reporting-labs 0.6.6 → 0.6.7

package/README.md

@@ -19,7 +19,7 @@ Today it ships with a **Playwright** reporter. WebdriverIO, Cypress and Jest/Vit
 **1. Install**
 
 ```bash
-npm i -D reporting-labs
+npm i -D reporting-labs@latest
 ```
 
 **2. Create the config file**
@@ -134,7 +134,7 @@ await testData(rowsFromExcelOrJson, 'Coupons');                           // arr
 await testData(fs.readFileSync('data/users.csv', 'utf8'), 'users.csv');   // CSV text → table
 ```
 
-**Secrets are masked automatically**, wherever they show up: `console.log` output, `log()` lines, `testData()` blocks, API headers and bodies, step titles and assertion messages. Covered forms: `password=x`, `Password: x`, `{ password: 'x' }`, `"password":"x"`, `X-Api-Key: x`, `access_token=x`, "password is x", "with password S3cret@1", `Bearer ...` / `Basic ...`, JWTs, and well-known token formats (GitHub, AWS, Slack, Stripe, Google, GitLab, npm, SendGrid). A failing `expect(token)` shows `Received: "****"`. Add your own keys with `maskKeys: ['otp', 'pan']` in the config; they apply to text too.
+**Secrets are masked automatically**, wherever they show up: `console.log` output, `log()` lines, `testData()` blocks, API headers and bodies, step titles and assertion messages. Covered forms: `password=x`, `Password: x`, `{ password: 'x' }`, `"password":"x"`, `X-Api-Key: x`, `access_token=x`, "password is x", "with password S3cret@1", `Bearer ...` / `Basic ...`, JWTs, and well-known token formats (GitHub, AWS, Slack, Stripe, Google, GitLab, npm, SendGrid). A failing `expect(token)` shows `Received: "****"`. Also `user:pass@host` in URLs, `curl -u user:pass`, `credentials user:pass`, `password for user X is Y`, `Typed x into password field`, and Luhn-valid card numbers. The masker remembers every value it has masked (and the values of `PASSWORD` / `API_TOKEN` / `*_SECRET` environment variables), so a secret that later appears with no key at all (`Logging in as admin / s3cret`) is blanked too. Add your own keys with `maskKeys: ['otp', 'pan']` and values it cannot know about with `maskValues: [process.env.PASSWORD]`; `maskFromEnv: false` turns the environment learning off.
 
 ## API calls: recorded on their own
 
@@ -307,6 +307,8 @@ Every option is optional. `npx reporting-labs init` writes them all, with commen
 | `env` | – | Extra rows on the Environment card |
 | `links` | `{}` | Turn meta keys into links. `{id}` is replaced by the value. An object `{ url, display }` builds the URL from several fields of an object passed to `meta()`, see below |
 | `maskKeys` | `[]` | Extra keys to mask as `****` |
+| `maskValues` | `[]` | Literal values to blank wherever they appear, keyed or not |
+| `maskFromEnv` | `true` | Learn the values of sensitive-looking environment variables (`PASSWORD`, `API_TOKEN`) and blank them everywhere |
 | `dimensions` | `['priority','severity','feature','owner']` | Which `meta()` keys get a tab in the Breakdown chart and a dropdown filter on the Tests page. Add your own key, e.g. `'team'`, to get a chart for it |
 | `dimensionOrder` | P0…P4, blocker…trivial | The order values appear in those charts and filters. Only needed for your own values, e.g. `{ severity: ['high','medium','low'] }` |
 | `widgets` | all on | Hide cards: `{ tags: false, timeline: false, ... }`. Failure clusters and the Trend chart are always shown |

package/dist/mask.d.ts

@@ -1,7 +1,14 @@
-export declare function makeMasker(extraKeys?: string[]): {
+export interface MaskerOptions {
+    /** Literal values to blank wherever they appear, keyed or not. */
+    knownValues?: string[];
+    /** Learn the values of PASSWORD / API_TOKEN / *_SECRET environment variables (default true). */
+    fromEnv?: boolean;
+}
+export declare function makeMasker(extraKeys?: string[], opts?: MaskerOptions): {
     mask: (v: unknown, key?: string) => unknown;
     maskStr: (input: string) => string;
