@vtex/api 6.49.5-beta.0 → 6.49.5

package/lib/tracing/utils.d.ts

@@ -3,9 +3,14 @@ export interface TraceInfo {
     traceId?: string;
     isSampled: boolean;
 }
+/**
+ * Headers that are interesting for tracing and debugging purposes
+ */
+export declare const INTERESTING_HEADERS: string[];
 export declare function getTraceInfo(span?: Span): TraceInfo;
 /**
  * Do a shallow copy of a headers object and redacts sensitive information.
+ * Only includes headers that are in the INTERESTING_HEADERS whitelist.
  *
  * @param headersObj The headers object
  * @param resultFieldsPrefix The prefix that will be added to each field on the result object

package/lib/tracing/utils.js

@@ -1,7 +1,53 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.cloneAndSanitizeHeaders = exports.getTraceInfo = void 0;
+exports.cloneAndSanitizeHeaders = exports.getTraceInfo = exports.INTERESTING_HEADERS = void 0;
 const node_error_report_1 = require("@vtex/node-error-report");
+/**
+ * Headers that are interesting for tracing and debugging purposes
+ */
+exports.INTERESTING_HEADERS = [
+    // Request/Response Identification & Routing
+    'x-request-id',
+    'x-correlation-id',
+    'x-trace-id',
+    'x-span-id',
+    'x-forwarded-for',
+    'x-real-ip',
+    'host',
+    'referer',
+    // Content & Encoding
+    'content-type',
+    'content-length',
+    'content-encoding',
+    'accept',
+    'accept-encoding',
+    'accept-language',
+    // Caching & Performance
+    'cache-control',
+    'etag',
+    'if-none-match',
+    'expires',
+    'last-modified',
+    // Client Information
+    'user-agent',
+    'x-forwarded-proto',
+    'x-forwarded-host',
+    'x-forwarded-port',
+    // VTEX/E-commerce Specific (x-vtex-* headers are handled automatically)
+    'x-router-cache',
+    'x-powered-by-vtex-cache',
+    'jaeger-debug-id',
+    // API & Service Headers
+    'x-api-version',
+    'x-service-name',
+    'x-timeout',
+    'retry-after',
+    // Security (will be sanitized)
+    'authorization',
+    'cookie',
+];
+// Create the set once for performance
+const INTERESTING_HEADERS_SET = new Set(exports.INTERESTING_HEADERS.map(h => h.toLowerCase()));
 function getTraceInfo(span) {
     var _a, _b;
     const spanContext = span === null || span === void 0 ? void 0 : span.context();
@@ -13,6 +59,7 @@ function getTraceInfo(span) {
 exports.getTraceInfo = getTraceInfo;
 /**
  * Do a shallow copy of a headers object and redacts sensitive information.
+ * Only includes headers that are in the INTERESTING_HEADERS whitelist.
  *
  * @param headersObj The headers object
  * @param resultFieldsPrefix The prefix that will be added to each field on the result object
@@ -21,6 +68,11 @@ const cloneAndSanitizeHeaders = (headersObj, resultFieldsPrefix = '') => {
     const ret = {};
     const entries = Object.entries(headersObj);
     for (const [key, val] of entries) {
+        const lowerKey = key.toLowerCase();
+        // Only include headers that are in our whitelist or start with x-vtex-
+        if (!INTERESTING_HEADERS_SET.has(lowerKey) && !lowerKey.startsWith('x-vtex-')) {
+            continue;
+        }
         // Most of the time val is a string, but there are some cases, for example when we do a axios interceptor,
         // that a header field can contain an object, for example:
         // ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vtex/api",
-  "version": "6.49.5-beta.0",
+  "version": "6.49.5",
   "description": "VTEX I/O API client",
   "main": "lib/index.js",
   "typings": "lib/index.d.ts",
@@ -49,7 +49,7 @@
   "dependencies": {
     "@types/koa": "^2.11.0",
     "@types/koa-compose": "^3.2.3",
-    "@vtex/diagnostics-nodejs": "0.1.0-beta.10",
+    "@vtex/diagnostics-nodejs": "0.1.0-beta.8",
     "@vtex/node-error-report": "^0.0.3",
     "@wry/equality": "^0.1.9",
     "agentkeepalive": "^4.0.2",
@@ -124,5 +124,26 @@
     "typemoq": "^2.1.0",
     "typescript": "^4.4.4",
     "typescript-json-schema": "^0.52.0"
+  },
+  "resolutions": {
+    "@opentelemetry/core": "1.30.1",
+    "@opentelemetry/exporter-metrics-otlp-grpc": "0.57.2",
+    "@opentelemetry/exporter-metrics-otlp-http": "0.57.2",
+    "@opentelemetry/exporter-logs-otlp-grpc": "0.57.2",
+    "@opentelemetry/exporter-logs-otlp-http": "0.57.2",
+    "@opentelemetry/exporter-trace-otlp-grpc": "0.57.2",
+    "@opentelemetry/exporter-trace-otlp-http": "0.57.2",
+    "@opentelemetry/instrumentation": "0.57.2",
+    "@opentelemetry/instrumentation-http": "0.57.2",
+    "@opentelemetry/instrumentation-grpc": "0.57.2",
+    "@opentelemetry/instrumentation-net": "0.43.1",
+    "@opentelemetry/propagator-b3": "1.30.1",
+    "@opentelemetry/resource-detector-aws": "1.12.0",
+    "@opentelemetry/resources": "1.30.1",
+    "@opentelemetry/sdk-node": "0.57.2",
+    "@opentelemetry/sdk-logs": "0.57.2",
+    "@opentelemetry/sdk-metrics": "1.30.1",
+    "@opentelemetry/sdk-trace-base": "1.30.1",
+    "@opentelemetry/sdk-trace-node": "1.30.1"
   }
 }