n8n-nodes-redactor 1.11.1 → 4.0.0

package/README.md

@@ -16,7 +16,7 @@
   <a href="https://www.npmjs.com/package/n8n-nodes-redactor#provenance"><img src="https://img.shields.io/badge/npm-provenance%20signed-brightgreen" alt="npm provenance" /></a>
   <a href="#license"><img src="https://img.shields.io/npm/l/n8n-nodes-redactor" alt="MIT License" /></a>
   <img src="https://img.shields.io/badge/PII%20patterns-216-blue" alt="216 PII patterns" />
-  <img src="https://img.shields.io/badge/n8n-self--hosted-FF6D5A" alt="Self-hosted n8n" />
+  <img src="https://img.shields.io/badge/n8n-Cloud%20%2B%20self--hosted-FF6D5A" alt="n8n Cloud and self-hosted" />
 </p>
 
 ## What you get
@@ -25,7 +25,7 @@
 - **The answer still makes sense.** After the model replies, the node puts the real values back, so your output reads naturally.
 - **Fewer false alarms.** Card numbers are Luhn checked, IBANs checksum verified, NHS numbers mod 11 validated, so random digits are left alone.
 - **Proof for your records.** An optional audit report, and a GDPR Article 30 processing record built from each run.
-- **No new vendor.** Everything runs inside your own n8n. No cloud service, no API key, no runtime dependency.
+- **No new vendor.** Everything runs inside your n8n, on n8n Cloud or self-hosted. No extra service, no API key, no runtime dependency.
 
 ## From install to first result
 
@@ -50,11 +50,11 @@ After Restore, your workflow gets the real values back.
 
 | Environment | Status |
 |---|---|
+| n8n Cloud | Supported from 4.0.0 |
 | Self-hosted n8n 1.x and 2.x | Supported |
-| n8n Cloud | Not available |
-| n8n verified community nodes | Not eligible |
+| n8n verified community nodes | Eligible from 4.0.0. Passes n8n's verification scanner with no findings |
 
-The persistent vault, encrypted vault files and JSONL audit log write to the local disk. n8n Cloud and n8n's verification program do not allow community nodes to use the file system, so this node is self-hosted only by design.
+Version 4.0.0 uses no local disk. The vault lives in workflow storage and audit records go to the Report output. Upgrading from 1.x? Read [docs/MIGRATION.md](https://github.com/mjmirza/n8n-nodes-redactor/blob/master/docs/MIGRATION.md). The 1.x line stays installable with `npm install n8n-nodes-redactor@v1-legacy`.
 
 ## Operations
 
@@ -65,7 +65,7 @@ The persistent vault, encrypted vault files and JSONL audit log write to the loc
 | Detect | Assessing data before deciding | Reports what personal data exists without changing anything |
 | Verify | After redaction | Rescans the output and returns PASS or FAIL with any leaked values |
 | Classify | Governance and routing | Labels data PUBLIC, INTERNAL, CONFIDENTIAL or RESTRICTED |
-| Purge | Erasure requests and cleanup | Deletes vault sessions from memory or disk, supporting GDPR Article 17 |
+| Purge | Erasure requests and cleanup | Deletes vault sessions from memory or workflow storage, supporting GDPR Article 17 |
 | Stats | Debugging | Lists active vault sessions with entry counts and TTL |
 
