apitally 0.15.3 → 0.16.1

package/dist/hono/middleware.cjs

@@ -436,6 +436,16 @@ var MASK_HEADER_PATTERNS = [
   /token/i,
   /cookie/i
 ];
+var MASK_BODY_FIELD_PATTERNS = [
+  /password/i,
+  /pwd/i,
+  /token/i,
+  /secret/i,
+  /auth/i,
+  /card[-_ ]?number/i,
+  /ccv/i,
+  /ssn/i
+];
 var DEFAULT_CONFIG = {
   enabled: false,
   logQueryParams: true,
@@ -446,6 +456,7 @@ var DEFAULT_CONFIG = {
   logException: true,
   maskQueryParams: [],
   maskHeaders: [],
+  maskBodyFields: [],
   excludePaths: []
 };
 var _RequestLogger = class _RequestLogger {
@@ -496,11 +507,23 @@ var _RequestLogger = class _RequestLogger {
     ];
     return matchPatterns(name, patterns);
   }
+  shouldMaskBodyField(name) {
+    const patterns = [
+      ...this.config.maskBodyFields,
+      ...MASK_BODY_FIELD_PATTERNS
+    ];
+    return matchPatterns(name, patterns);
+  }
   hasSupportedContentType(headers) {
     var _a2;
     const contentType = (_a2 = headers.find(([k]) => k.toLowerCase() === "content-type")) == null ? void 0 : _a2[1];
     return this.isSupportedContentType(contentType);
   }
+  hasJsonContentType(headers) {
+    var _a2;
+    const contentType = (_a2 = headers.find(([k]) => k.toLowerCase() === "content-type")) == null ? void 0 : _a2[1];
+    return contentType ? /\bjson\b/i.test(contentType) : null;
+  }
   isSupportedContentType(contentType) {
     return typeof contentType === "string" && ALLOWED_CONTENT_TYPES.some((t) => contentType.startsWith(t));
   }
@@ -519,6 +542,72 @@ var _RequestLogger = class _RequestLogger {
       this.shouldMaskHeader(k) ? MASKED : v
     ]);
   }
+  maskBody(data) {
+    if (typeof data === "object" && data !== null && !Array.isArray(data)) {
+      const result = {};
+      for (const [key, value] of Object.entries(data)) {
+        if (typeof value === "string" && this.shouldMaskBodyField(key)) {
+          result[key] = MASKED;
+        } else {
+          result[key] = this.maskBody(value);
+        }
+      }
+      return result;
+    }
+    if (Array.isArray(data)) {
+      return data.map((item) => this.maskBody(item));
+    }
+    return data;
+  }
+  applyMasking(item) {
+    if (this.config.maskRequestBodyCallback && item.request.body && item.request.body !== BODY_TOO_LARGE) {
+      try {
+        const maskedBody = this.config.maskRequestBodyCallback(item.request);
+        item.request.body = maskedBody ?? BODY_MASKED;
+      } catch {
+        item.request.body = void 0;
+      }
+    }
+    if (this.config.maskResponseBodyCallback && item.response.body && item.response.body !== BODY_TOO_LARGE) {
+      try {
+        const maskedBody = this.config.maskResponseBodyCallback(item.request, item.response);
+        item.response.body = maskedBody ?? BODY_MASKED;
+      } catch {
+        item.response.body = void 0;
+      }
+    }
+    if (item.request.body && item.request.body.length > MAX_BODY_SIZE) {
+      item.request.body = BODY_TOO_LARGE;
+    }
+    if (item.response.body && item.response.body.length > MAX_BODY_SIZE) {
+      item.response.body = BODY_TOO_LARGE;
+    }
+    for (const key of [
+      "request",
+      "response"
+    ]) {
+      const bodyData = item[key].body;
+      if (!bodyData || bodyData === BODY_TOO_LARGE || bodyData === BODY_MASKED) {
+        continue;
+      }
+      const headers = item[key].headers;
+      const hasJsonContent = this.hasJsonContentType(headers);
+      if (hasJsonContent === null || hasJsonContent) {
+        try {
+          const parsedBody = JSON.parse(bodyData.toString());
+          const maskedBody = this.maskBody(parsedBody);
+          item[key].body = import_buffer2.Buffer.from(JSON.stringify(maskedBody));
+        } catch {
+        }
+      }
+    }
+    item.request.headers = this.config.logRequestHeaders ? this.maskHeaders(item.request.headers) : [];
+    item.response.headers = this.config.logResponseHeaders ? this.maskHeaders(item.response.headers) : [];
+    const url = new URL(item.request.url);
+    url.search = this.config.logQueryParams ? this.maskQueryParams(url.search) : "";
