chainlesschain 0.166.89 → 0.166.91

package/src/lib/audit-logger.js

@@ -6,6 +6,18 @@
 import crypto from "crypto";
 import { safeJsonParse } from "./safe-json.js";
 import { escapeLike } from "./sql-like.js";
+import { sanitizeAuditDetails } from "./audit-sanitizer.js";
+import auditDataPolicy from "@chainlesschain/session-core/audit-data-policy";
+import restrictedAudit from "@chainlesschain/session-core/restricted-audit-store";
+
+const { projectAuditMetadata, projectAuditField, validateRetentionDays } =
+  auditDataPolicy;
+
+// Host API: authorization must come from the invoking host, never event details.
+// No general audit query/export includes this separate store.
+export function createAuditDiagnostics(db, options) {
+  return new restrictedAudit.RestrictedAuditStore(db, options);
+}
 
 /**
  * Event types for audit logging.
@@ -112,29 +124,15 @@ export function assessRisk(eventType, operation, details) {
  * Sanitize sensitive data from log details.
  */
 export function sanitizeDetails(details) {
-  if (!details || typeof details !== "object") return details;
-
-  const sanitized = { ...details };
-  const sensitiveKeys = [
-    "password",
-    "secret",
-    "secretKey",
-    "secret_key",
-    "privateKey",
-    "private_key",
-    "token",
-    "apiKey",
-    "api_key",
-    "mnemonic",
-  ];
-
-  for (const key of sensitiveKeys) {
-    if (sanitized[key]) {
-      sanitized[key] = "[REDACTED]";
-    }
-  }
+  return sanitizeAuditDetails(details);
+}
 
-  return sanitized;
+function sanitizeErrorMessage(value) {
+  const sanitized = projectAuditMetadata(value);
+  if (sanitized == null) return null;
+  return typeof sanitized === "object"
+    ? JSON.stringify(sanitized)
+    : String(sanitized);
 }
 
 /**
@@ -144,26 +142,26 @@ export function logEvent(db, event) {
   ensureAuditTables(db);
 
   const id = crypto.randomUUID();
-  const sanitized = sanitizeDetails(event.details);
-  const risk =
-    event.riskLevel ||
-    assessRisk(event.eventType, event.operation, event.details);
+  const sanitized = projectAuditMetadata(event.details);
+  const risk = Object.values(RISK_LEVELS).includes(event.riskLevel)
+    ? event.riskLevel
+    : assessRisk(event.eventType, event.operation || "unknown", sanitized);
 
   db.prepare(
     `INSERT INTO audit_log (id, event_type, operation, actor, target, details, risk_level, ip_address, user_agent, success, error_message)
      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
   ).run(
     id,
-    event.eventType || EVENT_TYPES.SYSTEM,
-    event.operation || "unknown",
-    event.actor || null,
-    event.target || null,
-    sanitized ? JSON.stringify(sanitized) : null,
+    projectAuditField("eventType", event.eventType || EVENT_TYPES.SYSTEM),
+    projectAuditField("operation", event.operation || "unknown"),
+    projectAuditField("actor", event.actor || null),
+    projectAuditField("target", event.target || null),
+    sanitized == null ? null : JSON.stringify(sanitized),
     risk,
-    event.ipAddress || null,
-    event.userAgent || null,
+    event.ipAddress ? projectAuditField("ipAddress", event.ipAddress) : null,
+    event.userAgent ? projectAuditField("userAgent", event.userAgent) : null,
     event.success !== false ? 1 : 0,
-    event.errorMessage || null,
+    sanitizeErrorMessage(event.errorMessage),
   );
 
   return { id, riskLevel: risk, createdAt: new Date().toISOString() };
@@ -234,8 +232,21 @@ export function queryLogs(db, filters = {}) {
   const rows = db.prepare(sql).all(...params);
   return rows.map((r) => ({
     ...r,
+    event_type: projectAuditField("eventType", r.event_type),
+    operation: projectAuditField("operation", r.operation),
     // One corrupt details cell must not throw out of the whole query.
-    details: safeJsonParse(r.details, null),
+    details: projectAuditMetadata(safeJsonParse(r.details, null)),
+    error_message: sanitizeErrorMessage(
+      safeJsonParse(r.error_message, r.error_message),
+    ),
+    actor: projectAuditField("actor", r.actor),
+    target: projectAuditField("target", r.target),
+    ip_address: r.ip_address
+      ? projectAuditField("ipAddress", r.ip_address)
+      : null,
+    user_agent: r.user_agent
+      ? projectAuditField("userAgent", r.user_agent)
+      : null,
     success: r.success === 1,
   }));
 }
@@ -347,6 +358,7 @@ export function exportLogs(db, format = "json", filters = {}) {
  * Delete old audit logs.
  */
 export function purgeLogs(db, daysToKeep = 90) {
+  validateRetentionDays(daysToKeep);
   ensureAuditTables(db);
 
