adonisjs-server-stats 1.16.1 → 1.17.0

package/dist/src/dashboard/sensitive_patterns.js

@@ -9,9 +9,22 @@
  */
 // Custom word boundaries: `\b` does not match between `CLIENT` and `SECRET` in
 // `GOOGLE_CLIENT_SECRET`, because `_` is a word character. These treat `_`,
-// `.`, and `-` as separators, and also match a bare token on its own.
+// `.`, and `-` as separators, and also match a bare token on its own. The
+// trailing boundary tolerates a plural `s` so `tokens`/`secrets` match too.
+// camelCase is handled by normalizing the name BEFORE testing (see
+// `splitCamelCase`), not by the boundaries themselves.
 const B = '(?:^|[_.\\-])'; // boundary before
-const A = '(?:$|[_.\\-])'; // boundary after
+const A = 's?(?:$|[_.\\-])'; // boundary after (optional plural)
+/**
+ * Insert `_` at lower/digit→UPPER transitions so the separator-based patterns
+ * above see camelCase the same way they see snake_case. Without this,
+ * `passwordHash` and `clientSecret` — the *normal* shape for AdonisJS config
+ * keys and camelCase column strategies — sail past every pattern while their
+ * snake_case twins are redacted.
+ */
+function splitCamelCase(name) {
+    return name.replace(/([a-z0-9])([A-Z])/g, '$1_$2');
+}
 /**
  * Names that identify a credential — applies to env vars, config keys, and SQL
  * identifiers alike.
@@ -23,6 +36,9 @@ export const SECRET_NAME_PATTERNS = [
     new RegExp(`${B}credential${A}`, 'i'),
     new RegExp(`${B}private${A}`, 'i'),
     new RegExp(`${B}auth${A}`, 'i'),
+    // HTTP credential carriers — log records embed request headers
+    new RegExp(`${B}authorization${A}`, 'i'),
+    new RegExp(`${B}cookie${A}`, 'i'),
     // API keys: `api_key`, `apiKey`, `API_KEY`
     /api[_-]?key/i,
     // `_KEY` at end or `_KEY_` in middle (AWS_ACCESS_KEY_ID, ENCRYPTION_KEY, etc.)
@@ -41,8 +57,18 @@ export const SECRET_NAME_PATTERNS = [
     new RegExp(`${B}encryption${A}`, 'i'),
     // App key / app secret
     /app[_-]key/i,
-    // One-time codes
+    // One-time codes and second factors
     new RegExp(`${B}otp${A}`, 'i'),
+    new RegExp(`${B}totp${A}`, 'i'),
+    new RegExp(`${B}mfa${A}`, 'i'),
+    // Password abbreviations
+    new RegExp(`${B}passwd${A}`, 'i'),
+    new RegExp(`${B}pwd${A}`, 'i'),
+    // Card / identity numbers
+    new RegExp(`${B}cvv${A}`, 'i'),
+    new RegExp(`${B}cvc${A}`, 'i'),
+    new RegExp(`${B}pin${A}`, 'i'),
+    new RegExp(`${B}ssn${A}`, 'i'),
 ];
 /**
  * Names that matter for env vars and config keys but NOT for SQL identifiers.
