@vtex/api 6.52.0 → 6.52.5

package/lib/utils/stringRedactor.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactSecrets = exports.REDACTED = void 0;
+exports.REDACTED = '[Redacted]';
+// Shorter values are not credentials, and replacing them everywhere would damage ordinary text.
+const MIN_SECRET_LENGTH = 16;
+/**
+ * Names under which credentials travel in HTTP headers. When an error is turned into text with
+ * `JSON.stringify`, its request config, and the headers in it, end up in the text under these keys.
+ */
+const SENSITIVE_KEYS = [
+    'authorization',
+    'cookie',
+    'proxy-authorization',
+    'vtexidclientautcookie',
+    'x-vtex-api-appkey',
+    'x-vtex-api-apptoken',
+    'x-vtex-credential',
+    'x-vtex-session',
+];
+// `"key":"value"`, also when the text was serialized twice (`\"key\":\"value\"`). Captures
+// everything up to the value, which is what is replaced. The value is a run of characters that are
+// not a quote, where a backslash only escapes the character after it. The two alternatives of the
+// run exclude each other, so the match is linear.
+const KEYED_VALUE = new RegExp(String.raw `(\\{0,2}"(?:${SENSITIVE_KEYS.join('|')})\\{0,2}"\s*:\s*\\{0,2}")(?:[^"\\]|\\[^"])+`, 'gi');
+// A header written as a line of the request (`Proxy-Authorization: value`), which is how a
+// serialized request object (`_header`) holds it. Short values are not credentials. `Cookie` is
+// not in this list: the word opens ordinary sentences, so its lines are matched separately.
+const HEADER_LINE_NAMES = [
+    'authorization',
+    'proxy-authorization',
+    'vtexidclientautcookie',
+    'x-vtex-api-appkey',
+    'x-vtex-api-apptoken',
+    'x-vtex-credential',
+    'x-vtex-session',
+];
+// The name starts a line. In a serialized request the line break is the two characters `\n`, so a
+// word boundary never fires there: the `n` and the name are both word characters.
+const AT_LINE_START = String.raw `(?<=^|\\n|\\r|\n|\r)`;
+const HEADER_LINE = new RegExp(String.raw `${AT_LINE_START}((?:${HEADER_LINE_NAMES.join('|')})[ \t]*:[ \t]*)[^\s"\\][^\r\n"\\]{7,}`, 'gi');
+// A `Cookie` or `Set-Cookie` line. The value has to be cookie pairs (`name=value`), so a sentence
+// that happens to start with "Cookie:" is left as it is.
+const COOKIE_LINE = new RegExp(String.raw `${AT_LINE_START}((?:set-)?cookie[ \t]*:[ \t]*)[^\s=;"\\]+=[^\r\n"\\]{6,}`, 'gi');
+// The VTEX ID cookie, in a `Cookie` header or a `Set-Cookie` line.
+const VTEX_ID_COOKIE = /\b(VtexIdclientAutCookie(?:_[a-z0-9-]+)?=)[^;\s"\\]+/gi;
+// An `Authorization` value that is not under a key, as in a message or a copied header line.
+const BEARER_TOKEN = /\b(Bearer\s+)[a-z0-9._~+/=-]{16,}/gi;
+const redactKnown = (text, secrets) => {
+    let value = text;
+    let redacted = 0;
+    for (const secret of secrets) {
+        if (!secret || secret.length < MIN_SECRET_LENGTH || !value.includes(secret)) {
+            continue;
+        }
+        const parts = value.split(secret);
+        redacted += parts.length - 1;
+        value = parts.join(exports.REDACTED);
+    }
+    return { redacted, value };
+};
+const redactPattern = (text, pattern) => {
+    let redacted = 0;
+    const value = text.replace(pattern, (match, prefix) => {
+        if (match === `${prefix}${exports.REDACTED}`) {
+            return match;
+        }
+        redacted++;
+        return `${prefix}${exports.REDACTED}`;
+    });
+    return { redacted, value: redacted > 0 ? value : text };
+};
+/**
+ * Replaces credentials in a text: the given secrets wherever they appear, the value of the
+ * credential headers in JSON text and in header lines, `Cookie` and `Set-Cookie` lines, the VTEX
+ * ID cookie, and `Bearer` tokens.
+ * The rest of the text is kept.
+ *
+ * It is for text that was built from an error, where the error object is no longer there to
+ * detect. It does not inspect anything else: a credential that is neither one of the secrets nor
+ * under one of those names is not found.
+ */
+const redactSecrets = (text, secrets = []) => {
+    const known = redactKnown(text, secrets);
+    let value = known.value;
+    let redacted = known.redacted;
+    for (const pattern of [KEYED_VALUE, HEADER_LINE, COOKIE_LINE, VTEX_ID_COOKIE, BEARER_TOKEN]) {
+        const result = redactPattern(value, pattern);
+        value = result.value;
+        redacted += result.redacted;
+    }
+    return { redacted, value: redacted > 0 ? value : text };
+};
+exports.redactSecrets = redactSecrets;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vtex/api",
-  "version": "6.52.0",
+  "version": "6.52.5",
   "description": "VTEX I/O API client",
   "main": "lib/index.js",
   "typings": "lib/index.d.ts",