   const cutoff = new Date();
@@ -516,23 +528,24 @@ export function logEventV2(
   if (_logStatesV2.has(logId)) {
     throw new Error(`Log already registered: ${logId}`);
   }
-  const risk = riskLevel || assessRisk(eventType, operation, details);
+  const sanitized = projectAuditMetadata(details);
+  const risk = riskLevel || assessRisk(eventType, operation, sanitized);
   if (!RISK_LEVELS_V2.includes(risk)) {
     throw new Error(`Invalid riskLevel: ${risk}`);
   }
   const now = Date.now();
   const entry = {
     logId,
-    eventType,
-    operation,
-    actor: actor || null,
-    target: target || null,
-    details: sanitizeDetails(details) || null,
+    eventType: projectAuditField("eventType", eventType),
+    operation: projectAuditField("operation", operation),
+    actor: projectAuditField("actor", actor || null),
+    target: projectAuditField("target", target || null),
+    details: sanitized ?? null,
     riskLevel: risk,
-    ipAddress: ipAddress || null,
-    userAgent: userAgent || null,
+    ipAddress: ipAddress ? projectAuditField("ipAddress", ipAddress) : null,
+    userAgent: userAgent ? projectAuditField("userAgent", userAgent) : null,
     success: success !== false,
-    errorMessage: errorMessage || null,
+    errorMessage: sanitizeErrorMessage(errorMessage),
     status: LOG_STATUS_V2.ACTIVE,
     integrityStatus: INTEGRITY_STATUS_V2.UNVERIFIED,
     prevHash: _lastChainHash,
@@ -552,8 +565,8 @@ export function logEventV2(
       _alertStatesV2.set(alertId, {
         alertId,
         logId,
-        actor,
-        operation,
+        actor: entry.actor,
+        operation: entry.operation,
         riskLevel: risk,
         status: ALERT_STATUS_V2.OPEN,
         reason: null,