@@ -60,11 +86,15 @@ export const CONFIG_ONLY_NAME_PATTERNS = [
 ];
 /** Whether a name identifies a credential. */
 export function isSecretName(name) {
-    return SECRET_NAME_PATTERNS.some((pattern) => pattern.test(name));
+    const normalized = splitCamelCase(name);
+    return SECRET_NAME_PATTERNS.some((pattern) => pattern.test(normalized));
 }
 /** Whether a name is sensitive in a config/env context (credentials plus contact/service names). */
 export function isSensitiveConfigName(name) {
-    return isSecretName(name) || CONFIG_ONLY_NAME_PATTERNS.some((pattern) => pattern.test(name));
+    if (isSecretName(name))
+        return true;
+    const normalized = splitCamelCase(name);
+    return CONFIG_ONLY_NAME_PATTERNS.some((pattern) => pattern.test(normalized));
 }
 /** Identifier-ish tokens in a SQL statement: table names, column names, aliases. */
 const SQL_IDENTIFIER_RE = /[A-Za-z_][A-Za-z0-9_$]*/g;
@@ -116,3 +146,114 @@ export function looksLikeCredentialValue(value) {
         return true;
     return CREDENTIAL_VALUE_PATTERNS.some((pattern) => pattern.test(value));
 }
+// ---------------------------------------------------------------------------
+// Binding hygiene
+// ---------------------------------------------------------------------------
+/** Max length for a stored string binding before it is truncated. */
+const MAX_BINDING_LEN = 256;
+/** Placeholder stored in place of a binding that looks like a credential. */
+const REDACTED_BINDING = '[redacted]';
+/**
+ * Redact and truncate SQL bindings before persistence.
+ *
+ * Two independent rules, because neither catches everything on its own:
+ *
+ * 1. **By statement.** If the SQL mentions a credential-shaped identifier
+ *    (`password`, `remember_token`, `otp`, ...), every binding for that
+ *    statement is redacted. Positional bindings cannot be mapped back to
+ *    columns reliably, so this is all-or-nothing per statement — coarse, but
+ *    it is the only thing that catches a short secret like a 6-digit OTP.
+ * 2. **By value shape.** Hashes, JWTs, provider key prefixes, long hex
+ *    digests, and URLs with embedded credentials are redacted wherever they
+ *    appear, regardless of the statement.
+ *
+ * Anything that survives both is truncated at {@link MAX_BINDING_LEN} so an
+ * oversized payload cannot bloat the row.
+ *
+ * Ordinary parameters — ids, flags, emails, timestamps — still pass through, so
+ * the query pane stays useful for debugging.
+ */
+export function sanitizeBindings(bindings, sqlText) {
+    const redactAll = sqlText !== undefined && sqlMentionsSecret(sqlText);
+    return sanitizeBindingValue(bindings, redactAll, true);
+}
+/**
+ * Redact a structured record (a pino log entry, an event payload) with the
+ * same key/shape rules as bindings but WITHOUT length truncation — log data
+ * carries stack traces and payload context that must stay whole.
+ */
+export function sanitizeRecordValues(record) {
+    return sanitizeBindingValue(record, false, false);
+}
+function sanitizeBindingValue(value, redactAll, truncate) {
+    if (Array.isArray(value))
+        return value.map((v) => sanitizeBindingValue(v, redactAll, truncate));
+    if (value !== null && typeof value === 'object') {
+        return sanitizeNamedBindings(value, redactAll, truncate);
+    }
+    if (typeof value === 'string')
+        return sanitizeStringBinding(value, redactAll, truncate);
+    // A statement touching a secret column may bind it as a non-string — a numeric
+    // OTP, for instance — so redact those too rather than only masking strings.
+    // Booleans and null carry nothing worth hiding.
+    const redactable = value !== null && value !== undefined && typeof value !== 'boolean';
+    return redactAll && redactable ? REDACTED_BINDING : value;
+}
+/** Named bindings carry their own key, so use it when it is telling. */
+function sanitizeNamedBindings(value, redactAll, truncate) {
+    const out = {};
+    for (const [key, nested] of Object.entries(value)) {
+        out[key] = sanitizeBindingValue(nested, redactAll || isSecretName(key), truncate);
+    }
+    return out;
+}
+/** Matches a value this module already truncated, so a second pass is a no-op. */
+const TRUNCATION_MARKER_RE = /…\[truncated \d+ chars\]$/;
+function sanitizeStringBinding(value, redactAll, truncate) {
+    if (redactAll || looksLikeCredentialValue(value))
+        return REDACTED_BINDING;
+    if (truncate && value.length > MAX_BINDING_LEN && !TRUNCATION_MARKER_RE.test(value)) {
+        return value.slice(0, MAX_BINDING_LEN) + `…[truncated ${value.length} chars]`;
+    }
+    return value;
+}
+// ---------------------------------------------------------------------------
+// URL hygiene
+// ---------------------------------------------------------------------------
+/**
+ * Redact credential-bearing query parameters from a URL before it is stored.
