logixia 2.0.6 → 2.0.8

package/dist/nest.js

@@ -1,8 +1,9 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_secret_config = require("./secret-config-CmK2wVkr.js");
-const require_builder = require("./builder-yFvJrz7o.js");
+const require_secret_config = require("./secret-config-BvFl2dC8.js");
+const require_builder = require("./builder-BTzvPGHN.js");
+const require_sensitive_names = require("./sensitive-names-CHMowujD.js");
 const require_request_trace = require("./request-trace-ByujsUZk.js");
-const require_internal_log = require("./internal-log-By4Govmu.js");
+const require_internal_log = require("./internal-log-DwqTjhpb.js");
 const require_coerce_utils = require("./coerce.utils-C1C5sIX0.js");
 let _nestjs_common = require("@nestjs/common");
 let rxjs = require("rxjs");
@@ -303,10 +304,18 @@ function writeTraceHeader(res, header, traceId) {
 		else if (typeof r.header === "function") r.header(header, traceId);
 	} catch {}
 }
+/** Injection token for extra query parameter names redacted in the trace context `url`. */
+const LOGIXIA_TRACE_REDACT_QUERY_PARAMS = "LOGIXIA_TRACE_REDACT_QUERY_PARAMS";
+/** The request URL as stored in the trace context: `originalUrl`, sensitive query values redacted. */
+function traceUrl(req, names) {
+	const raw = req.originalUrl ?? req.url;
+	return raw === void 0 ? void 0 : require_sensitive_names.redactUrlQuery(raw, names);
+}
 let TraceMiddleware = class TraceMiddleware {
-	constructor(config) {
+	constructor(config, redactQueryParams) {
 		this.config = config;
 		this.ctx = require_request_trace.TraceContext.instance;
+		this.redactParams = require_sensitive_names.buildNameSet(require_sensitive_names.DEFAULT_REDACT_QUERY_PARAMS, redactQueryParams);
 		const defaultExtractor = {
 			header: require_request_trace.DEFAULT_TRACE_HEADERS,
 			query: ["traceId", "trace_id"]
@@ -339,7 +348,7 @@ let TraceMiddleware = class TraceMiddleware {
 		if (header) writeTraceHeader(res, header, traceId);
 		this.ctx.run(traceId, () => next(), {
 			method: req.method,
-			url: req.url,
+			url: traceUrl(req, this.redactParams),
 			userAgent: req.get("User-Agent"),
 			ip: req.ip || ((_req$socket = req.socket) === null || _req$socket === void 0 ? void 0 : _req$socket.remoteAddress) || ((_req$connection = req.connection) === null || _req$connection === void 0 ? void 0 : _req$connection.remoteAddress)
 		});
@@ -348,7 +357,9 @@ let TraceMiddleware = class TraceMiddleware {
 TraceMiddleware = __decorate([
 	(0, _nestjs_common.Injectable)(),
 	__decorateParam(0, (0, _nestjs_common.Optional)()),
-	__decorateMetadata("design:paramtypes", [Object])
+	__decorateParam(1, (0, _nestjs_common.Optional)()),
+	__decorateParam(1, (0, _nestjs_common.Inject)(LOGIXIA_TRACE_REDACT_QUERY_PARAMS)),
+	__decorateMetadata("design:paramtypes", [Object, Array])
 ], TraceMiddleware);
 // src/core/websocket-trace.interceptor.ts
 let WebSocketTraceInterceptor = class WebSocketTraceInterceptor {
@@ -470,6 +481,7 @@ let LogixiaLoggerModule = class LogixiaLoggerModule {
 		return _LogixiaLoggerModule._globalLogger;
 	}
 	configure(consumer) {
+		var _LogixiaLoggerModule$;
 		const { forRoutes = DEFAULT_ROUTES, exclude } = this.config;
 		let resolvedTraceConfig;
 		if (typeof _LogixiaLoggerModule.loggerConfig.traceId === "object") resolvedTraceConfig = _LogixiaLoggerModule.loggerConfig.traceId;
