logixia 2.0.6 → 2.0.8

package/dist/nest.mjs

@@ -1,7 +1,8 @@
-import { a as isLogixiaException, o as LogixiaLogger, t as ErrorResponseBuilder, w as LogLevel, x as DEFAULT_CONFIG } from "./builder-DhNhvOkt.mjs";
+import { S as DEFAULT_CONFIG, T as LogLevel, _ as serializeError, a as isLogixiaException, o as LogixiaLogger, t as ErrorResponseBuilder } from "./builder-DKL7WcIN.mjs";
+import { a as buildNameSet, c as sensitiveQueryValues, l as assignOwn, n as DEFAULT_REDACT_QUERY_PARAMS, o as redactUrlQuery, s as sanitizeText } from "./sensitive-names-o__1PUUR.mjs";
 import { d as getTraceContextKey, l as extractTraceId, o as TraceContext, p as sanitizeIncomingId, r as DEFAULT_TRACE_HEADERS } from "./request-trace-BgNykH9M.mjs";
-import { r as internalWarn, t as internalError } from "./internal-log-Bg4V1cPg.mjs";
-import { n as protectSecrets } from "./secret-config-Dhb6pqTU.mjs";
+import { n as protectSecrets } from "./secret-config-ByGq7kJd.mjs";
+import { r as internalWarn, t as internalError } from "./internal-log-Cy5nF1ZL.mjs";
 import { t as safeToString } from "./coerce.utils-B_rEudCn.mjs";
 import { Catch, Inject, Injectable, Module, Optional, RequestMethod, Scope } from "@nestjs/common";
 import { EMPTY, Observable } from "rxjs";
@@ -302,10 +303,18 @@ function writeTraceHeader(res, header, traceId) {
 		else if (typeof r.header === "function") r.header(header, traceId);
 	} catch {}
 }
+/** Injection token for extra query parameter names redacted in the trace context `url`. */
+const LOGIXIA_TRACE_REDACT_QUERY_PARAMS = "LOGIXIA_TRACE_REDACT_QUERY_PARAMS";
+/** The request URL as stored in the trace context: `originalUrl`, sensitive query values redacted. */
+function traceUrl(req, names) {
+	const raw = req.originalUrl ?? req.url;
+	return raw === void 0 ? void 0 : redactUrlQuery(raw, names);
+}
 let TraceMiddleware = class TraceMiddleware {
-	constructor(config) {
+	constructor(config, redactQueryParams) {
 		this.config = config;
 		this.ctx = TraceContext.instance;
+		this.redactParams = buildNameSet(DEFAULT_REDACT_QUERY_PARAMS, redactQueryParams);
 		const defaultExtractor = {
 			header: DEFAULT_TRACE_HEADERS,
 			query: ["traceId", "trace_id"]
@@ -338,7 +347,7 @@ let TraceMiddleware = class TraceMiddleware {
 		if (header) writeTraceHeader(res, header, traceId);
 		this.ctx.run(traceId, () => next(), {
 			method: req.method,
-			url: req.url,
+			url: traceUrl(req, this.redactParams),
 			userAgent: req.get("User-Agent"),
 			ip: req.ip || ((_req$socket = req.socket) === null || _req$socket === void 0 ? void 0 : _req$socket.remoteAddress) || ((_req$connection = req.connection) === null || _req$connection === void 0 ? void 0 : _req$connection.remoteAddress)
 		});
@@ -347,7 +356,9 @@ let TraceMiddleware = class TraceMiddleware {
 TraceMiddleware = __decorate([
 	Injectable(),
 	__decorateParam(0, Optional()),
-	__decorateMetadata("design:paramtypes", [Object])
+	__decorateParam(1, Optional()),
+	__decorateParam(1, Inject(LOGIXIA_TRACE_REDACT_QUERY_PARAMS)),
+	__decorateMetadata("design:paramtypes", [Object, Array])
 ], TraceMiddleware);
 // src/core/websocket-trace.interceptor.ts
 let WebSocketTraceInterceptor = class WebSocketTraceInterceptor {
@@ -469,6 +480,7 @@ let LogixiaLoggerModule = class LogixiaLoggerModule {
 		return _LogixiaLoggerModule._globalLogger;
 	}
 	configure(consumer) {
+		var _LogixiaLoggerModule$;