+ *
+ * Request URLs are persisted with their query strings (useful for debugging
+ * pagination and filters), but a `?token=…` password-reset link or a
+ * `?signature=…` signed URL must not land in SQLite in the clear. Parameters
+ * are redacted by name (see {@link isSecretName}) or when the value itself
+ * looks like a credential; everything else passes through untouched.
+ */
+export function sanitizeUrlQuery(url) {
+    const qIdx = url.indexOf('?');
+    if (qIdx === -1)
+        return url;
+    const sanitized = url
+        .slice(qIdx + 1)
+        .split('&')
+        .map((pair) => {
+        if (pair === '')
+            return pair;
+        const eq = pair.indexOf('=');
+        const name = eq === -1 ? pair : pair.slice(0, eq);
+        const rawValue = eq === -1 ? '' : pair.slice(eq + 1);
+        let value = rawValue;
+        try {
+            value = decodeURIComponent(rawValue);
+        }
+        catch {
+            // Malformed escape — judge the raw text instead.
+        }
+        if (isSecretName(name) || (value !== '' && looksLikeCredentialValue(value))) {
+            return `${name}=[redacted]`;
+        }
+        return pair;
+    })
+        .join('&');
+    return url.slice(0, qIdx) + '?' + sanitized;
+}

package/dist/src/dashboard/write_queue.d.ts

@@ -5,11 +5,18 @@
  * objects. They are pure (no I/O, no Knex dependency) so they can
  * be tested in isolation.
  */
+import { sanitizeBindings } from './sensitive_patterns.js';
 import type { EventRecord, EmailRecord } from '../debug/types.js';
 import type { PersistRequestInput } from './dashboard_types.js';
 import type { Knex } from 'knex';
 export declare function hasWarned(path: string): boolean;
 export declare function markWarned(path: string): void;
+/**
+ * Forget which write paths have warned. Called when a DashboardStore stops so
+ * a re-initialized store in the same process warns afresh instead of
+ * inheriting a spent latch from its predecessor.
+ */
+export declare function resetWriteWarnings(): void;
 /**
  * Normalize a SQL query by replacing literal values with `?` placeholders.
  * Used for grouping identical query patterns.
@@ -20,27 +27,7 @@ export declare function markWarned(path: string): void;
  * merged together.
  */
 export declare function normalizeSql(sql: string): string;
-/**
- * Redact and truncate SQL bindings before persistence.
- *
- * Two independent rules, because neither catches everything on its own:
- *
- * 1. **By statement.** If the SQL mentions a credential-shaped identifier
- *    (`password`, `remember_token`, `otp`, ...), every binding for that
- *    statement is redacted. Positional bindings cannot be mapped back to
- *    columns reliably, so this is all-or-nothing per statement — coarse, but
- *    it is the only thing that catches a short secret like a 6-digit OTP.
- * 2. **By value shape.** Hashes, JWTs, provider key prefixes, long hex
- *    digests, and URLs with embedded credentials are redacted wherever they
- *    appear, regardless of the statement.
- *
- * Anything that survives both is truncated at {@link MAX_BINDING_LEN} so an
- * oversized payload cannot bloat the row.
- *
- * Ordinary parameters — ids, flags, emails, timestamps — still pass through, so
- * the query pane stays useful for debugging.
- */
-export declare function sanitizeBindings(bindings: unknown, sqlText?: string): unknown;
+export { sanitizeBindings };
 export interface PreparedQuery {
     sql_text: string;
     sql_normalized: string;
@@ -100,6 +87,13 @@ export interface EventRow {
 export declare function prepareRequestRows(requests: PersistRequestInput[]): PreparedRequest[];
 /**
  * Transform raw log entries into SQLite-ready row objects.
