then
     return {}
   end
-  local patterns = self.options["redact"] or REDACT
+  local patterns = {}
+  for _, p in ipairs(self.options["redact"] or {}) do
+    patterns[#patterns + 1] = string.lower(tostring(p))
+  end
   local out = {}
   for k, v in pairs(headers) do
     local masked = false
@@ -173,12 +177,12 @@ function DebugFeature:_redact(headers)
       end
     end
     if masked then
-      out[k] = "<redacted>"
+      out[k] = "[redacted]"
     else
       out[k] = v
     end
   end
-  return out
+  return ctx.utility.clean(ctx, out)
 end
 
 

package/project/.sdk/tm/lua/feature/log_feature.lua

@@ -55,7 +55,8 @@ function LogFeature:_loghook(hook, ctx, level)
     opname = ctx.op.name
   end
 
-  local msg = "hook=" .. hook .. " op=" .. opname
+  -- A log line leaves the pipeline, so it is cleaned like every record.
+  local msg = ctx.utility.clean(ctx, "hook=" .. hook .. " op=" .. opname)
 
   local log_fn = self.logger[level]
   if type(log_fn) == "function" then

package/project/.sdk/tm/lua/feature/proxy_feature.lua

@@ -27,6 +27,7 @@ function ProxyFeature.new()
   self.options = nil
   self.url = nil
   self.no_proxy = {}
+  self._ctx = nil
   return self
 end
 
@@ -64,6 +65,22 @@ function ProxyFeature:init(ctx, options)
   end
 
   self.url = url
+  self._ctx = ctx
+
+  -- A proxy URL may carry credentials as userinfo, from the option or the
+  -- environment, and neither is under a sensitive key name.
+  if type(url) == "string" then
+    local userinfo = string.match(url, "^%a[%w+.-]*://([^@/]+)@")
+    if userinfo ~= nil then
+      for part in string.gmatch(userinfo, "[^:]+") do
+        ctx.utility.clean_add(ctx, part)
+        ctx.utility.clean_add(ctx, (string.gsub(part, "%%(%x%x)", function(hex)
+          return string.char(tonumber(hex, 16))
+        end)))
+      end
+    end
+  end
+
   self.no_proxy = {}
   if type(no_proxy) == "string" then
     for part in string.gmatch(no_proxy, "[^,]+") do
@@ -138,7 +155,12 @@ end
 function ProxyFeature:_track(fullurl)
   local client = self.client
   if client._proxy == nil then
-    client._proxy = { routed = 0, url = self.url }
+    local ctx = self._ctx
+    local url = self.url
+    if ctx ~= nil and type(url) == "string" then
+      url = ctx.utility.clean(ctx, url)
+    end
+    client._proxy = { routed = 0, url = url }
   end
   client._proxy.routed = client._proxy.routed + 1
 end

package/project/.sdk/tm/lua/feature/secrets_feature.lua

@@ -153,16 +153,30 @@ function SecretsFeature.new()
   self._resolved = false
   self._initerr = nil
 
+  -- The context this feature was initialised against: where clean_add is.
+  self._rootctx = nil
+
   return self
 end
 
 
+-- Every value this feature resolves or buys is a secret the SDK handles,
+-- and none arrives under an option key the intake registration saw.
+function SecretsFeature:_register(value)
+  local ctx = self._rootctx
+  if ctx ~= nil and ctx.utility ~= nil and type(ctx.utility.clean_add) == "function" then
+    ctx.utility.clean_add(ctx, value)
+  end
+end
+
+
 -- init is sync by feature contract: build the chain, never look anything
 -- up here.
 function SecretsFeature:init(ctx, options)
   self.client = ctx.client
   self.options = options or {}
   self._liveopts = ctx.options or {}
+  self._rootctx = ctx
   self.active = (self.options["active"] == true)
 
   if not self.active then
@@ -227,6 +241,7 @@ function SecretsFeature:init(ctx, options)
   local specs = {}
 
   if type(explicit) == "string" and explicit ~= "" then
+    self:_register(explicit)
     local ok, key = pcall(sekreto.envkey, self._secretname, "")
     if ok then
       specs[#specs + 1] = {
@@ -358,6 +373,7 @@ function SecretsFeature:_resolve_once()
   if not ok then
     return found
   end
+  self:_register(found)
 
   if self._exchange == nil then
     -- A hit is the credential. An UNCACHED miss after an earlier hit is a
@@ -683,6 +699,8 @@ function SecretsFeature:_buy_once()
       "secrets: token exchange returned no '" .. x.response .. "' field from " .. url)
   end
 
+  self:_register(token)
+
   return token, nil
 end
 

package/project/.sdk/tm/lua/feature/telemetry_feature.lua

@@ -123,13 +123,15 @@ function TelemetryFeature:_close(ctx, ok)
   span.durationMs = math.max(0, span["end"] - span.start)
   span.ok = ok
 
+  local out = ctx.utility.clean(ctx, span)
+
   local client = self.client
   client._telemetry.active = client._telemetry.active - 1
-  table.insert(client._telemetry.spans, span)
+  table.insert(client._telemetry.spans, out)
 
   local exporter = self.options["exporter"]
   if type(exporter) == "function" then
-    pcall(exporter, span)
+    pcall(exporter, out)
   end
 end
 

package/project/.sdk/tm/lua/test/feature/secrets/secrets_feature_test.lua

@@ -195,9 +195,10 @@ end
 
 -- The entity accessors this SDK generated, found from the client's own
 -- config: this file is a TEMPLATE and no project's entity names are known
--- here. Accessors are PascalCase methods on the SDK class.
+-- here. Accessors are PascalCase methods on the SDK class, which is the
+-- client's metatable: its __index is a function that hides the options.
 local function entity_accessors(client)
-  local class = getmetatable(client).__index
+  local class = getmetatable(client)
   local out = {}
   for name, _ in pairs(client:options_map().entity or {}) do
     local flat = name:gsub("_", ""):lower()

package/project/.sdk/tm/lua/test/feature_test.lua

@@ -111,7 +111,14 @@ local function make_client(spec)
   local base = spec.base or "http://api.test"
   local server = spec.server or default_server
 
-  local utility = { fetcher = server }
+  -- Every feature cleans what it emits, so the fake utility carries the real
+  -- clean seam beside the transport.
+  local cleanmod = require("utility.clean")
+  local utility = {
+    fetcher = server,
+    clean = cleanmod.clean,
+    clean_add = cleanmod.clean_add,
+  }
 
   local client = {
     mode = "test",
@@ -922,7 +929,7 @@ describe("feature", function()
       local entries = h.client._debug.entries
       assert.are.equal(1, #entries) -- ring buffer capped at max
       assert.are.equal(2, #seen)
-      assert.are.equal("<redacted>", seen[1].headers.authorization)
+      assert.are.equal("[redacted]", seen[1].headers.authorization)
     end)
 
     if has_feature("netsim") then it("captures failures", function()
@@ -940,7 +947,7 @@ describe("feature", function()
       } })
       h.op({ op = "load", headers = { ["x-secret"] = "hide", ["x-ok"] = "show" } })
       local e = h.client._debug.entries[1]
-      assert.are.equal("<redacted>", e.headers["x-secret"])
+      assert.are.equal("[redacted]", e.headers["x-secret"])
       assert.are.equal("show", e.headers["x-ok"])
     end)