     isSensitive: (k: string) => boolean;
+    learn: (value: unknown, minLength?: number) => void;
 };
 export declare function parseCsv(text: string): {
     columns: string[];

package/dist/mask.js

@@ -18,24 +18,93 @@ const VALUE_PATTERNS = [
     /\bnpm_[A-Za-z0-9]{30,}\b/g, // npm
     /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/g, // SendGrid
 ];
+/** 13 to 19 digits, spaces or dashes between groups allowed; masked only when the Luhn check passes. */
+const CARD_NUMBER = /(?<![\w.-])\d(?:[ -]?\d){12,18}(?![\w.-])/g;
+const luhn = (s) => { let sum = 0, dbl = false, digits = 0; for (let i = s.length - 1; i >= 0; i--) {
+    const c = s.charCodeAt(i);
+    if (c < 48 || c > 57)
+        continue;
+    let d = c - 48;
+    digits++;
+    if (dbl) {
+        d *= 2;
+        if (d > 9)
+            d -= 9;
+    }
+    sum += d;
+    dbl = !dbl;
+} return digits >= 13 && sum % 10 === 0; };
+/** Auth schemes and placeholders that follow a sensitive key but are not the secret. */
+const NOT_A_VALUE = new Set(['bearer', 'basic', 'digest', 'token', 'undefined', 'redacted', 'hidden', 'secret', 'password']);
 /** Words after "password is ..." that are plainly not a secret. */
 const NOT_A_SECRET = new Set(['valid', 'invalid', 'visible', 'hidden', 'required', 'optional', 'missing', 'empty', 'null', 'undefined', 'none',
     'correct', 'incorrect', 'wrong', 'right', 'expired', 'set', 'unset', 'not', 'present', 'absent', 'ok', 'true', 'false', 'masked', 'blank',
     'too', 'the', 'a', 'an', 'same', 'different', 'changed', 'unchanged', 'shown', 'displayed', 'accepted', 'rejected', 'weak', 'strong']);
 const esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-function makeMasker(extraKeys = []) {
+function makeMasker(extraKeys = [], opts = {}) {
     const keys = [...DEFAULT_KEYS, ...extraKeys.map(k => k.toLowerCase())];
     const isSensitive = (k) => { const l = k.toLowerCase(); return keys.some(s => l === s || l.includes(s)); };
+    // ---- values already known to be secrets ----
+    // Every value the key patterns have masked, the values under sensitive keys in data blocks and API
+    // calls, `maskValues`, and sensitive-looking environment variables. Once known, a value is blanked
+    // wherever it shows up later, keyed or not: "Logging in as admin / s3cret" is masked because
+    // "password=s3cret" (or a PASSWORD env var) came first.
+    const learned = new Set();
+    let learnedRe = null, learnedDirty = false;
+    const MAX_LEARNED = 500;
+    const learn = (value, minLength = 4) => {
+        if (typeof value !== 'string')
+            return;
+        let v = value.trim();
+        if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'")))
+            v = v.slice(1, -1);
+        if (v.length < minLength || v.includes('***') || !/[A-Za-z0-9]/.test(v) || learned.size >= MAX_LEARNED)
+            return;
+        const word = v.toLowerCase().replace(/[^a-z0-9]/g, '');
+        if (NOT_A_SECRET.has(word) || NOT_A_VALUE.has(word))
+            return;
+        if (!learned.has(v)) {
+            learned.add(v);
+            learnedDirty = true;
+        }
+    };
+    const learnedPattern = () => {
+        if (!learnedDirty)
+            return learnedRe;
+        const vals = [...learned].sort((a, b) => b.length - a.length); // longest first
+        learnedRe = vals.length ? new RegExp(vals.map(v => /^[A-Za-z0-9_]+$/.test(v) ? `(?<![A-Za-z0-9_])${esc(v)}(?![A-Za-z0-9_])` : esc(v)).join('|'), 'g') : null;
+        learnedDirty = false;
+        return learnedRe;
+    };
+    for (const v of opts.knownValues ?? [])
+        learn(v, 4);
+    if (opts.fromEnv !== false) {
+        // PASSWORD=…, API_TOKEN=…, OAUTH_CLIENT_SECRET=… in the environment: the values a CI job injects are the
+        // ones that end up in log lines. Short values are skipped so a plain word is not blanked everywhere.