package/lib/service/metrics/clusterMetricsAggregator.d.ts

@@ -1,72 +0,0 @@
-import { Worker } from 'cluster';
-import { AggregatorRegistry } from 'prom-client';
-/**
- * Cluster-wide Prometheus metrics aggregation.
- *
- * In multi-worker mode each cluster worker keeps its own prom-client default
- * registry. Serving `/metrics` from a single (round-robin selected) worker
- * therefore exposes only that worker's local counters, which makes Prometheus
- * treat the per-scrape braid of independent counters as counter resets and
- * inflates `rate()`/`increase()` by orders of magnitude.
- *
- * This module uses prom-client's `AggregatorRegistry` cluster IPC protocol so
- * that the worker answering a scrape asks the master for a merged, monotonic
- * view built from every worker's registry in one pass (no double-counting of
- * the answering worker).
- */
-/** Tagged IPC message: worker -> master, "please build the cluster aggregate". */
-export declare const AGG_METRICS_REQ = "vtex-api:aggMetricsReq";
-/** Tagged IPC message: master -> worker, carries the aggregate (or an error). */
-export declare const AGG_METRICS_RES = "vtex-api:aggMetricsRes";
-export interface AggMetricsReqMessage {
-    type: typeof AGG_METRICS_REQ;
-    id: number;
-}
-export interface AggMetricsResMessage {
-    type: typeof AGG_METRICS_RES;
-    id: number;
-    body?: string;
-    error?: string;
-}
-export declare const isAggMetricsRequest: (message: any) => message is AggMetricsReqMessage;
-export declare const isAggMetricsResponse: (message: any) => message is AggMetricsResMessage;
-/**
- * prom-client's cluster protocol emits its own tagged IPC messages
- * (`prom-client:getMetricsReq` / `prom-client:getMetricsRes`). They are handled
- * by prom-client's own cluster listeners, so our `onMessage` handlers must
- * ignore them instead of warning about "unknown" messages.
- */
-export declare const isPromClientMessage: (message: any) => boolean;
-/**
- * Constructs the master-side `AggregatorRegistry` (idempotent). Its constructor
- * installs prom-client's master `cluster.on('message')` collector, which is
- * what makes `clusterMetrics()` work. Must be called in the master before any
- * worker can answer a scrape.
- */
-export declare const initMasterAggregatorRegistry: () => AggregatorRegistry;
-/**
- * Handles an `AGG_METRICS_REQ` from a worker: builds the cluster aggregate and
- * replies to that worker only. prom-client fans the request out to *all*
- * connected workers (including the requester), so the requester is one of the N
- * merged sources and is never double-counted.
- */
-export declare const handleWorkerMetricsRequest: (worker: Worker, message: AggMetricsReqMessage) => Promise<void>;
-/**
- * Constructs the worker-side `AggregatorRegistry` (idempotent). Its constructor
- * installs prom-client's worker `process.on('message')` responder that answers
- * the master's `getMetricsReq` with this worker's registry JSON.
- */
-export declare const ensureWorkerAggregatorRegistry: () => AggregatorRegistry;
-/**
- * Requests the cluster aggregate from the master over IPC and resolves with the
- * merged exposition string. On timeout or any error it falls back to this
- * worker's local `register.metrics()` so `/metrics` always answers promptly.
- */
-export declare const requestAggregatedMetrics: () => Promise<string>;
-/**
- * Resolves the pending `requestAggregatedMetrics` promise correlated by id when
- * the master replies. On error it falls back to the local registry.
- */
-export declare const handleMasterMetricsResponse: (message: AggMetricsResMessage) => void;
-/** Test-only helper to reset module state between test cases. */
-export declare const __resetForTests: () => void;