 The recommended production chain looks like this.
@@ -109,16 +109,16 @@ Data source > Detect > Redact > LLM > Verify > Restore > Output > Purge
 |---|---|
 | Deduplication | The same value gets the same token everywhere, so the model keeps relationships between fields |
 | Field targeting | Allowlist or denylist paths such as `user.email`, `*.phone` or `metadata.*` |
-| Vault | In memory, or file based in `~/.n8n/pii-vault/` so it survives restarts. Sessions expire after 60 minutes by default |
+| Vault | Workflow Storage by default, so Restore works in later production runs of the same workflow, or In-Memory. Sessions expire after 60 minutes by default |
 | Vault encryption | AES-256-GCM with scrypt key derivation, one passphrase per tenant |
 | Confidence threshold | Each match carries a 0.0 to 1.0 score. Checksum validated patterns score 0.95 |
 | Allow and deny lists | Values to never redact, such as your support address, and values to always redact, such as project codenames |
 | Prompt injection check | 25+ patterns, including instruction overrides, delimiter escapes, encoded payloads and zero width characters. Returns BLOCK, FLAG or CLEAN |
 | Audit report | A second output with hits by category and pattern |
-| Audit log | JSONL with daily rotation and a 100 MB cap, readable by Splunk, ELK and Datadog |
+| Audit log | Turn on Audit Log to get an `audit` record (counts, labels, timing, never values) on the Report output. Send it to any database, sheet or SIEM node |
 | ROPA record | Turn on Include Audit Report, then Include GDPR Art.30 ROPA Record, and fill in the controller details |
 | Presidio | Optional Microsoft Presidio container for names and organisations in free text. See [docs/PRESIDIO_SETUP.md](https://github.com/mjmirza/n8n-nodes-redactor/blob/master/docs/PRESIDIO_SETUP.md). Falls back to built-in patterns when unreachable |
-| Per-tenant profiles | Planned for 2.0.0 as JSON settings in the node |
+| Per-tenant profiles | Turn on Use Tenant Profile and paste JSON. Validated on every run. Fields are listed in [docs/MIGRATION.md](https://github.com/mjmirza/n8n-nodes-redactor/blob/master/docs/MIGRATION.md#tenant-profile-fields) |
 
 This node reduces what reaches a model. It is not legal advice and does not on its own make a workflow GDPR or HIPAA compliant.
 