package/src/lib/audit-sanitizer.js

@@ -0,0 +1,279 @@
+/**
+ * JSON-safe audit details. Limits apply before string processing and while
+ * traversing; getters and user-provided toJSON methods are never invoked.
+ * This is field/credential redaction, not detection of arbitrary secrets in prose.
+ */
+const REDACTED = "[REDACTED]";
+const TRUNCATED = "[Truncated]";
+const LIMITS = Object.freeze({
+  depth: 8,
+  entries: 100,
+  nodes: 512,
+  stringLength: 4096,
+  keyLength: 256,
+  totalCharacters: 16384,
+  serializedBytes: 65536,
+});
+
+const SENSITIVE_KEYS = new Set([
+  "password",
+  "passwd",
+  "pwd",
+  "passphrase",
+  "secret",
+  "secretkey",
+  "privatekey",
+  "apikey",
+  "token",
+  "authorization",
+  "proxyauthorization",
+  "cookie",
+  "setcookie",
+  "mnemonic",
+  "seedphrase",
+  "credentials",
+  "credential",
+  "encryptionkey",
+  "signingkey",
+  "sessionid",
+  "auth",
+]);
+
+function normalizeKey(key) {
+  return key.toLowerCase().replace(/[\s_.-]/g, "");
+}
+
+function isSensitiveKey(key) {
+  const normalized = normalizeKey(key);
+  return (
+    SENSITIVE_KEYS.has(normalized) ||
+    /(?:password|secret|privatekey|apikey|token)$/.test(normalized)
+  );
+}
+
+function isSensitiveQueryKey(key) {
+  return isSensitiveKey(key) || /^(?:key|code|sig|signature)$/i.test(key);
+}
+
+function sanitizeUrl(text) {
+  try {
+    const url = new URL(text);
+    if (url.username || url.password) {
+      url.username = REDACTED;
+      url.password = "";
+    }
+    const params = new URLSearchParams();
+    for (const [key, value] of url.searchParams) {
+      params.append(key, isSensitiveQueryKey(key) ? REDACTED : value);
+    }
+    url.search = params.toString();
+    // OAuth implicit responses put credentials in the fragment instead of query.
+    if (url.hash.includes("=")) {
+      const fragment = new URLSearchParams(url.hash.slice(1));
+      const sanitized = new URLSearchParams();
+      for (const [key, value] of fragment) {
+        sanitized.append(key, isSensitiveQueryKey(key) ? REDACTED : value);
+      }
+      url.hash = sanitized.toString();
+    }
+    return url.toString();
+  } catch {
+    return "[REDACTED URL]";
+  }
+}
+
+function sanitizeString(value) {
+  // Drop oversized strings whole: slicing can expose half of a credential.
+  if (value.length > LIMITS.stringLength) return TRUNCATED;
+  return value
+    .replace(/\b[a-z][a-z0-9+.-]*:\/\/[^\s<>"'`]+/gi, sanitizeUrl)
+    .replace(/\b(?:Bearer|Basic)\s+[a-z0-9._~+/=-]+/gi, REDACTED)
+    .replace(
+      /\b((?:proxy[-_ ]?)?authorization|(?:set[-_ ]?)?cookie)\s*:\s*[^\r\n]+/gi,
+      "$1: [REDACTED]",
+    )
+    .replace(
+      /\b((?:[a-z0-9_.-]{0,64})?(?:password|secret|private[-_.]?key|api[-_.]?key|token)|passwd|pwd|passphrase|mnemonic|seed[-_.]?phrase|credentials?|encryption[-_.]?key|signing[-_.]?key|session[-_.]?id|auth|(?:proxy[-_.]?)?authorization|(?:set[-_.]?)?cookie)(["']?\s*[=:]\s*)("(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*'|[^\s&,;"']+)/gi,
+      (_match, key, separator, value) => {
+        const quote = value[0] === '"' || value[0] === "'" ? value[0] : "";
+        return `${key}${separator}${quote}${REDACTED}${quote}`;
+      },
+    );
+}
+
+function readDataProperty(value, key) {
+  const descriptor = Object.getOwnPropertyDescriptor(value, key);
+  return descriptor && "value" in descriptor
+    ? descriptor.value
+    : "[Accessor omitted]";
+}
+
+function errorName(value) {
+  let prototype = value;
+  for (let i = 0; prototype && i < LIMITS.depth; i += 1) {
+    if (Object.hasOwn(prototype, "name")) {
+      const name = readDataProperty(prototype, "name");
+      return typeof name === "string" ? name : "Error";
+    }
+    prototype = Object.getPrototypeOf(prototype);
+  }
+  return "Error";
+}
+
+function setDataProperty(target, key, value) {
+  // Defining __proto__ as data cannot mutate the output object's prototype.
+  Object.defineProperty(target, key, {
+    value,
+    enumerable: true,
+    configurable: true,
+    writable: true,
+  });
+}
+
+export function sanitizeAuditDetails(details) {
+  const ancestors = new WeakSet();
+  let remainingNodes = LIMITS.nodes;
+  let remainingCharacters = LIMITS.totalCharacters;
+
+  function text(value) {
+    const sanitized = sanitizeString(value);
+    if (sanitized.length > remainingCharacters) return TRUNCATED;
+    remainingCharacters -= sanitized.length;
+    return sanitized;
+  }
+
+  function visit(value, depth = 0, context = "") {
+    if (remainingNodes-- <= 0) return TRUNCATED;
+    if (value === null || value === undefined) return value;
+    if (typeof value === "string") return text(value);
+    if (typeof value === "bigint") return text(value.toString());
+    if (typeof value === "number") return Number.isFinite(value) ? value : null;
+    if (typeof value === "boolean") return value;
+    if (typeof value === "function") return "[Function omitted]";
+    if (typeof value === "symbol") return "[Symbol omitted]";
+    if (depth >= LIMITS.depth) return TRUNCATED;
+    if (ancestors.has(value)) return "[Circular Reference]";
+    ancestors.add(value);
+    try {
+      if (value instanceof Date) {
+        return text(Date.prototype.toISOString.call(value));
+      }
+      if (value instanceof URL) {
+        return text(URL.prototype.toString.call(value));
+      }
+      if (ArrayBuffer.isView(value) || value instanceof ArrayBuffer) {
+        return "[Binary omitted]";
+      }
+
+      // Native fetch headers and query objects have no useful enumerable fields.
+      if (value instanceof Headers || value instanceof URLSearchParams) {
+        const result = {};
+        const iterator =
+          value instanceof Headers
+            ? Headers.prototype.entries.call(value)
+            : URLSearchParams.prototype.entries.call(value);
+        let count = 0;
+        for (const [key, item] of iterator) {
+          if (count++ >= LIMITS.entries || remainingNodes <= 0) {
+            setDataProperty(result, "[Truncated]", true);
+            break;
+          }
+          if (key.length > LIMITS.keyLength) continue;
+          setDataProperty(
+            result,
+            text(key),
+            isSensitiveQueryKey(key) ? REDACTED : visit(item, depth + 1),
+          );
+        }
+        return result;
+      }
+
+      if (Array.isArray(value)) {
+        const result = [];
+        const isHeaderList = normalizeKey(context).endsWith("headers");
+        // Header tuple arrays are commonly returned by fetch/HTTP clients.
+        const first = readDataProperty(value, "0");
+        const isSensitivePair =
+          value.length === 2 &&
+          typeof first === "string" &&
+          isSensitiveKey(first);
+        for (let i = 0; i < value.length; i += 1) {
+          if (i >= LIMITS.entries || remainingNodes <= 0) {
+            result.push(TRUNCATED);
+            break;
+          }
+          const previous =
+            i % 2 === 1 && isHeaderList
+              ? readDataProperty(value, String(i - 1))
+              : null;
+          const redact =
+            (isSensitivePair && i === 1) ||
+            (typeof previous === "string" && isSensitiveKey(previous));
+          result.push(
+            redact
+              ? REDACTED
+              : visit(readDataProperty(value, String(i)), depth + 1, context),
+          );
+        }
+        return result;
+      }
+
+      const result = {};
+      if (value instanceof Error) {
+        setDataProperty(result, "name", text(errorName(value)));
+        // message/stack/cause are usually non-enumerable. Do not call getters.
+        for (const key of ["name", "message", "stack", "cause"]) {
+          if (Object.hasOwn(value, key)) {
+            setDataProperty(
+              result,
+              key,
+              visit(readDataProperty(value, key), depth + 1),
+            );
+          }
+        }
+      }
+      let count = 0;
+      const headerName = normalizeKey(context).endsWith("headers")
+        ? readDataProperty(value, "name")
+        : null;
+      for (const key in value) {
+        if (
+          count++ >= LIMITS.entries ||
+          remainingNodes <= 0 ||
+          remainingCharacters <= 0
+        ) {
+          setDataProperty(result, "[Truncated]", true);
+          break;
+        }
+        if (!Object.hasOwn(value, key)) continue;
+        if (key.length > LIMITS.keyLength) {
+          setDataProperty(result, "[Truncated key]", true);
+          continue;
+        }
+        setDataProperty(
+          result,
+          text(key),
+          isSensitiveKey(key) ||
+            (key === "value" &&
+              typeof headerName === "string" &&
+              isSensitiveKey(headerName))
+            ? REDACTED
+            : visit(readDataProperty(value, key), depth + 1, key),
+        );
+      }
+      return result;
+    } catch {
+      // Proxies, invalid native objects, etc. must not break event persistence.
+      return "[Unserializable]";
+    } finally {
+      ancestors.delete(value);
+    }
+  }
+
+  const sanitized = visit(details);
+  const serialized = JSON.stringify(sanitized);
+  return serialized &&
+    Buffer.byteLength(serialized, "utf8") > LIMITS.serializedBytes
+    ? TRUNCATED
+    : sanitized;
+}