package/lib/service/metrics/clusterMetricsAggregator.js

@@ -1,181 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.__resetForTests = exports.handleMasterMetricsResponse = exports.requestAggregatedMetrics = exports.ensureWorkerAggregatorRegistry = exports.handleWorkerMetricsRequest = exports.initMasterAggregatorRegistry = exports.isPromClientMessage = exports.isAggMetricsResponse = exports.isAggMetricsRequest = exports.AGG_METRICS_RES = exports.AGG_METRICS_REQ = void 0;
-const prom_client_1 = require("prom-client");
-const listeners_1 = require("../worker/listeners");
-/**
- * Cluster-wide Prometheus metrics aggregation.
- *
- * In multi-worker mode each cluster worker keeps its own prom-client default
- * registry. Serving `/metrics` from a single (round-robin selected) worker
- * therefore exposes only that worker's local counters, which makes Prometheus
- * treat the per-scrape braid of independent counters as counter resets and
- * inflates `rate()`/`increase()` by orders of magnitude.
- *
- * This module uses prom-client's `AggregatorRegistry` cluster IPC protocol so
- * that the worker answering a scrape asks the master for a merged, monotonic
- * view built from every worker's registry in one pass (no double-counting of
- * the answering worker).
- */
-/** Tagged IPC message: worker -> master, "please build the cluster aggregate". */
-exports.AGG_METRICS_REQ = 'vtex-api:aggMetricsReq';
-/** Tagged IPC message: master -> worker, carries the aggregate (or an error). */
-exports.AGG_METRICS_RES = 'vtex-api:aggMetricsRes';
-/**
- * Upper bound for a worker waiting on the master aggregate. prom-client's own
- * `clusterMetrics()` has a 5s timeout collecting worker registries; we guard
- * slightly above that and fall back to the local registry on expiry so that
- * `/metrics` never hangs or returns empty.
- */
-const AGG_METRICS_TIMEOUT_MS = 6000;
-const isAggMetricsRequest = (message) => (message === null || message === void 0 ? void 0 : message.type) === exports.AGG_METRICS_REQ && typeof (message === null || message === void 0 ? void 0 : message.id) === 'number';
-exports.isAggMetricsRequest = isAggMetricsRequest;
-const isAggMetricsResponse = (message) => (message === null || message === void 0 ? void 0 : message.type) === exports.AGG_METRICS_RES && typeof (message === null || message === void 0 ? void 0 : message.id) === 'number';
-exports.isAggMetricsResponse = isAggMetricsResponse;
-/**
- * prom-client's cluster protocol emits its own tagged IPC messages
- * (`prom-client:getMetricsReq` / `prom-client:getMetricsRes`). They are handled
- * by prom-client's own cluster listeners, so our `onMessage` handlers must
- * ignore them instead of warning about "unknown" messages.
- */
-const isPromClientMessage = (message) => typeof (message === null || message === void 0 ? void 0 : message.type) === 'string' && message.type.startsWith('prom-client:');
-exports.isPromClientMessage = isPromClientMessage;
-// ---------------------------------------------------------------------------
-// Master side
-// ---------------------------------------------------------------------------
-let masterAggregatorRegistry;
-/**
- * Constructs the master-side `AggregatorRegistry` (idempotent). Its constructor
- * installs prom-client's master `cluster.on('message')` collector, which is
- * what makes `clusterMetrics()` work. Must be called in the master before any
- * worker can answer a scrape.
- */
-const initMasterAggregatorRegistry = () => {
-    if (!masterAggregatorRegistry) {
-        masterAggregatorRegistry = new prom_client_1.AggregatorRegistry();
-    }
-    return masterAggregatorRegistry;
-};
-exports.initMasterAggregatorRegistry = initMasterAggregatorRegistry;
-/**
- * Handles an `AGG_METRICS_REQ` from a worker: builds the cluster aggregate and
- * replies to that worker only. prom-client fans the request out to *all*
- * connected workers (including the requester), so the requester is one of the N
- * merged sources and is never double-counted.
- */
-const handleWorkerMetricsRequest = async (worker, message) => {
-    var _a, _b;
-    const aggregator = (0, exports.initMasterAggregatorRegistry)();
-    let response;
-    try {
-        const body = await aggregator.clusterMetrics();
-        response = { type: exports.AGG_METRICS_RES, id: message.id, body };
-    }
-    catch (err) {
-        response = { type: exports.AGG_METRICS_RES, id: message.id, error: (_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : String(err) };