+        try {
+            for (const [k, v] of Object.entries(process.env))
+                if (isSensitive(k))
+                    learn(v, 6);
+        }
+        catch { /* no env access */ }
+    }
     // Key names as they appear in free text: password, X-Api-Key, access_token, userPassword, "password", db.password...
     // `auth`, `otp`, `pin`... are matched as whole words only, so "author" or "pinned" stay untouched.
-    const compound = ['password', 'passwd', 'pwd', 'passcode', 'secret', 'token', 'api[_-]?key', 'cookie', 'credentials?', 'private[_-]?key', 'access[_-]?key', 'session[_-]?id', ...extraKeys.map(esc)];
-    const exact = ['authorization', 'auth', 'otp', 'pin', 'cvv', 'ssn'];
-    const KEY = `(?:[\\w.-]*?(?:${compound.join('|')})[\\w-]*|${exact.join('|')})`;
+    const compound = ['password', 'passwort', 'passwd', 'pwd', 'passcode', 'secret', 'token', 'api[ _-]?key', 'cookie', 'credentials?', 'private[ _-]?key', 'access[ _-]?key', 'session[ _-]?id', '(?<![A-Za-z])auth(?![A-Za-z])', ...extraKeys.map(esc)];
+    const exact = ['authorization', 'pass', 'pw', 'otp', 'pin', 'cvv', 'ssn'];
+    const KEY = `(?:[\\w.-]*?(?:${compound.join('|')})[\\w.-]*|${exact.join('|')})`;
     // key = value | key: value | "key": "value" | key => value | key -> value   (value runs to a delimiter; a closing quote stays)
     const KV = new RegExp(`(["']?)\\b(${KEY})\\b(["']?)(\\s*(?:=>|->|[=:])\\s*)(["']?)([^"'\\s&;,}\\]\\)]+)`, 'gi');
     // password is S3cret | token was abc | password 'S3cret' | with password S3cret@123 (only when the value looks like a secret)
-    const SPOKEN_KEYS = ['password', 'passwd', 'pwd', 'passcode', 'secret', 'token', 'api[ _-]?key', 'access[ _-]?key', 'otp', 'pin', 'cvv', ...extraKeys.map(esc)];
-    const SPOKEN = new RegExp(`\\b(${SPOKEN_KEYS.join('|')})(s?\\b\\s+(?:is|was|of|as)?\\s*['"]?)([^\\s'",;]+)`, 'gi');
+    const SPOKEN_KEYS = ['password', 'passwort', 'passwd', 'pwd', 'pass', 'passcode', 'secret', 'token', 'api[ _-]?key', 'access[ _-]?key', 'otp', 'pin', 'cvv', ...extraKeys.map(esc)];
+    // "password is x", "password for user admin is x", "token: x", "the token is: x", "with pwd x"
+    const SPOKEN = new RegExp(`\\b(${SPOKEN_KEYS.join('|')})(s?\\b(?:\\s+for\\s+(?:\\S+\\s+){1,3}?(?:[:=]|(?:is|was)\\b)\\s*|\\s*[:=]?\\s*(?:(?:is|was|of|as)\\b\\s*)?[:=]?\\s*)['"]?)((?=[A-Za-z0-9])[^\\s'",;]+)`, 'gi');
+    // user:password@host in a URL, curl -u user:password, "credentials admin:x"
+    const URL_USERINFO = /(:\/\/[^\s/:@]+:)([^\s@]+)(@)/g;
+    const CLI_USER = /((?:^|\s)(?:-u|--user|--username|--credentials?)\s+[^\s:]+:)(\S+)/g;
+    const CREDS_PAIR = /\b(credentials?|creds|login)(\s*[:=]?\s+[^\s:'"]+:)([^\s'",;]+)/gi;
+    // The value comes first: "Typed s3cret into password field", "Entered x in #password"
+    const VALUE_THEN_KEY = /([^\s'"(]+)(\s+(?:into|in|to|for|as)\s+(?:the\s+)?['"#]?[\w-]*?(?:password|passwd|pwd|secret|token|otp|pin)\b)/gi;
     const looksSecret = (v) => !/\s/.test(v) && (/\d/.test(v) && v.length >= 4 || /[^A-Za-z0-9]/.test(v) && v.length >= 6 || /[a-z][A-Z]|[A-Z][a-z].*[A-Z]/.test(v) && v.length >= 8);