+ *
+ * The full pino record lands in `data`, and log lines routinely carry bound
+ * request context — authorization headers, cookies, tokens in payloads — so
+ * the record is run through the shared redaction rules (secret-named keys and
+ * credential-shaped values) before it is stringified. The `message` column is
+ * kept verbatim: it is free text, and the shape rules are anchored to whole
+ * values, so prose stays readable.
  */
 export declare function prepareLogRows(logs: Record<string, unknown>[]): PreparedLog[];
 /**
@@ -118,6 +112,11 @@ export declare function buildEmailRow(record: EmailRecord): EmailRow;
 export declare function buildEventRows(events: EventRecord[]): EventRow[];
 /**
  * Insert rows into a table in batches of 50.
+ *
+ * Yields to the event loop between chunks: better-sqlite3 is fully
+ * synchronous, so without a real macrotask hop a large batch would execute
+ * back-to-back on microtask continuations and stall the host app — the exact
+ * failure mode `migrator_tables.ts` documents and guards against.
  */
 export declare function batchInsert(trx: Knex.Transaction, table: string, rows: Record<string, unknown>[]): Promise<void>;
 export declare function flushRequests(trx: Knex.Transaction, preparedRequests: PreparedRequest[]): Promise<void>;

package/dist/src/dashboard/write_queue.js

@@ -6,7 +6,8 @@
  * be tested in isolation.
  */
 import { round } from '../utils/math_helpers.js';
-import { isSecretName, looksLikeCredentialValue, sqlMentionsSecret } from './sensitive_patterns.js';
+import { yieldToEventLoop } from './migrator_tables.js';
+import { sanitizeBindings, sanitizeRecordValues } from './sensitive_patterns.js';
 // ---------------------------------------------------------------------------
 // Warn-once tracking for write-path catch blocks
 // ---------------------------------------------------------------------------
@@ -17,6 +18,14 @@ export function hasWarned(path) {
 export function markWarned(path) {
     warnedWritePaths.add(path);
 }
+/**
+ * Forget which write paths have warned. Called when a DashboardStore stops so
+ * a re-initialized store in the same process warns afresh instead of
+ * inheriting a spent latch from its predecessor.
+ */
+export function resetWriteWarnings() {
+    warnedWritePaths.clear();
+}
 // ---------------------------------------------------------------------------
 // SQL normalization
 // ---------------------------------------------------------------------------
@@ -37,65 +46,11 @@ export function normalizeSql(sql) {
         .trim();
 }
 // ---------------------------------------------------------------------------
-// Binding hygiene
+// Binding hygiene — implementation lives in sensitive_patterns.ts so the
+// in-memory QueryCollector can sanitize at capture time without importing the
+// write path. Re-exported here for existing consumers.
 // ---------------------------------------------------------------------------
-/** Max length for a persisted string binding before it is truncated. */
-const MAX_BINDING_LEN = 256;
-/** Placeholder stored in place of a binding that looks like a credential. */
-const REDACTED_BINDING = '[redacted]';
-/**
- * Redact and truncate SQL bindings before persistence.
- *
- * Two independent rules, because neither catches everything on its own:
- *
- * 1. **By statement.** If the SQL mentions a credential-shaped identifier
- *    (`password`, `remember_token`, `otp`, ...), every binding for that
- *    statement is redacted. Positional bindings cannot be mapped back to
- *    columns reliably, so this is all-or-nothing per statement — coarse, but
- *    it is the only thing that catches a short secret like a 6-digit OTP.
- * 2. **By value shape.** Hashes, JWTs, provider key prefixes, long hex
- *    digests, and URLs with embedded credentials are redacted wherever they
- *    appear, regardless of the statement.
- *
- * Anything that survives both is truncated at {@link MAX_BINDING_LEN} so an
- * oversized payload cannot bloat the row.
- *
- * Ordinary parameters — ids, flags, emails, timestamps — still pass through, so
- * the query pane stays useful for debugging.