-    }
-    // `worker.send` can throw (e.g. the worker disconnected between the request
-    // and the reply). This handler is invoked without `await` from the master's
-    // message listener, so a thrown send would surface as an unhandled rejection
-    // in the master process. Swallow and log it instead.
-    try {
-        worker.send(response);
-    }
-    catch (err) {
-        listeners_1.logger.warn({
-            content: (_b = err === null || err === void 0 ? void 0 : err.message) !== null && _b !== void 0 ? _b : String(err),
-            message: 'Failed to send aggregated cluster metrics to worker',
-            pid: process.pid,
-            workerId: worker.id,
-        });
-    }
-};
-exports.handleWorkerMetricsRequest = handleWorkerMetricsRequest;
-// ---------------------------------------------------------------------------
-// Worker side
-// ---------------------------------------------------------------------------
-let workerAggregatorRegistry;
-const pendingRequests = new Map();
-let requestCounter = 0;
-/**
- * Constructs the worker-side `AggregatorRegistry` (idempotent). Its constructor
- * installs prom-client's worker `process.on('message')` responder that answers
- * the master's `getMetricsReq` with this worker's registry JSON.
- */
-const ensureWorkerAggregatorRegistry = () => {
-    if (!workerAggregatorRegistry) {
-        workerAggregatorRegistry = new prom_client_1.AggregatorRegistry();
-    }
-    return workerAggregatorRegistry;
-};
-exports.ensureWorkerAggregatorRegistry = ensureWorkerAggregatorRegistry;
-/**
- * Requests the cluster aggregate from the master over IPC and resolves with the
- * merged exposition string. On timeout or any error it falls back to this
- * worker's local `register.metrics()` so `/metrics` always answers promptly.
- */
-const requestAggregatedMetrics = async () => {
-    if (typeof process.send !== 'function') {
-        return prom_client_1.register.metrics();
-    }
-    const id = requestCounter++;
-    return new Promise((resolve) => {
-        var _a;
-        const timer = setTimeout(() => {
-            pendingRequests.delete(id);
-            listeners_1.logger.warn({
-                message: 'Timed out waiting for aggregated cluster metrics; falling back to local registry',
-                pid: process.pid,
-            });
-            prom_client_1.register.metrics().then(resolve).catch(() => resolve(''));
-        }, AGG_METRICS_TIMEOUT_MS);
-        pendingRequests.set(id, { resolve, timer });
-        try {
-            process.send({ type: exports.AGG_METRICS_REQ, id });
-        }
-        catch (err) {
-            clearTimeout(timer);
-            pendingRequests.delete(id);
-            listeners_1.logger.warn({
-                content: (_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : String(err),
-                message: 'Failed to request aggregated cluster metrics; falling back to local registry',
-                pid: process.pid,
-            });
-            prom_client_1.register.metrics().then(resolve).catch(() => resolve(''));
-        }
-    });
-};
-exports.requestAggregatedMetrics = requestAggregatedMetrics;
-/**
- * Resolves the pending `requestAggregatedMetrics` promise correlated by id when
- * the master replies. On error it falls back to the local registry.
- */
-const handleMasterMetricsResponse = (message) => {
-    const pending = pendingRequests.get(message.id);
-    if (!pending) {
-        return;
-    }
-    pendingRequests.delete(message.id);
-    clearTimeout(pending.timer);
-    if (message.error != null || message.body == null) {
-        listeners_1.logger.warn({
-            content: message.error,
-            message: 'Master failed to aggregate cluster metrics; falling back to local registry',
-            pid: process.pid,
-        });
-        prom_client_1.register.metrics().then(pending.resolve).catch(() => pending.resolve(''));
-        return;
-    }
-    pending.resolve(message.body);
-};
-exports.handleMasterMetricsResponse = handleMasterMetricsResponse;
-/** Test-only helper to reset module state between test cases. */
-// tslint:disable-next-line:variable-name
-const __resetForTests = () => {
-    masterAggregatorRegistry = undefined;
-    workerAggregatorRegistry = undefined;
-    pendingRequests.forEach((p) => clearTimeout(p.timer));
-    pendingRequests.clear();
-    requestCounter = 0;
-};
-exports.__resetForTests = __resetForTests;

