adonisjs-server-stats 1.16.1 → 1.18.0

package/dist/src/dashboard/write_queue.js

@@ -6,7 +6,8 @@
  * be tested in isolation.
  */
 import { round } from '../utils/math_helpers.js';
-import { isSecretName, looksLikeCredentialValue, sqlMentionsSecret } from './sensitive_patterns.js';
+import { yieldToEventLoop } from './migrator_tables.js';
+import { sanitizeBindings, sanitizeRecordValues } from './sensitive_patterns.js';
 // ---------------------------------------------------------------------------
 // Warn-once tracking for write-path catch blocks
 // ---------------------------------------------------------------------------
@@ -17,6 +18,14 @@ export function hasWarned(path) {
 export function markWarned(path) {
     warnedWritePaths.add(path);
 }
+/**
+ * Forget which write paths have warned. Called when a DashboardStore stops so
+ * a re-initialized store in the same process warns afresh instead of
+ * inheriting a spent latch from its predecessor.
+ */
+export function resetWriteWarnings() {
+    warnedWritePaths.clear();
+}
 // ---------------------------------------------------------------------------
 // SQL normalization
 // ---------------------------------------------------------------------------
@@ -37,65 +46,11 @@ export function normalizeSql(sql) {
         .trim();
 }
 // ---------------------------------------------------------------------------
-// Binding hygiene
+// Binding hygiene — implementation lives in sensitive_patterns.ts so the
+// in-memory QueryCollector can sanitize at capture time without importing the
+// write path. Re-exported here for existing consumers.
 // ---------------------------------------------------------------------------
-/** Max length for a persisted string binding before it is truncated. */
-const MAX_BINDING_LEN = 256;
-/** Placeholder stored in place of a binding that looks like a credential. */
-const REDACTED_BINDING = '[redacted]';
-/**
- * Redact and truncate SQL bindings before persistence.
- *
- * Two independent rules, because neither catches everything on its own:
- *
- * 1. **By statement.** If the SQL mentions a credential-shaped identifier
- *    (`password`, `remember_token`, `otp`, ...), every binding for that
- *    statement is redacted. Positional bindings cannot be mapped back to
- *    columns reliably, so this is all-or-nothing per statement — coarse, but
- *    it is the only thing that catches a short secret like a 6-digit OTP.
- * 2. **By value shape.** Hashes, JWTs, provider key prefixes, long hex
- *    digests, and URLs with embedded credentials are redacted wherever they
- *    appear, regardless of the statement.
- *
- * Anything that survives both is truncated at {@link MAX_BINDING_LEN} so an
- * oversized payload cannot bloat the row.
- *
- * Ordinary parameters — ids, flags, emails, timestamps — still pass through, so
- * the query pane stays useful for debugging.
- */
-export function sanitizeBindings(bindings, sqlText) {
-    const redactAll = sqlText !== undefined && sqlMentionsSecret(sqlText);
-    return sanitizeBindingValue(bindings, redactAll);
-}
-function sanitizeBindingValue(value, redactAll) {
-    if (Array.isArray(value))
-        return value.map((v) => sanitizeBindingValue(v, redactAll));
-    if (value !== null && typeof value === 'object')
-        return sanitizeNamedBindings(value, redactAll);
-    if (typeof value === 'string')
-        return sanitizeStringBinding(value, redactAll);
-    // A statement touching a secret column may bind it as a non-string — a numeric