package/dist/nodes/Redactor/Redactor.node.js

@@ -9,6 +9,7 @@ const classification_1 = require("./classification");
 const injection_1 = require("./injection");
 const audit_1 = require("./audit");
 const presidio_1 = require("./presidio");
+const profiles_1 = require("./profiles");
 const ropa_1 = require("./ropa");
 const RECOMMENDED_PATTERNS = [
     'email', 'phone', 'phoneDE', 'phoneUK', 'phoneAT', 'phoneCH', 'phoneFR',
@@ -56,8 +57,21 @@ class Redactor {
                 name: 'Redactor',
             },
             inputs: [n8n_workflow_1.NodeConnectionTypes.Main],
-            outputs: `={{((parameters) => parameters["includeReport"] ? [{ type: "main", displayName: "Data" }, { type: "main", displayName: "Report" }] : [{ type: "main", displayName: "Data" }])($parameter)}}`,
+            outputs: `={{((parameters) => (parameters["includeReport"] || parameters["auditLog"]) ? [{ type: "main", displayName: "Data" }, { type: "main", displayName: "Report" }] : [{ type: "main", displayName: "Data" }])($parameter)}}`,
             properties: [
+                {
+                    displayName: 'Resource',
+                    name: 'resource',
+                    type: 'options',
+                    noDataExpression: true,
+                    options: [
+                        {
+                            name: 'Data',
+                            value: 'data',
+                        },
+                    ],
+                    default: 'data',
+                },
                 {
                     displayName: 'Operation',
                     name: 'operation',
@@ -500,7 +514,7 @@ class Redactor {
                         },
                     },
                     default: false,
-                    description: 'Whether to write a persistent JSONL audit log of all redaction activity to ~/.n8n/pii-audit/. Self-hosted n8n only. Supports GDPR Art.30, HIPAA, SOX and PCI DSS record-keeping.',
+                    description: 'Whether to add an audit record (counts, labels, severity, timing, no PII values) to the Report output. Store it with any node, for example a database or a file. Supports GDPR Art.30, HIPAA, SOX and PCI DSS record-keeping.',
                 },
                 {
                     displayName: 'Enhanced NLP Detection (Optional)',
@@ -561,31 +575,17 @@ class Redactor {
                         },
                     },
                     options: [
-                        {
-                            name: 'File-Based (Recommended, Persistent)',
-                            value: 'file',
-                        },
                         {
                             name: 'In-Memory (Fast, Lost on Restart)',
                             value: 'memory',
                         },
-                    ],
-                    default: 'file',
-                    description: 'File-based (recommended): Persists to disk, survives restarts, no memory bloat. Stored in ~/.n8n/pii-vault/. In-memory: Faster but lost on restart, capped at 1000 sessions to prevent memory bloat.',
-                },
-                {
-                    displayName: 'Vault Directory',
-                    name: 'vaultDir',
-                    type: 'string',
-                    displayOptions: {
-                        show: {
-                            operation: ['redact', 'restore', 'stats', 'purge'],
-                            vaultStorage: ['file'],
+                        {
+                            name: 'Workflow Storage (Recommended, Persistent)',
+                            value: 'workflow',
                         },
-                    },
-                    default: '',
-                    placeholder: '/path/to/vault (default: ~/.n8n/pii-vault/)',
-                    description: 'Custom directory for file-based vault storage',
+                    ],
+                    default: 'workflow',
+                    description: 'Workflow storage keeps sessions with the workflow, so Redact and Restore nodes in the same workflow share them and they survive restarts. n8n saves it after production runs of an active workflow. In-memory is faster but lost on restart and capped at 1000 sessions.',
                 },
                 {
                     displayName: 'Vault Encryption Passphrase',
@@ -597,11 +597,11 @@ class Redactor {
                     displayOptions: {
                         show: {
                             operation: ['redact', 'restore', 'stats', 'purge'],
-                            vaultStorage: ['file'],
+                            vaultStorage: ['workflow', 'file'],
                         },
                     },
                     default: '',
-                    description: 'Encrypt vault files at rest with AES-256-GCM. Leave empty for no encryption. When set, vault files cannot be read without this passphrase. Each tenant should use a different passphrase for complete isolation.',