@@ -478,7 +490,7 @@ let LogixiaLoggerModule = class LogixiaLoggerModule {
 			contextKey: "traceId",
 			generator: () => require_request_trace.TraceContext.instance.generate()
 		};
-		const middleware = new TraceMiddleware(resolvedTraceConfig);
+		const middleware = new TraceMiddleware(resolvedTraceConfig, (_LogixiaLoggerModule$ = _LogixiaLoggerModule.loggerConfig.redact) === null || _LogixiaLoggerModule$ === void 0 ? void 0 : _LogixiaLoggerModule$.queryParams);
 		const middlewareConfig = (req, res, next) => middleware.use(req, res, next);
 		if (exclude) consumer.apply(middlewareConfig).exclude(...exclude).forRoutes(...forRoutes);
 		else consumer.apply(middlewareConfig).forRoutes(...forRoutes);
@@ -765,9 +777,86 @@ function LogMethod(options = {}) {
 }
 /** Injection token for {@link LogixiaExceptionFilterOptions}. */
 const LOGIXIA_EXCEPTION_FILTER_OPTIONS = "LOGIXIA_EXCEPTION_FILTER_OPTIONS";
+const MAX_SCRUB_DEPTH = 8;
+/** Copy `value` with every string passed through `clean`; the input is never modified. */
+function cleanDeep(value, clean, depth = 0) {
+	if (typeof value === "string") return clean(value);
+	if (value === null || typeof value !== "object" || depth >= MAX_SCRUB_DEPTH) return value;
+	if (Array.isArray(value)) return value.map((item) => cleanDeep(item, clean, depth + 1));
+	const out = {};
+	for (const [key, item] of Object.entries(value)) out[key] = cleanDeep(item, clean, depth + 1);
+	return out;
+}
+function scrubErrorResponse(response, clean) {
+	const { error, debug } = response;
+	return {
+		...response,
+		error: cleanDeep(error, clean),
+		...debug !== void 0 ? { debug: cleanDeep(debug, clean) } : {}
+	};
+}
+const MAX_ERROR_DEPTH = 6;
+/** Scrub string VALUES of an already serialized tree; keys stay so key-based redaction still applies. */
+function scrubSerialized(value, clean, depth, seen) {
+	if (typeof value === "string") return clean(value);
+	if (value === null || typeof value !== "object") return typeof value === "function" || typeof value === "symbol" ? "[Unserializable]" : value;
+	if (seen.has(value)) return "[Circular]";
+	if (depth >= MAX_ERROR_DEPTH) return "[MaxDepth]";
+	seen.add(value);
+	try {
+		if (Array.isArray(value)) return value.map((item) => scrubSerialized(item, clean, depth + 1, seen));
+		const out = {};
+		for (const [key, item] of Object.entries(value)) require_sensitive_names.assignOwn(out, key, scrubSerialized(item, clean, depth + 1, seen));
+		return out;
+	} finally {
+		seen.delete(value);
+	}
+}
+/** Minimal copy used when the full sanitize step fails; never throws. */
+function fallbackError(exception, clean) {
+	let name = "Error";
+	let message = "[Unserializable]";
+	try {
+		if (exception instanceof Error) {
+			name = exception.name;
+			message = clean(exception.message);
+		}
+	} catch {}
+	const copy = new Error(message);
+	copy.name = name;
+	require_sensitive_names.assignOwn(copy, "serialization", "[Unserializable]");
+	return copy;
+}
+/**
+* A fresh Error safe to log. Built from `serializeError` (class instances walked by key,
+* so the logger's key-based redaction still sees `authorization`, `x-api-key`, ...), with
+* string values scrubbed. Keeps name, message, stack, cause and custom properties.
+* The original is untouched and this never throws.