package/lib/service/metrics/requestHandlerLabel.d.ts

@@ -1,26 +0,0 @@
-/**
- * Label value reported for requests that never reached a named handler: unmatched
- * paths (Koa answers its default 404), requests rejected before the route pipeline
- * (replica-level rate limiter, errors in compress/recorder), and handlers that
- * don't set `ctx.requestHandlerName`.
- *
- * The value must be a non-empty string. `ctx.requestHandlerName` is `undefined`
- * for those requests, and Node's cluster IPC serializes each worker's registry as
- * JSON, which drops properties whose value is `undefined`. The sample then reaches
- * the aggregated `/metrics` with the `handler` label missing altogether, which
- * Prometheus reads as `handler=""` — a distinct, unnamed series that shows up as
- * an extra "Value" line in dashboards.
- *
- * `'undefined'` is deliberate rather than a nicer word: prom-client's local
- * exposition already rendered `handler: undefined` as `handler="undefined"` before
- * the cluster aggregation was introduced, so keeping that value makes the
- * aggregated output match the historical series identity and keeps existing
- * dashboards, filters and alerts (e.g. `handler!~"builtin:.*|undefined"`) working.
- */
-export declare const UNNAMED_REQUEST_HANDLER = "undefined";
-/**
- * Resolves the `handler` label value for a request, falling back to
- * {@link UNNAMED_REQUEST_HANDLER} when the pipeline never named the handler.
- * Empty strings fall back too, so the label is never emitted empty.
- */
-export declare const requestHandlerLabel: (requestHandlerName?: string) => string;

package/lib/service/metrics/requestHandlerLabel.js

@@ -1,30 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.requestHandlerLabel = exports.UNNAMED_REQUEST_HANDLER = void 0;
-/**
- * Label value reported for requests that never reached a named handler: unmatched
- * paths (Koa answers its default 404), requests rejected before the route pipeline
- * (replica-level rate limiter, errors in compress/recorder), and handlers that
- * don't set `ctx.requestHandlerName`.
- *
- * The value must be a non-empty string. `ctx.requestHandlerName` is `undefined`
- * for those requests, and Node's cluster IPC serializes each worker's registry as
- * JSON, which drops properties whose value is `undefined`. The sample then reaches
- * the aggregated `/metrics` with the `handler` label missing altogether, which
- * Prometheus reads as `handler=""` — a distinct, unnamed series that shows up as
- * an extra "Value" line in dashboards.
- *
- * `'undefined'` is deliberate rather than a nicer word: prom-client's local
- * exposition already rendered `handler: undefined` as `handler="undefined"` before
- * the cluster aggregation was introduced, so keeping that value makes the
- * aggregated output match the historical series identity and keeps existing
- * dashboards, filters and alerts (e.g. `handler!~"builtin:.*|undefined"`) working.
- */
-exports.UNNAMED_REQUEST_HANDLER = 'undefined';
-/**
- * Resolves the `handler` label value for a request, falling back to
- * {@link UNNAMED_REQUEST_HANDLER} when the pipeline never named the handler.
- * Empty strings fall back too, so the label is never emitted empty.
- */
-const requestHandlerLabel = (requestHandlerName) => requestHandlerName || exports.UNNAMED_REQUEST_HANDLER;
-exports.requestHandlerLabel = requestHandlerLabel;