+                    description: 'Encrypt stored sessions at rest with AES-256-GCM. Leave empty for no encryption. When set, sessions cannot be read without this passphrase. Each tenant should use a different passphrase for complete isolation.',
                 },
                 {
                     displayName: 'Session TTL (Minutes)',
@@ -615,6 +615,32 @@ class Redactor {
                     default: 60,
                     description: 'Auto-expire vault sessions after this many minutes. Set to 0 for no expiry. Prevents vault from growing unbounded.',
                 },
+                {
+                    displayName: 'Use Tenant Profile',
+                    name: 'useTenantProfile',
+                    type: 'boolean',
+                    displayOptions: {
+                        show: {
+                            operation: ['redact'],
+                        },
+                    },
+                    default: false,
+                    description: 'Whether to apply per-client settings from a JSON profile on top of this node',
+                },
+                {
+                    displayName: 'Tenant Profile (JSON)',
+                    name: 'tenantProfile',
+                    type: 'json',
+                    required: true,
+                    displayOptions: {
+                        show: {
+                            operation: ['redact'],
+                            useTenantProfile: [true],
+                        },
+                    },
+                    default: '{}',
+                    description: 'Optional per-client settings that override this node: enabledPatterns, customPatterns, confidenceThreshold, redactionMode, dedup, fieldMode, fieldRules, allowList, denyList, retentionMinutes, auditLog. Unknown fields are rejected.',
+                },
                 {
                     displayName: 'Purge Scope',
                     name: 'purgeScope',
@@ -719,6 +745,7 @@ class Redactor {
         const items = this.getInputData();
         const allPaired = items.map((_, i) => ({ item: i }));
         const operation = this.getNodeParameter('operation', 0);
+        const startTime = Date.now();
         (0, presidio_1.resetCircuitBreaker)();
         if (operation === 'detect' || operation === 'verify') {
             const enabledPatterns = (0, patterns_1.getPatternOptions)().map((p) => p.value);
@@ -759,8 +786,21 @@ class Redactor {
                     includeReport = this.getNodeParameter('includeReport', 0, false);
                 }
                 catch { }
-                if (includeReport) {
-                    return [returnData, [{ json: { ...summary, hits: report.hits }, pairedItem: allPaired }]];
+                let auditLog = false;
+                try {
+                    auditLog = this.getNodeParameter('auditLog', 0, false);
+                }
+                catch { }
+                if (includeReport || auditLog) {
+                    const reportJson = includeReport
+                        ? { ...summary, hits: report.hits }
+                        : {};
+                    if (auditLog) {
+                        reportJson.audit = (0, audit_1.buildAuditEntry)('DETECT', 'token', allHits, items.length, Date.now() - startTime, enabledPatterns.length, false, (0, classification_1.classifyData)(allHits));
+                    }
+                    if (!includeReport)
+                        returnData.push({ json: summary, pairedItem: allPaired });
+                    return [returnData, [{ json: reportJson, pairedItem: allPaired }]];
                 }
                 returnData.push({ json: summary, pairedItem: allPaired });
                 return [returnData];
@@ -818,14 +858,13 @@ class Redactor {
                         pairedItem: allPaired,
                     }]];
         }
-        const vaultStorage = this.getNodeParameter('vaultStorage', 0, 'file');
-        const vaultDir = this.getNodeParameter('vaultDir', 0, '');
+        const vaultStorage = this.getNodeParameter('vaultStorage', 0, 'workflow');
         let vaultPassphrase = '';
         try {
             vaultPassphrase = this.getNodeParameter('vaultPassphrase', 0, '');
         }
         catch { }
-        const vault = (0, vault_1.createVault)(vaultStorage, vaultDir || undefined, vaultPassphrase || undefined);
+        const vault = (0, vault_1.createVault)(vaultStorage, vaultStorage === 'memory' ? undefined : this.getWorkflowStaticData('global'), vaultPassphrase || undefined);
         if (operation === 'stats') {
             vault.cleanup();
             const sessions = vault.listSessions();
@@ -857,7 +896,7 @@ class Redactor {
             }
         }
         if (operation === 'redact') {
-            const mode = this.getNodeParameter('redactionMode', 0, 'token');
+            let mode = this.getNodeParameter('redactionMode', 0, 'token');