     // Assertion output: when the text talks about a password/token/secret, the compared values are that secret.
     //   expect(token, 'token should match').toBe('x')  ->  Expected: "x" / Received: "tok_9f8e..."
@@ -43,23 +112,52 @@ function makeMasker(extraKeys = []) {
     const COMPARED = /\b(Expected|Received|Actual|expected|received|actual|got)(\s*[:=]\s*)(["'\u201c]?)([^"'\u201d\s]+)/g;
     const maskStr = (input) => {
         let s = input;
+        s = s.replace(CARD_NUMBER, m => luhn(m) ? '****' : m);
         for (const re of VALUE_PATTERNS)
-            s = s.replace(re, m => /^(Bearer|Basic|Digest|Token)\s/i.test(m) ? m.split(/\s+/)[0] + ' ****' : '****');
-        s = s.replace(KV, (_m, q1, key, q2, sep, q3, _value) => `${q1}${key}${q2}${sep}${q3}****`);
+            s = s.replace(re, m => {
+                if (/^(Bearer|Basic|Digest|Token)\s/i.test(m)) {
+                    const i = m.search(/\s/);
+                    learn(m.slice(i).trim());
+                    return m.slice(0, i) + ' ****';
+                }
+                learn(m);
+                return '****';
+            });
+        s = s.replace(URL_USERINFO, (_m, a, value, b) => { learn(value); return `${a}****${b}`; });
+        s = s.replace(CLI_USER, (_m, a, value) => { learn(value); return `${a}****`; });
+        s = s.replace(CREDS_PAIR, (_m, a, b, value) => { learn(value); return `${a}${b}****`; });
+        s = s.replace(KV, (_m, q1, key, q2, sep, q3, value) => { learn(value); return `${q1}${key}${q2}${sep}${q3}****`; });
         s = s.replace(SPOKEN, (m, key, between, value) => {
             const word = value.toLowerCase().replace(/[^a-z0-9]/g, '');
-            if (NOT_A_SECRET.has(word) || word === '****' || value === '****')
+            if (NOT_A_SECRET.has(word) || value.includes('*'))
                 return m;
-            const explicit = /\b(is|was|of|as)\b|['"]$/.test(between);
-            return explicit || looksSecret(value) ? `${key}${between}****` : m;
+            const explicit = /\b(is|was|of|as)\b|['"]$|[:=]\s*$/.test(between);
+            if (explicit || looksSecret(value)) {
+                learn(value);
+                return `${key}${between}****`;
+            }
+            return m;
+        });
+        s = s.replace(VALUE_THEN_KEY, (m, value, rest) => {
+            const word = value.toLowerCase().replace(/[^a-z0-9]/g, '');
+            if (NOT_A_SECRET.has(word) || value.includes('*') || !looksSecret(value))
+                return m;
+            learn(value);
+            return `****${rest}`;
         });
         if (MENTIONS_SECRET.test(s))
-            s = s.replace(COMPARED, (m, label, sep, q, value) => looksSecret(value) ? `${label}${sep}${q}****` : m);
+            s = s.replace(COMPARED, (m, label, sep, q, value) => { if (!looksSecret(value))
+                return m; learn(value); return `${label}${sep}${q}****`; });
+        const known = learnedPattern();
+        if (known)
+            s = s.replace(known, '****');
         return s;
     };
     const mask = (v, key = '') => {
-        if (key && isSensitive(key))