-    // OTP, for instance — so redact those too rather than only masking strings.
-    // Booleans and null carry nothing worth hiding.
-    const redactable = value !== null && value !== undefined && typeof value !== 'boolean';
-    return redactAll && redactable ? REDACTED_BINDING : value;
-}
-/** Named bindings carry their own key, so use it when it is telling. */
-function sanitizeNamedBindings(value, redactAll) {
-    const out = {};
-    for (const [key, nested] of Object.entries(value)) {
-        out[key] = sanitizeBindingValue(nested, redactAll || isSecretName(key));
-    }
-    return out;
-}
-function sanitizeStringBinding(value, redactAll) {
-    if (redactAll || looksLikeCredentialValue(value))
-        return REDACTED_BINDING;
-    if (value.length > MAX_BINDING_LEN) {
-        return value.slice(0, MAX_BINDING_LEN) + `…[truncated ${value.length} chars]`;
-    }
-    return value;
-}
+export { sanitizeBindings };
 // ---------------------------------------------------------------------------
 // Pure data-prep functions
 // ---------------------------------------------------------------------------
@@ -135,6 +90,13 @@ export function prepareRequestRows(requests) {
 }
 /**
  * Transform raw log entries into SQLite-ready row objects.
+ *
+ * The full pino record lands in `data`, and log lines routinely carry bound
+ * request context — authorization headers, cookies, tokens in payloads — so
+ * the record is run through the shared redaction rules (secret-named keys and
+ * credential-shaped values) before it is stringified. The `message` column is
+ * kept verbatim: it is free text, and the shape rules are anchored to whole
+ * values, so prose stays readable.
  */
 export function prepareLogRows(logs) {
     return logs.map((entry) => {
@@ -145,7 +107,7 @@ export function prepareLogRows(logs) {
             request_id: entry.request_id || entry.requestId || entry['x-request-id']
                 ? String(entry.request_id || entry.requestId || entry['x-request-id'])
                 : null,
-            data: JSON.stringify(entry),
+            data: JSON.stringify(sanitizeRecordValues(entry)),
         };
     });
 }
@@ -187,9 +149,16 @@ export function buildEventRows(events) {
 // ---------------------------------------------------------------------------
 /**
  * Insert rows into a table in batches of 50.
+ *
+ * Yields to the event loop between chunks: better-sqlite3 is fully
+ * synchronous, so without a real macrotask hop a large batch would execute
+ * back-to-back on microtask continuations and stall the host app — the exact
+ * failure mode `migrator_tables.ts` documents and guards against.
  */
 export async function batchInsert(trx, table, rows) {
     for (let i = 0; i < rows.length; i += 50) {
+        if (i > 0)
+            await yieldToEventLoop();
         await trx(table).insert(rows.slice(i, i + 50));
     }
 }
@@ -233,7 +202,15 @@ async function insertOneRequest(trx, prepared) {
     }
 }
 export async function flushRequests(trx, preparedRequests) {
+    let sinceYield = 0;
     for (const prepared of preparedRequests) {
+        // Up to ~4 synchronous statements per request; a full backlog is hundreds
+        // of them in one flush. Yield periodically so the host app's I/O keeps
+        // being serviced mid-flush (see batchInsert for why awaits alone don't).
+        if (++sinceYield >= 10) {
+            sinceYield = 0;
+            await yieldToEventLoop();
+        }
         try {
             await insertOneRequest(trx, prepared);
         }