             const detectionScope = this.getNodeParameter('detectionScope', 0, 'recommended');
             let enabledPatterns;
             if (detectionScope === 'all') {
@@ -869,17 +908,29 @@ class Redactor {
             else {
                 enabledPatterns = this.getNodeParameter('piiTypes', 0);
             }
-            const dedup = this.getNodeParameter('dedup', 0, true);
-            const fieldMode = this.getNodeParameter('fieldMode', 0, 'all');
-            const sessionTtl = this.getNodeParameter('sessionTtl', 0, 60);
+            let dedup = this.getNodeParameter('dedup', 0, true);
+            let fieldMode = this.getNodeParameter('fieldMode', 0, 'all');
+            let sessionTtl = this.getNodeParameter('sessionTtl', 0, 60);
             const includeReport = this.getNodeParameter('includeReport', 0, false);
             const customPatternsRaw = this.getNodeParameter('customPatterns', 0, {});
-            const customPatterns = (_a = customPatternsRaw.patterns) !== null && _a !== void 0 ? _a : [];
+            let customPatterns = (_a = customPatternsRaw.patterns) !== null && _a !== void 0 ? _a : [];
             const fieldRulesRaw = this.getNodeParameter('fieldRules', 0, {});
-            const fieldRules = ((_b = fieldRulesRaw.rules) !== null && _b !== void 0 ? _b : []).map((r) => ({
+            let fieldRules = ((_b = fieldRulesRaw.rules) !== null && _b !== void 0 ? _b : []).map((r) => ({
                 field: r.field,
                 mode: fieldMode === 'allowlist' ? 'include' : 'exclude',
             }));
+            const presidioRequester = async ({ method, url, body, timeout }) => {
+                const response = await this.helpers.httpRequest({
+                    method: method,
+                    url,
+                    body,
+                    json: true,
+                    timeout,
+                    returnFullResponse: true,
+                    ignoreHttpStatusErrors: true,
+                });
+                return { statusCode: response.statusCode, body: response.body };
+            };
             let enablePresidio = false;
             let presidioUrl = '';
             let presidioLanguage = 'en';
@@ -893,16 +944,53 @@ class Redactor {
             catch {
             }
             const allowListRaw = this.getNodeParameter('allowList', 0, {});
-            const allowList = ((_c = allowListRaw.entries) !== null && _c !== void 0 ? _c : []).map((e) => ({
+            let allowList = ((_c = allowListRaw.entries) !== null && _c !== void 0 ? _c : []).map((e) => ({
                 value: e.value,
                 type: (e.type || 'contains'),
             }));
             const denyListRaw = this.getNodeParameter('denyList', 0, {});
-            const denyList = ((_d = denyListRaw.entries) !== null && _d !== void 0 ? _d : []).map((e) => ({
+            let denyList = ((_d = denyListRaw.entries) !== null && _d !== void 0 ? _d : []).map((e) => ({
                 value: e.value,
                 type: (e.type || 'exact'),
             }));
-            const confidenceThreshold = this.getNodeParameter('confidenceThreshold', 0, 0);
+            let confidenceThreshold = this.getNodeParameter('confidenceThreshold', 0, 0);
+            const hasReportOutput = includeReport || this.getNodeParameter('auditLog', 0, false);
+            let auditLog = this.getNodeParameter('auditLog', 0, false);
+            const useTenantProfile = this.getNodeParameter('useTenantProfile', 0, false);
+            const profileRaw = useTenantProfile ? this.getNodeParameter('tenantProfile', 0, '') : '';
+            if (profileRaw !== '' && profileRaw !== undefined && profileRaw !== null) {
+                let profile;
+                try {
+                    profile = (0, profiles_1.parseTenantProfile)(profileRaw, (0, patterns_1.getPatternOptions)().map((o) => o.value));
+                }
+                catch (error) {
+                    throw new n8n_workflow_1.NodeOperationError(this.getNode(), error.message, {
+                        description: 'Fix the Tenant Profile (JSON) field, or leave it empty to use the node settings.',
+                    });
+                }
+                if (profile.enabledPatterns)
+                    enabledPatterns = profile.enabledPatterns;
+                if (profile.customPatterns)
+                    customPatterns = profile.customPatterns;
+                if (profile.confidenceThreshold !== undefined)
+                    confidenceThreshold = profile.confidenceThreshold;
+                if (profile.redactionMode)
+                    mode = profile.redactionMode;
+                if (profile.dedup !== undefined)
+                    dedup = profile.dedup;
+                if (profile.fieldMode)
+                    fieldMode = profile.fieldMode;
+                if (profile.fieldRules)
+                    fieldRules = profile.fieldRules;
+                if (profile.allowList)
+                    allowList = profile.allowList;