- */
-export function sanitizeBindings(bindings, sqlText) {
-    const redactAll = sqlText !== undefined && sqlMentionsSecret(sqlText);
-    return sanitizeBindingValue(bindings, redactAll);
-}
-function sanitizeBindingValue(value, redactAll) {
-    if (Array.isArray(value))
-        return value.map((v) => sanitizeBindingValue(v, redactAll));
-    if (value !== null && typeof value === 'object')
-        return sanitizeNamedBindings(value, redactAll);
-    if (typeof value === 'string')
-        return sanitizeStringBinding(value, redactAll);
-    // A statement touching a secret column may bind it as a non-string — a numeric
-    // OTP, for instance — so redact those too rather than only masking strings.
-    // Booleans and null carry nothing worth hiding.
-    const redactable = value !== null && value !== undefined && typeof value !== 'boolean';
-    return redactAll && redactable ? REDACTED_BINDING : value;
-}
-/** Named bindings carry their own key, so use it when it is telling. */
-function sanitizeNamedBindings(value, redactAll) {
-    const out = {};
-    for (const [key, nested] of Object.entries(value)) {
-        out[key] = sanitizeBindingValue(nested, redactAll || isSecretName(key));
-    }
-    return out;
-}
-function sanitizeStringBinding(value, redactAll) {
-    if (redactAll || looksLikeCredentialValue(value))
-        return REDACTED_BINDING;
-    if (value.length > MAX_BINDING_LEN) {
-        return value.slice(0, MAX_BINDING_LEN) + `…[truncated ${value.length} chars]`;
-    }
-    return value;
-}
+export { sanitizeBindings };
 // ---------------------------------------------------------------------------
 // Pure data-prep functions
 // ---------------------------------------------------------------------------
@@ -135,6 +90,13 @@ export function prepareRequestRows(requests) {
 }
 /**
  * Transform raw log entries into SQLite-ready row objects.
+ *
+ * The full pino record lands in `data`, and log lines routinely carry bound
+ * request context — authorization headers, cookies, tokens in payloads — so
+ * the record is run through the shared redaction rules (secret-named keys and
+ * credential-shaped values) before it is stringified. The `message` column is
+ * kept verbatim: it is free text, and the shape rules are anchored to whole
+ * values, so prose stays readable.
  */
 export function prepareLogRows(logs) {
     return logs.map((entry) => {
@@ -145,7 +107,7 @@ export function prepareLogRows(logs) {
             request_id: entry.request_id || entry.requestId || entry['x-request-id']
                 ? String(entry.request_id || entry.requestId || entry['x-request-id'])
                 : null,
-            data: JSON.stringify(entry),
+            data: JSON.stringify(sanitizeRecordValues(entry)),
         };
     });
 }
@@ -187,9 +149,16 @@ export function buildEventRows(events) {
 // ---------------------------------------------------------------------------
 /**
  * Insert rows into a table in batches of 50.
+ *
+ * Yields to the event loop between chunks: better-sqlite3 is fully
+ * synchronous, so without a real macrotask hop a large batch would execute
+ * back-to-back on microtask continuations and stall the host app — the exact
+ * failure mode `migrator_tables.ts` documents and guards against.
  */
 export async function batchInsert(trx, table, rows) {
     for (let i = 0; i < rows.length; i += 50) {
+        if (i > 0)
+            await yieldToEventLoop();
         await trx(table).insert(rows.slice(i, i + 50));
     }
 }
@@ -233,7 +202,15 @@ async function insertOneRequest(trx, prepared) {
     }
 }
 export async function flushRequests(trx, preparedRequests) {
+    let sinceYield = 0;
     for (const prepared of preparedRequests) {
+        // Up to ~4 synchronous statements per request; a full backlog is hundreds
+        // of them in one flush. Yield periodically so the host app's I/O keeps
+        // being serviced mid-flush (see batchInsert for why awaits alone don't).