 		const { forRoutes = DEFAULT_ROUTES, exclude } = this.config;
 		let resolvedTraceConfig;
 		if (typeof _LogixiaLoggerModule.loggerConfig.traceId === "object") resolvedTraceConfig = _LogixiaLoggerModule.loggerConfig.traceId;
@@ -477,7 +489,7 @@ let LogixiaLoggerModule = class LogixiaLoggerModule {
 			contextKey: "traceId",
 			generator: () => TraceContext.instance.generate()
 		};
-		const middleware = new TraceMiddleware(resolvedTraceConfig);
+		const middleware = new TraceMiddleware(resolvedTraceConfig, (_LogixiaLoggerModule$ = _LogixiaLoggerModule.loggerConfig.redact) === null || _LogixiaLoggerModule$ === void 0 ? void 0 : _LogixiaLoggerModule$.queryParams);
 		const middlewareConfig = (req, res, next) => middleware.use(req, res, next);
 		if (exclude) consumer.apply(middlewareConfig).exclude(...exclude).forRoutes(...forRoutes);
 		else consumer.apply(middlewareConfig).forRoutes(...forRoutes);
@@ -764,9 +776,86 @@ function LogMethod(options = {}) {
 }
 /** Injection token for {@link LogixiaExceptionFilterOptions}. */
 const LOGIXIA_EXCEPTION_FILTER_OPTIONS = "LOGIXIA_EXCEPTION_FILTER_OPTIONS";
+const MAX_SCRUB_DEPTH = 8;
+/** Copy `value` with every string passed through `clean`; the input is never modified. */
+function cleanDeep(value, clean, depth = 0) {
+	if (typeof value === "string") return clean(value);
+	if (value === null || typeof value !== "object" || depth >= MAX_SCRUB_DEPTH) return value;
+	if (Array.isArray(value)) return value.map((item) => cleanDeep(item, clean, depth + 1));
+	const out = {};
+	for (const [key, item] of Object.entries(value)) out[key] = cleanDeep(item, clean, depth + 1);
+	return out;
+}
+function scrubErrorResponse(response, clean) {
+	const { error, debug } = response;
+	return {
+		...response,
+		error: cleanDeep(error, clean),
+		...debug !== void 0 ? { debug: cleanDeep(debug, clean) } : {}
+	};
+}
+const MAX_ERROR_DEPTH = 6;
+/** Scrub string VALUES of an already serialized tree; keys stay so key-based redaction still applies. */
+function scrubSerialized(value, clean, depth, seen) {
+	if (typeof value === "string") return clean(value);
+	if (value === null || typeof value !== "object") return typeof value === "function" || typeof value === "symbol" ? "[Unserializable]" : value;
+	if (seen.has(value)) return "[Circular]";
+	if (depth >= MAX_ERROR_DEPTH) return "[MaxDepth]";
+	seen.add(value);
+	try {
+		if (Array.isArray(value)) return value.map((item) => scrubSerialized(item, clean, depth + 1, seen));
+		const out = {};
+		for (const [key, item] of Object.entries(value)) assignOwn(out, key, scrubSerialized(item, clean, depth + 1, seen));
+		return out;
+	} finally {
+		seen.delete(value);
+	}
+}
+/** Minimal copy used when the full sanitize step fails; never throws. */
+function fallbackError(exception, clean) {
+	let name = "Error";
+	let message = "[Unserializable]";
+	try {
+		if (exception instanceof Error) {
+			name = exception.name;
+			message = clean(exception.message);
+		}
+	} catch {}
+	const copy = new Error(message);
+	copy.name = name;
+	assignOwn(copy, "serialization", "[Unserializable]");
+	return copy;
+}
+/**
+* A fresh Error safe to log. Built from `serializeError` (class instances walked by key,
+* so the logger's key-based redaction still sees `authorization`, `x-api-key`, ...), with
+* string values scrubbed. Keeps name, message, stack, cause and custom properties.
+* The original is untouched and this never throws.