+                if (profile.denyList)
+                    denyList = profile.denyList;
+                if (profile.retentionMinutes !== undefined)
+                    sessionTtl = profile.retentionMinutes;
+                if (profile.auditLog !== undefined)
+                    auditLog = profile.auditLog;
+            }
             vault.getOrCreateSession(sessionId, sessionTtl * 60 * 1000);
             const ctx = {
                 enabledPatterns,
@@ -916,6 +1004,7 @@ class Redactor {
                 confidenceThreshold,
                 presidioUrl: enablePresidio ? presidioUrl : undefined,
                 presidioLanguage: enablePresidio ? presidioLanguage : undefined,
+                presidioRequest: enablePresidio ? presidioRequester : undefined,
             };
             const allHits = [];
             const returnData = [];
@@ -948,16 +1037,9 @@ class Redactor {
             }
             catch {
             }
-            try {
-                const auditLog = this.getNodeParameter('auditLog', 0, false);
-                if (auditLog) {
-                    const startTime = Date.now();
-                    const classification = (0, classification_1.classifyData)(allHits);
-                    (0, audit_1.writeAuditLog)('REDACT', mode, allHits, items.length, Date.now() - startTime, enabledPatterns.length, !!ctx.presidioUrl, classification, sessionId);
-                }
-            }
-            catch {
-            }
+            const auditEntry = auditLog && hasReportOutput
+                ? (0, audit_1.buildAuditEntry)('REDACT', mode, allHits, items.length, Date.now() - startTime, enabledPatterns.length, !!ctx.presidioUrl, (0, classification_1.classifyData)(allHits), sessionId)
+                : undefined;
             if (injectionResult && injectionResult.detected) {
                 returnData.push({
                     json: {
@@ -966,12 +1048,14 @@ class Redactor {
                     pairedItem: allPaired,
                 });
             }
-            if (includeReport) {
-                const report = (0, engine_1.buildReport)(sessionId, allHits);
-                if (this.getNodeParameter('includeRopa', 0, false)) {
+            if (hasReportOutput) {
+                const report = includeReport ? (0, engine_1.buildReport)(sessionId, allHits) : {};
+                if (auditEntry)
+                    report.audit = auditEntry;
+                if (includeReport && this.getNodeParameter('includeRopa', 0, false)) {
                     const d = this.getNodeParameter('ropa', 0, {});
                     const list = (v) => String(v !== null && v !== void 0 ? v : '').split(',').map((x) => x.trim()).filter(Boolean);
-                    report.ropa = (0, ropa_1.generateRopaRecord)(allHits, (0, classification_1.classifyData)(allHits), items.length, enabledPatterns.length, mode, sessionTtl, !!vaultPassphrase, this.getNodeParameter('auditLog', 0, false), { name: String((_e = d.controllerName) !== null && _e !== void 0 ? _e : ''), contactEmail: String((_f = d.controllerContact) !== null && _f !== void 0 ? _f : ''), dpo: d.dpo ? String(d.dpo) : undefined }, list(d.purposes), String((_g = d.legalBasis) !== null && _g !== void 0 ? _g : 'legitimate_interest'), list(d.dataSubjects), list(d.recipients), []);
+                    report.ropa = (0, ropa_1.generateRopaRecord)(allHits, (0, classification_1.classifyData)(allHits), items.length, enabledPatterns.length, mode, sessionTtl, !!vaultPassphrase, auditLog, { name: String((_e = d.controllerName) !== null && _e !== void 0 ? _e : ''), contactEmail: String((_f = d.controllerContact) !== null && _f !== void 0 ? _f : ''), dpo: d.dpo ? String(d.dpo) : undefined }, list(d.purposes), String((_g = d.legalBasis) !== null && _g !== void 0 ? _g : 'legitimate_interest'), list(d.dataSubjects), list(d.recipients), []);
                 }
                 return [returnData, [{ json: report, pairedItem: allPaired }]];
             }
@@ -982,7 +1066,7 @@ class Redactor {
             const session = vault.getSession(sessionId);
             if (!session) {
                 throw new n8n_workflow_1.NodeOperationError(this.getNode(), `No vault found for session "${sessionId}". Ensure a Redact node ran first with the same Session ID and vault storage type.`, {
-                    description: 'Testing step by step? Each "Execute step" gets a new execution ID, so Redact and Restore no longer share a session. Run the whole workflow, or set the same fixed Session ID (for example "test-1") on both nodes.',
+                    description: 'Testing step by step? Each "Execute step" gets a new execution ID, and n8n saves workflow storage only after production runs of an active workflow. Run the whole workflow, or set the same fixed Session ID (for example "test-1") on both nodes. Restore only works in the workflow that ran Redact.',
                 });
             }
             const returnData = [];

