@vtex/api 6.45.5 → 6.45.8

package/CHANGELOG.md

@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+## [6.45.8] - 2022-02-25
+
+### Fixed
+
+- Remove only cookie fields when cleaning logs.
+
+## [6.45.7] - 2022-02-23
+
+### Fixed
+
+- Remove sensitive data from logs.
+
+## [6.45.6] - 2021-10-26
+
+### Fixed
+
+- `vtex_segment` cookie extraction
+
 ## [6.54.5] - 2021-10-22
 
 ### Fixed

package/lib/clients/janus/Segment.d.ts

@@ -30,7 +30,7 @@ export declare class Segment extends JanusClient {
     getSegmentByToken: (token: string | null, tracingConfig?: RequestTracingConfig | undefined) => Promise<SegmentData>;
     getOrCreateSegment: (query?: Record<string, string> | undefined, token?: string | undefined, tracingConfig?: RequestTracingConfig | undefined) => Promise<{
         segmentData: SegmentData;
-        segmentToken: string | undefined;
+        segmentToken: string | null;
     }>;
     private rawSegment;
 }

package/lib/clients/janus/Segment.js

@@ -1,10 +1,14 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
+const cookie_1 = __importDefault(require("cookie"));
 const ramda_1 = require("ramda");
 const constants_1 = require("../../constants");
 const HttpClient_1 = require("../../HttpClient");
 const JanusClient_1 = require("./JanusClient");
-const Session_1 = require("./Session");
+const SEGMENT_COOKIE = 'vtex_segment';
 const SEGMENT_MAX_AGE_S = 60 * 60; // 60 minutes - segment is actually immutable
 const ALLOWED_QUERY_PREFIXES = ['utm', 'cultureInfo', 'supportedLocales', '__bindingId'];
 const filterAndSortQuery = (query) => {
@@ -21,7 +25,7 @@ const filterAndSortQuery = (query) => {
 };
 const routes = {
     base: '/api/segments',
-    segments: (token) => token ? `${routes.base}/${token}` : routes.base,
+    segments: (token) => (token ? `${routes.base}/${token}` : routes.base),
 };
 class Segment extends JanusClient_1.JanusClient {
     constructor() {
@@ -39,17 +43,17 @@ class Segment extends JanusClient_1.JanusClient {
          */
         this.getSegmentByToken = (token, tracingConfig) => this.rawSegment(token, undefined, tracingConfig).then(ramda_1.prop('data'));
         this.getOrCreateSegment = async (query, token, tracingConfig) => {
-            const { data: segmentData, headers, } = await this.rawSegment(token, query, tracingConfig);
+            const { data: segmentData, headers } = await this.rawSegment(token, query, tracingConfig);
             return {
                 segmentData,
-                segmentToken: Session_1.extractSessionCookie(headers) || token,
+                segmentToken: extractSegmentCookie(headers),
             };
         };
         this.rawSegment = (token, query, tracingConfig) => {
             const { product, workspace } = this.context;
             const filteredQuery = filterAndSortQuery(query);
             const metric = token ? 'segment-get-token' : 'segment-get-new';
-            return this.http.getRaw(routes.segments(token), ({
+            return this.http.getRaw(routes.segments(token), {
                 forceMaxAge: SEGMENT_MAX_AGE_S,
                 headers: {
                     'Content-Type': 'application/json',
@@ -66,8 +70,19 @@ class Segment extends JanusClient_1.JanusClient {
                     requestSpanNameSuffix: metric,
                     ...tracingConfig === null || tracingConfig === void 0 ? void 0 : tracingConfig.tracing,
                 },
-            }));
+            });
         };
     }
 }
 exports.Segment = Segment;
+function extractSegmentCookie(headers) {
+    var _a;
+    for (const setCookie of (_a = headers['set-cookie']) !== null && _a !== void 0 ? _a : []) {
+        const parsedCookie = cookie_1.default.parse(setCookie);
+        const segmentCookie = parsedCookie[SEGMENT_COOKIE];
+        if (segmentCookie != null) {
+            return segmentCookie;
+        }
+    }
+    return null;
+}

package/lib/clients/janus/Session.d.ts

@@ -13,4 +13,3 @@ export declare class Session extends JanusClient {
      */
     updateSession: (key: string, value: any, items: string[], token: any, tracingConfig?: RequestTracingConfig | undefined) => Promise<void>;
 }
-export declare function extractSessionCookie(headers: Record<string, string>): string | null;

package/lib/clients/janus/Session.js

@@ -21,7 +21,7 @@ class Session extends JanusClient_1.JanusClient {
             const { data: sessionData, headers } = await this.http.getRaw(routes.base, {
                 headers: {
                     'Content-Type': 'application/json',
-                    'Cookie': `vtex_session=${token};`,
+                    Cookie: `vtex_session=${token};`,
                 },
                 metric,
                 params: {
@@ -46,7 +46,7 @@ class Session extends JanusClient_1.JanusClient {
             const config = {
                 headers: {
                     'Content-Type': 'application/json',
-                    'Cookie': `vtex_session=${token};`,
+                    Cookie: `vtex_session=${token};`,
                 },
                 metric,
                 params: {
@@ -73,4 +73,3 @@ function extractSessionCookie(headers) {
     }
     return null;
 }
-exports.extractSessionCookie = extractSessionCookie;

package/lib/service/logger/logger.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const constants_1 = require("../../constants");
 const error_1 = require("../../utils/error");
+const log_1 = require("../../utils/log");
 const console_1 = require("./console");
 const linked = !!process.env.VTEX_APP_LINK;
 const app = constants_1.APP.ID;
@@ -22,6 +23,7 @@ class Logger {
         this.log = (message, level) => {
             var _a;
             const data = message ? error_1.cleanError(message) : EMPTY_MESSAGE;
+            log_1.cleanLog(data);
             /* tslint:disable:object-literal-sort-keys */
             const inflatedLog = {
                 __VTEX_IO_LOG: true,

package/lib/utils/json.d.ts

@@ -0,0 +1,5 @@
+export declare function cleanJson(json: {
+    [k: string]: any;
+}, targetFields: string[]): {
+    [k: string]: any;
+};

package/lib/utils/json.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+function cleanJson(json, targetFields) {
+    for (const key of json.keys()) {
+        let deleted = false;
+        for (const field of targetFields) {
+            if (key === field) {
+                delete json[key];
+                deleted = true;
+            }
+        }
+        if (!deleted && typeof json[key] === 'object') {
+            json[key] = cleanJson(json[key], targetFields);
+        }
+    }
+    return json;
+}
+exports.cleanJson = cleanJson;

package/lib/utils/log.d.ts

@@ -0,0 +1,3 @@
+export declare const cleanLog: (log: any) => {
+    [k: string]: any;
+};

package/lib/utils/log.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const json_1 = require("./json");
+const SENSITIVE_FIELDS = ['cookie', 'Cookie', 'vtexIdclientautcookie', 'error'];
+exports.cleanLog = (log) => {
+    return json_1.cleanJson(log, SENSITIVE_FIELDS);
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vtex/api",
-  "version": "6.45.5",
+  "version": "6.45.8",
   "description": "VTEX I/O API client",
   "main": "lib/index.js",
   "typings": "lib/index.d.ts",