+        if (++sinceYield >= 10) {
+            sinceYield = 0;
+            await yieldToEventLoop();
+        }
         try {
             await insertOneRequest(trx, prepared);
         }

package/dist/src/debug/query_collector.js

@@ -1,3 +1,4 @@
+import { sanitizeBindings } from '../dashboard/sensitive_patterns.js';
 import { isExcludedRequest } from '../middleware/request_tracking_middleware.js';
 import { round } from '../utils/math_helpers.js';
 import { RingBuffer } from './ring_buffer.js';
@@ -14,7 +15,11 @@ function buildQueryRecord(data, id) {
     return {
         id,
         sql: data.sql || '',
-        bindings: data.bindings || [],
+        // Sanitized at capture time so the in-memory debug panel never shows a
+        // credential the persisted dashboard would have redacted. The write path
+        // sanitizes again (idempotently) as defense in depth for records loaded
+        // from an older on-disk dump.
+        bindings: sanitizeBindings(data.bindings || [], data.sql || '') ?? [],
         duration: round(parseDuration(data.duration)),
         method: data.method || 'unknown',
         model: data.model || null,

package/dist/src/debug/trace_collector.js

@@ -7,11 +7,16 @@ import { RingBuffer } from './ring_buffer.js';
  */
 const globalRef = { current: null };
 /**
- * Tracks whether console.warn is currently patched by a TraceCollector, so a
- * second instance (or a skipped stop()) cannot double-wrap it and leak the
- * patch permanently.
+ * Tracks which TraceCollector currently owns the console.warn patch, so a
+ * second instance cannot double-wrap it and leak the patch permanently. The
+ * owner (not a boolean) matters: if a prior instance never ran stop(), its
+ * wrapper checks the *old* AsyncLocalStorage and silently stops attaching
+ * warnings to traces — a newcomer must be able to detect that and take over.
  */
-const consoleWarnPatch = { active: false };
+const consoleWarnPatch = {
+    owner: null,
+    original: null,
+};
 /**
  * Wrap an async function in a traced span.
  *
@@ -157,12 +162,18 @@ export class TraceCollector {
             };
             emitter.on('db:query', this.dbHandler);
         }
-        // Intercept console.warn to capture warnings per-request. Guard against
-        // double-wrapping: if another instance (or a prior start() without a
-        // matching stop()) already patched console.warn, don't wrap it again —
-        // that would capture the patched fn as the "original" and leak the patch.
-        if (!consoleWarnPatch.active) {
-            consoleWarnPatch.active = true;
+        // Intercept console.warn to capture warnings per-request. If a prior
+        // instance still owns the patch (its stop() was skipped), restore its
+        // original first and take over — deferring to the stale owner would leave
+        // a wrapper bound to a dead AsyncLocalStorage, silently detaching
+        // warnings from every trace. Never wrap the wrapper: the restore below
+        // guarantees `console.warn` is the real one before we capture it.
+        if (consoleWarnPatch.owner !== this) {
+            if (consoleWarnPatch.owner && consoleWarnPatch.original) {
+                console.warn = consoleWarnPatch.original;
+            }
+            consoleWarnPatch.owner = this;
+            consoleWarnPatch.original = console.warn;
             this.originalConsoleWarn = console.warn;
             console.warn = (...args) => {
                 const ctx = this.als.getStore();
@@ -178,10 +189,12 @@ export class TraceCollector {
         if (this.emitter && this.dbHandler) {
             this.emitter.off('db:query', this.dbHandler);
         }
-        // Only restore console.warn if this instance was the one that patched it.
-        if (this.originalConsoleWarn) {
+        // Only restore console.warn if this instance still owns the patch — a
+        // newer instance may have taken over, and restoring would clobber it.
+        if (consoleWarnPatch.owner === this && this.originalConsoleWarn) {
             console.warn = this.originalConsoleWarn;
-            consoleWarnPatch.active = false;
+            consoleWarnPatch.owner = null;
+            consoleWarnPatch.original = null;
         }
         this.dbHandler = null;
         this.emitter = null;