package/dist/nodes/Redactor/audit.d.ts

@@ -18,5 +18,4 @@ export interface AuditLogEntry {
     presidioEnabled: boolean;
     sessionId?: string;
 }
-export declare function writeAuditLog(action: string, mode: RedactionMode | string, hits: RedactionHit[], inputItemCount: number, processingTimeMs: number, patternsUsed: number, presidioEnabled: boolean, classification?: ClassificationLabel, sessionId?: string, auditDir?: string): void;
-export declare function readAuditLog(startDate?: string, endDate?: string, auditDir?: string): AuditLogEntry[];
+export declare function buildAuditEntry(action: string, mode: RedactionMode | string, hits: RedactionHit[], inputItemCount: number, processingTimeMs: number, patternsUsed: number, presidioEnabled: boolean, classification?: ClassificationLabel, sessionId?: string): AuditLogEntry;

package/dist/nodes/Redactor/audit.js

@@ -33,23 +33,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.writeAuditLog = writeAuditLog;
-exports.readAuditLog = readAuditLog;
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-const MAX_FILE_SIZE = 104857600;
-const DEFAULT_AUDIT_DIR = path.join(process.env.HOME || '/tmp', '.n8n', 'pii-audit');
-function generateEventId() {
-    const bytes = new Array(16).fill(0).map(() => Math.floor(Math.random() * 256));
-    bytes[6] = (bytes[6] & 0x0f) | 0x40;
-    bytes[8] = (bytes[8] & 0x3f) | 0x80;
-    const hex = bytes.map((b) => b.toString(16).padStart(2, '0')).join('');
-    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
-}
-function getLogFilePath(auditDir) {
-    const today = new Date().toISOString().split('T')[0];
-    return path.join(auditDir, `pii-audit-${today}.jsonl`);
-}
+exports.buildAuditEntry = buildAuditEntry;
+const crypto = __importStar(require("crypto"));
 function determineSeverity(classificationLevel, totalHits = 0) {
     if (classificationLevel === 'RESTRICTED' || totalHits >= 50)
         return 'CRITICAL';
@@ -59,87 +44,29 @@ function determineSeverity(classificationLevel, totalHits = 0) {
         return 'MEDIUM';
     return 'LOW';
 }
-function writeAuditLog(action, mode, hits, inputItemCount, processingTimeMs, patternsUsed, presidioEnabled, classification, sessionId, auditDir) {
-    try {
-        const dir = auditDir || DEFAULT_AUDIT_DIR;
-        if (!fs.existsSync(dir)) {
-            fs.mkdirSync(dir, { recursive: true });
-        }
-        const hitsByCategory = {};
-        const hitsByPattern = {};
-        for (const hit of hits) {
-            hitsByCategory[hit.category] = (hitsByCategory[hit.category] || 0) + 1;
-            hitsByPattern[hit.patternLabel] = (hitsByPattern[hit.patternLabel] || 0) + 1;
-        }
-        const entry = {
-            version: '1.0',
-            timestamp: new Date().toISOString(),
-            eventId: generateEventId(),
-            severity: determineSeverity(classification === null || classification === void 0 ? void 0 : classification.level, hits.length),
-            action,
-            mode,
-            status: 'SUCCESS',
-            totalHits: hits.length,
-            hitsByCategory,
-            hitsByPattern,
-            classificationLevel: classification === null || classification === void 0 ? void 0 : classification.level,
-            inputItemCount,
-            processingTimeMs,
-            patternsUsed,
-            presidioEnabled,
-            sessionId,
-        };
-        const logFile = getLogFilePath(dir);
-        try {
-            if (fs.existsSync(logFile)) {
-                const stats = fs.statSync(logFile);
-                if (stats.size >= MAX_FILE_SIZE) {
-                    let seq = 1;
-                    while (fs.existsSync(`${logFile}.${seq}`))
-                        seq++;
-                    fs.renameSync(logFile, `${logFile}.${seq}`);
-                }
-            }
-        }
-        catch {
-        }
-        fs.appendFileSync(logFile, JSON.stringify(entry) + '\n', 'utf-8');
-    }
-    catch {
-    }
-}
-function readAuditLog(startDate, endDate, auditDir) {
-    try {
-        const dir = auditDir || DEFAULT_AUDIT_DIR;
-        if (!fs.existsSync(dir))
-            return [];
-        const files = fs.readdirSync(dir)
-            .filter((f) => f.startsWith('pii-audit-') && f.endsWith('.jsonl'))
-            .sort();
-        const entries = [];
-        for (const file of files) {
-            const fileDate = file.replace('pii-audit-', '').replace('.jsonl', '');
-            if (startDate && fileDate < startDate)
-                continue;
-            if (endDate && fileDate > endDate)
-                continue;
-            try {
-                const content = fs.readFileSync(path.join(dir, file), 'utf-8');
-                const lines = content.split('\n').filter((l) => l.trim().length > 0);
-                for (const line of lines) {
-                    try {
-                        entries.push(JSON.parse(line));
-                    }
-                    catch {
-                    }
-                }
-            }
-            catch {
-            }
-        }
-        return entries;
-    }
-    catch {
-        return [];
+function buildAuditEntry(action, mode, hits, inputItemCount, processingTimeMs, patternsUsed, presidioEnabled, classification, sessionId) {
+    const hitsByCategory = {};
+    const hitsByPattern = {};
+    for (const hit of hits) {
+        hitsByCategory[hit.category] = (hitsByCategory[hit.category] || 0) + 1;
+        hitsByPattern[hit.patternLabel] = (hitsByPattern[hit.patternLabel] || 0) + 1;
     }
+    return {
+        version: '2.0',
+        timestamp: new Date().toISOString(),
+        eventId: crypto.randomUUID(),
+        severity: determineSeverity(classification === null || classification === void 0 ? void 0 : classification.level, hits.length),
+        action,
+        mode,
+        status: 'SUCCESS',
+        totalHits: hits.length,
+        hitsByCategory,
+        hitsByPattern,
+        classificationLevel: classification === null || classification === void 0 ? void 0 : classification.level,
+        inputItemCount,
+        processingTimeMs,
+        patternsUsed,
+        presidioEnabled,
+        sessionId,
+    };
 }