package/dist/src/debug/query_collector.js

@@ -1,3 +1,4 @@
+import { sanitizeBindings } from '../dashboard/sensitive_patterns.js';
 import { isExcludedRequest } from '../middleware/request_tracking_middleware.js';
 import { round } from '../utils/math_helpers.js';
 import { RingBuffer } from './ring_buffer.js';
@@ -14,7 +15,11 @@ function buildQueryRecord(data, id) {
     return {
         id,
         sql: data.sql || '',
-        bindings: data.bindings || [],
+        // Sanitized at capture time so the in-memory debug panel never shows a
+        // credential the persisted dashboard would have redacted. The write path
+        // sanitizes again (idempotently) as defense in depth for records loaded
+        // from an older on-disk dump.
+        bindings: sanitizeBindings(data.bindings || [], data.sql || '') ?? [],
         duration: round(parseDuration(data.duration)),
         method: data.method || 'unknown',
         model: data.model || null,

package/dist/src/debug/trace_collector.js

@@ -7,11 +7,16 @@ import { RingBuffer } from './ring_buffer.js';
  */
 const globalRef = { current: null };
 /**
- * Tracks whether console.warn is currently patched by a TraceCollector, so a
- * second instance (or a skipped stop()) cannot double-wrap it and leak the
- * patch permanently.
+ * Tracks which TraceCollector currently owns the console.warn patch, so a
+ * second instance cannot double-wrap it and leak the patch permanently. The
+ * owner (not a boolean) matters: if a prior instance never ran stop(), its
+ * wrapper checks the *old* AsyncLocalStorage and silently stops attaching
+ * warnings to traces — a newcomer must be able to detect that and take over.
  */
-const consoleWarnPatch = { active: false };
+const consoleWarnPatch = {
+    owner: null,
+    original: null,
+};
 /**
  * Wrap an async function in a traced span.
  *
@@ -157,12 +162,18 @@ export class TraceCollector {
             };
             emitter.on('db:query', this.dbHandler);
         }
-        // Intercept console.warn to capture warnings per-request. Guard against
-        // double-wrapping: if another instance (or a prior start() without a
-        // matching stop()) already patched console.warn, don't wrap it again —
-        // that would capture the patched fn as the "original" and leak the patch.
-        if (!consoleWarnPatch.active) {
-            consoleWarnPatch.active = true;
+        // Intercept console.warn to capture warnings per-request. If a prior
+        // instance still owns the patch (its stop() was skipped), restore its
+        // original first and take over — deferring to the stale owner would leave
+        // a wrapper bound to a dead AsyncLocalStorage, silently detaching
+        // warnings from every trace. Never wrap the wrapper: the restore below
+        // guarantees `console.warn` is the real one before we capture it.
+        if (consoleWarnPatch.owner !== this) {
+            if (consoleWarnPatch.owner && consoleWarnPatch.original) {
+                console.warn = consoleWarnPatch.original;
+            }
+            consoleWarnPatch.owner = this;
+            consoleWarnPatch.original = console.warn;
             this.originalConsoleWarn = console.warn;
             console.warn = (...args) => {
                 const ctx = this.als.getStore();
@@ -178,10 +189,12 @@ export class TraceCollector {
         if (this.emitter && this.dbHandler) {
             this.emitter.off('db:query', this.dbHandler);
         }
-        // Only restore console.warn if this instance was the one that patched it.
-        if (this.originalConsoleWarn) {
+        // Only restore console.warn if this instance still owns the patch — a
+        // newer instance may have taken over, and restoring would clobber it.
+        if (consoleWarnPatch.owner === this && this.originalConsoleWarn) {
             console.warn = this.originalConsoleWarn;
-            consoleWarnPatch.active = false;
+            consoleWarnPatch.owner = null;
+            consoleWarnPatch.original = null;
         }
         this.dbHandler = null;
         this.emitter = null;

package/dist/src/debug/types.d.ts

@@ -284,6 +284,8 @@ export interface DevToolbarConfig {
     dashboardPath: string;
     /** Data retention period in days for historical persistence. */
     retentionDays: number;
+    /** Size cap in MB for the SQLite database's live data; `0` disables it. */
+    maxDbSizeMb: number;
     /** Path to the SQLite database file for historical persistence. */
     dbPath: string;
     /** Base path for the debug toolbar API endpoints. */

package/dist/src/define_config.js

@@ -33,6 +33,8 @@ function applyDashboardConfig(dashboard, result) {
             result.dashboardPath = dashboard.path;
         if (dashboard.retentionDays !== undefined)
             result.retentionDays = dashboard.retentionDays;
+        if (dashboard.maxDbSizeMb !== undefined)
+            result.maxDbSizeMb = dashboard.maxDbSizeMb;
     }
 }
 /** Advanced config field mappings. */