+*/
+function sanitizedError(exception, clean) {
+	try {
+		if (!(exception instanceof Error)) return new Error(clean(String(exception)));
+		const scrubbed = scrubSerialized(serializeError(exception), clean, 0, /* @__PURE__ */ new WeakSet());
+		const copy = new Error(String(scrubbed["message"] ?? ""));
+		for (const [key, value] of Object.entries(scrubbed)) {
+			if (key === "message") continue;
+			if (key === "stack" || key === "name") Object.defineProperty(copy, key, {
+				value,
+				writable: true,
+				configurable: true
+			});
+			else assignOwn(copy, key, value);
+		}
+		return copy;
+	} catch {
+		return fallbackError(exception, clean);
+	}
+}
 let LogixiaExceptionFilter = class LogixiaExceptionFilter {
 	constructor(logger, loggerConfig, options) {
+		var _loggerConfig$redact;
 		this._options = options ?? {};
+		this._redactParams = buildNameSet(DEFAULT_REDACT_QUERY_PARAMS, [...(loggerConfig === null || loggerConfig === void 0 || (_loggerConfig$redact = loggerConfig.redact) === null || _loggerConfig$redact === void 0 ? void 0 : _loggerConfig$redact.queryParams) ?? [], ...this._options.redactQueryParams ?? []]);
 		this._logger = logger ?? LogixiaLoggerModule._globalLogger ?? void 0;
 		this._traceConfig = typeof (loggerConfig === null || loggerConfig === void 0 ? void 0 : loggerConfig.traceId) === "object" ? loggerConfig.traceId : void 0;
 	}
@@ -776,18 +865,39 @@ let LogixiaExceptionFilter = class LogixiaExceptionFilter {
 		const request = ctx.getRequest();
 		const response = ctx.getResponse();
 		const traceId = TraceContext.instance.getCurrentTraceId() ?? sanitizeIncomingId((_request$headers = request.headers) === null || _request$headers === void 0 ? void 0 : _request$headers["x-trace-id"]) ?? sanitizeIncomingId(request.id) ?? void 0;
-		const { response: errorResponse, httpStatus } = ErrorResponseBuilder.build({
-			exception,
-			traceId,
-			path: request.url ?? "/",
-			startTime: request.startTime,
-			exposeDebug: this._options.exposeDebug === true,
-			exposeCause: this._options.exposeCause === true
-		});
+		const rawUrl = request.originalUrl ?? request.url ?? "";
+		const url = redactUrlQuery(rawUrl, this._redactParams);
+		const secrets = sensitiveQueryValues(rawUrl, this._redactParams);
+		const clean = (text) => sanitizeText(text, this._redactParams, secrets);
+		const buildFor = (input) => {
+			const { response: built, httpStatus: status } = ErrorResponseBuilder.build({
+				exception: input,
+				traceId,
+				path: url || "/",
+				startTime: request.startTime,
+				exposeDebug: this._options.exposeDebug === true,
+				exposeCause: this._options.exposeCause === true
+			});
+			return {
+				errorResponse: scrubErrorResponse(built, clean),
+				httpStatus: status
+			};
+		};
+		let result;
+		try {
+			result = buildFor(exception);
+		} catch {
+			result = buildFor(fallbackError(exception, clean));
+		}
+		const { errorResponse, httpStatus } = result;
+		let logixiaException = false;
+		try {
+			logixiaException = isLogixiaException(exception);
+		} catch {}
 		if (this._logger) {
 			const requestMeta = {
 				method: request.method ?? "",
-				url: request.url ?? "",
+				url,
 				status: httpStatus,
 				...errorResponse.meta.trace_id !== void 0 ? { trace_id: errorResponse.meta.trace_id } : {}
 			};
@@ -795,10 +905,8 @@ let LogixiaExceptionFilter = class LogixiaExceptionFilter {
 				internalError(`ExceptionFilter failed to write log entry: ${String(err)}`);
 			};
 			let logPromise;
-			if (httpStatus >= 500) {
-				const err = exception instanceof Error ? exception : new Error(String(exception));
-				logPromise = this._logger.error(err, requestMeta);
-			} else if (isLogixiaException(exception)) logPromise = this._logger.warn(`[${errorResponse.error.code}] ${errorResponse.error.message}`, requestMeta);
+			if (httpStatus >= 500) logPromise = this._logger.error(sanitizedError(exception, clean), requestMeta);
+			else if (logixiaException) logPromise = this._logger.warn(`[${errorResponse.error.code}] ${errorResponse.error.message}`, requestMeta);
 			else logPromise = this._logger.warn(`[${httpStatus}] ${errorResponse.error.message}`, requestMeta);
 			if (logPromise && typeof logPromise.catch === "function") logPromise.catch(onLogFailure);
 		}