+*/
+function sanitizedError(exception, clean) {
+	try {
+		if (!(exception instanceof Error)) return new Error(clean(String(exception)));
+		const scrubbed = scrubSerialized(require_builder.serializeError(exception), clean, 0, /* @__PURE__ */ new WeakSet());
+		const copy = new Error(String(scrubbed["message"] ?? ""));
+		for (const [key, value] of Object.entries(scrubbed)) {
+			if (key === "message") continue;
+			if (key === "stack" || key === "name") Object.defineProperty(copy, key, {
+				value,
+				writable: true,
+				configurable: true
+			});
+			else require_sensitive_names.assignOwn(copy, key, value);
+		}
+		return copy;
+	} catch {
+		return fallbackError(exception, clean);
+	}
+}
 let LogixiaExceptionFilter = class LogixiaExceptionFilter {
 	constructor(logger, loggerConfig, options) {
+		var _loggerConfig$redact;
 		this._options = options ?? {};
+		this._redactParams = require_sensitive_names.buildNameSet(require_sensitive_names.DEFAULT_REDACT_QUERY_PARAMS, [...(loggerConfig === null || loggerConfig === void 0 || (_loggerConfig$redact = loggerConfig.redact) === null || _loggerConfig$redact === void 0 ? void 0 : _loggerConfig$redact.queryParams) ?? [], ...this._options.redactQueryParams ?? []]);
 		this._logger = logger ?? LogixiaLoggerModule._globalLogger ?? void 0;
 		this._traceConfig = typeof (loggerConfig === null || loggerConfig === void 0 ? void 0 : loggerConfig.traceId) === "object" ? loggerConfig.traceId : void 0;
 	}
@@ -777,18 +866,39 @@ let LogixiaExceptionFilter = class LogixiaExceptionFilter {
 		const request = ctx.getRequest();
 		const response = ctx.getResponse();
 		const traceId = require_request_trace.TraceContext.instance.getCurrentTraceId() ?? require_request_trace.sanitizeIncomingId((_request$headers = request.headers) === null || _request$headers === void 0 ? void 0 : _request$headers["x-trace-id"]) ?? require_request_trace.sanitizeIncomingId(request.id) ?? void 0;
-		const { response: errorResponse, httpStatus } = require_builder.ErrorResponseBuilder.build({
-			exception,
-			traceId,
-			path: request.url ?? "/",
-			startTime: request.startTime,
-			exposeDebug: this._options.exposeDebug === true,
-			exposeCause: this._options.exposeCause === true
-		});
+		const rawUrl = request.originalUrl ?? request.url ?? "";
+		const url = require_sensitive_names.redactUrlQuery(rawUrl, this._redactParams);
+		const secrets = require_sensitive_names.sensitiveQueryValues(rawUrl, this._redactParams);
+		const clean = (text) => require_sensitive_names.sanitizeText(text, this._redactParams, secrets);
+		const buildFor = (input) => {
+			const { response: built, httpStatus: status } = require_builder.ErrorResponseBuilder.build({
+				exception: input,
+				traceId,
+				path: url || "/",
+				startTime: request.startTime,
+				exposeDebug: this._options.exposeDebug === true,
+				exposeCause: this._options.exposeCause === true
+			});
+			return {
+				errorResponse: scrubErrorResponse(built, clean),
+				httpStatus: status
+			};
+		};
+		let result;
+		try {
+			result = buildFor(exception);
+		} catch {
+			result = buildFor(fallbackError(exception, clean));
+		}
+		const { errorResponse, httpStatus } = result;
+		let logixiaException = false;
+		try {
+			logixiaException = require_builder.isLogixiaException(exception);
+		} catch {}
 		if (this._logger) {
 			const requestMeta = {
 				method: request.method ?? "",
-				url: request.url ?? "",
+				url,
 				status: httpStatus,
 				...errorResponse.meta.trace_id !== void 0 ? { trace_id: errorResponse.meta.trace_id } : {}
 			};
@@ -796,10 +906,8 @@ let LogixiaExceptionFilter = class LogixiaExceptionFilter {
 				require_internal_log.internalError(`ExceptionFilter failed to write log entry: ${String(err)}`);
 			};
 			let logPromise;
-			if (httpStatus >= 500) {
-				const err = exception instanceof Error ? exception : new Error(String(exception));
-				logPromise = this._logger.error(err, requestMeta);
-			} else if (require_builder.isLogixiaException(exception)) logPromise = this._logger.warn(`[${errorResponse.error.code}] ${errorResponse.error.message}`, requestMeta);
+			if (httpStatus >= 500) logPromise = this._logger.error(sanitizedError(exception, clean), requestMeta);
+			else if (logixiaException) logPromise = this._logger.warn(`[${errorResponse.error.code}] ${errorResponse.error.message}`, requestMeta);
 			else logPromise = this._logger.warn(`[${httpStatus}] ${errorResponse.error.message}`, requestMeta);
 			if (logPromise && typeof logPromise.catch === "function") logPromise.catch(onLogFailure);
 		}