+    item.request.url = url.toString();
+    return item;
+  }
   logRequest(request, response, error) {
     var _a2, _b, _c;
     if (!this.enabled || this.suspendUntil !== null) return;
@@ -528,64 +617,30 @@ var _RequestLogger = class _RequestLogger {
     if (this.shouldExcludePath(path) || this.shouldExcludeUserAgent(userAgent) || (((_c = (_b = this.config).excludeCallback) == null ? void 0 : _c.call(_b, request, response)) ?? false)) {
       return;
     }
-    url.search = this.config.logQueryParams ? this.maskQueryParams(url.search) : "";
-    request.url = url.toString();
     if (!this.config.logRequestBody || !this.hasSupportedContentType(request.headers)) {
       request.body = void 0;
-    } else if (request.body) {
-      if (request.body.length > MAX_BODY_SIZE) {
-        request.body = BODY_TOO_LARGE;
-      } else if (this.config.maskRequestBodyCallback) {
-        try {
-          request.body = this.config.maskRequestBodyCallback(request) ?? BODY_MASKED;
-          if (request.body.length > MAX_BODY_SIZE) {
-            request.body = BODY_TOO_LARGE;
-          }
-        } catch {
-          request.body = void 0;
-        }
-      }
     }
     if (!this.config.logResponseBody || !this.hasSupportedContentType(response.headers)) {
       response.body = void 0;
-    } else if (response.body) {
-      if (response.body.length > MAX_BODY_SIZE) {
-        response.body = BODY_TOO_LARGE;
-      } else if (this.config.maskResponseBodyCallback) {
-        try {
-          response.body = this.config.maskResponseBodyCallback(request, response) ?? BODY_MASKED;
-          if (response.body.length > MAX_BODY_SIZE) {
-            response.body = BODY_TOO_LARGE;
-          }
-        } catch {
-          response.body = void 0;
-        }
-      }
     }
-    request.headers = this.config.logRequestHeaders ? this.maskHeaders(request.headers) : [];
-    response.headers = this.config.logResponseHeaders ? this.maskHeaders(response.headers) : [];
+    if (request.size !== void 0 && request.size < 0) {
+      request.size = void 0;
+    }
+    if (response.size !== void 0 && response.size < 0) {
+      response.size = void 0;
+    }
     const item = {
       uuid: (0, import_crypto3.randomUUID)(),
-      request: skipEmptyValues(request),
-      response: skipEmptyValues(response),
+      request,
+      response,
       exception: error && this.config.logException ? {
         type: error.name,
         message: truncateExceptionMessage(error.message),
         stacktrace: truncateExceptionStackTrace(error.stack || ""),
         sentryEventId: getSentryEventId()
-      } : null
+      } : void 0
     };
-    [
-      item.request.body,
-      item.response.body
-    ].forEach((body) => {
-      if (body) {
-        body.toJSON = function() {
-          return this.toString("base64");
-        };
-      }
-    });
-    this.pendingWrites.push(JSON.stringify(item));
+    this.pendingWrites.push(item);
     if (this.pendingWrites.length > MAX_PENDING_WRITES) {
       this.pendingWrites.shift();
     }
@@ -599,9 +654,26 @@ var _RequestLogger = class _RequestLogger {
         this.currentFile = new TempGzipFile();
       }
       while (this.pendingWrites.length > 0) {
-        const item = this.pendingWrites.shift();
+        let item = this.pendingWrites.shift();
         if (item) {
-          await this.currentFile.writeLine(import_buffer2.Buffer.from(item));
+          item = this.applyMasking(item);
+          const finalItem = {
+            uuid: item.uuid,
+            request: skipEmptyValues(item.request),
+            response: skipEmptyValues(item.response),
+            exception: item.exception
+          };
+          [
+            finalItem.request.body,
+            finalItem.response.body
+          ].forEach((body) => {
+            if (body) {
+              body.toJSON = function() {
+                return this.toString("base64");
+              };
+            }
+          });
+          await this.currentFile.writeLine(import_buffer2.Buffer.from(JSON.stringify(finalItem)));
         }
       }
     });