package/dist/nodes/Redactor/engine.js

@@ -624,7 +624,7 @@ async function enhanceWithPresidio(data, ctx, vault, sessionId, hits, itemIndex)
         if (TOKEN_RE.test(value))
             continue;
         try {
-            const entities = await (0, presidio_1.analyzeWithPresidio)(ctx.presidioUrl, value, ctx.presidioLanguage || 'en', 0.4, 10000);
+            const entities = await (0, presidio_1.analyzeWithPresidio)(ctx.presidioUrl, value, ctx.presidioLanguage || 'en', 0.4, 10000, ctx.presidioRequest);
             if (entities.length === 0)
                 continue;
             const sorted = entities.sort((a, b) => b.start - a.start);

package/dist/nodes/Redactor/presidio.d.ts

@@ -1,3 +1,12 @@
+export type PresidioRequester = (options: {
+    method: 'GET' | 'POST';
+    url: string;
+    body?: object;
+    timeout: number;
+}) => Promise<{
+    statusCode: number;
+    body: unknown;
+}>;
 export interface PresidioEntity {
     entity_type: string;
     start: number;
@@ -20,8 +29,8 @@ export interface PresidioEntity {
     };
 }
 export declare function resetCircuitBreaker(): void;
-export declare function checkPresidioHealth(baseUrl: string): Promise<boolean>;
-export declare function analyzeWithPresidio(baseUrl: string, text: string, language?: string, scoreThreshold?: number, timeoutMs?: number): Promise<PresidioEntity[]>;
+export declare function checkPresidioHealth(baseUrl: string, request?: PresidioRequester): Promise<boolean>;
+export declare function analyzeWithPresidio(baseUrl: string, text: string, language?: string, scoreThreshold?: number, timeoutMs?: number, request?: PresidioRequester): Promise<PresidioEntity[]>;
 export declare function getRedactorLabel(presidioEntityType: string): string;
 export declare function getRedactorCategory(presidioEntityType: string): string;
-export declare function getPresidioEntities(baseUrl: string): Promise<string[]>;
+export declare function getPresidioEntities(baseUrl: string, request?: PresidioRequester): Promise<string[]>;