package/src/lib/automation-center.js

@@ -18,6 +18,7 @@ import {
   buildAutomationCenterRuntimeProjection,
 } from "./automation-center-runtime.js";
 import {
+  AUTOMATION_EXECUTION_CAPABILITY,
   EXECUTION_STATUS,
   FLOW_STATUS,
   TRIGGER_TYPE,
@@ -117,6 +118,7 @@ function projectExecution(execution) {
   return {
     id: execution.id,
     status: execution.status,
+    mode: execution.mode,
     triggerType: execution.triggerType || null,
     durationMs: Number(execution.durationMs) || 0,
     startedAt: execution.startedAt || null,
@@ -213,6 +215,7 @@ function projectFlow(db, flow, { historyLimit, now }) {
     history,
     incidents,
     security,
+    executionCapability: AUTOMATION_EXECUTION_CAPABILITY,
   };
   const revision = digest(content);
   const active = flow.status === FLOW_STATUS.ACTIVE;
@@ -225,21 +228,28 @@ function projectFlow(db, flow, { historyLimit, now }) {
     actions: [
       action(
         "run_now",
-        active && security.ready,
+        active && security.ready && AUTOMATION_EXECUTION_CAPABILITY.live,
         !active
           ? "flow is not active"
-          : "permission or budget preflight denied",
+          : !security.ready
+            ? "permission or budget preflight denied"
+            : AUTOMATION_EXECUTION_CAPABILITY.reason,
         flow.id,
         revision,
       ),
       action(
         "retry_failed",
-        active && latestFailed && security.ready,
+        active &&
+          latestFailed &&
+          security.ready &&
+          AUTOMATION_EXECUTION_CAPABILITY.live,
         !active
           ? "flow is not active"
           : !latestFailed
             ? "latest run did not fail"
-            : "permission or budget preflight denied",
+            : !security.ready
+              ? "permission or budget preflight denied"
+              : AUTOMATION_EXECUTION_CAPABILITY.reason,
         flow.id,
         revision,
       ),