+        if (key && isSensitive(key)) {
+            learn(v);
             return '****';
+        }
         if (typeof v === 'string')
             return maskStr(v);
         if (Array.isArray(v))
@@ -72,7 +170,7 @@ function makeMasker(extraKeys = []) {
         }
         return v;
     };
-    return { mask, maskStr, isSensitive };
+    return { mask, maskStr, isSensitive, learn };
 }
 function parseCsv(text) {
     const lines = text.replace(/\r/g, '').split('\n').filter(l => l.trim());

package/dist/reporter.js

@@ -57,7 +57,7 @@ class ReportingLabsReporter {
         this.globalErrors = [];
         this.globalOutput = [];
         this.options = options;
-        this.masker = (0, mask_1.makeMasker)(options.maskKeys ?? []);
+        this.masker = (0, mask_1.makeMasker)(options.maskKeys ?? [], { knownValues: options.maskValues ?? [], fromEnv: options.maskFromEnv !== false });
     }
     printsToStdio() { return false; }
     /** Errors outside tests: a spec that throws at load, global setup, a crashed worker. */
@@ -317,6 +317,7 @@ class ReportingLabsReporter {
         return rows;
     }
     toDataBlock(name, raw) {
+        name = this.masker.maskStr(String(name)); // a block name can carry a secret too
         let v;
         try {
             v = JSON.parse(raw);
@@ -326,7 +327,10 @@ class ReportingLabsReporter {
         }
         if (v && typeof v === 'object' && typeof v.csv === 'string' && Object.keys(v).length === 1) {
             const { columns, rows } = (0, mask_1.parseCsv)(v.csv);
-            const masked = rows.map(r => r.map((c, i) => this.masker.isSensitive(columns[i] ?? '') ? '****' : this.masker.maskStr(c)));
+            const masked = rows.map(r => r.map((c, i) => { if (this.masker.isSensitive(columns[i] ?? '')) {
+                this.masker.learn(c);
+                return '****';
+            } return this.masker.maskStr(c); }));
             return { name, kind: 'table', columns, rows: masked };
         }
         v = this.masker.mask(v);

package/dist/types.d.ts

@@ -87,6 +87,10 @@ export interface ReportingLabsOptions {
     links?: Record<string, string | LinkTemplate>;
     /** Keys (case-insensitive substrings) whose values are masked in test data and API panels. */
     maskKeys?: string[];
+    /** Literal values to blank wherever they appear, keyed or not (the test password, a token). Pass the real ones from CI: process.env.PASSWORD. */
+    maskValues?: string[];
+    /** Learn the values of PASSWORD / API_TOKEN / *_SECRET environment variables and blank them everywhere (default true). */
+    maskFromEnv?: boolean;
     /** Keep a rolling run history next to the report and draw a trend chart. Per-test outcomes are stored too, which powers new-vs-known failures, flaky history and duration regressions. */
     history?: {
         enabled?: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "reporting-labs",
-  "version": "0.6.6",
+  "version": "0.6.7",
   "description": "reportingLabs – beautiful, customizable single-file HTML test reports. One line of config. Playwright adapter included, more runners on the way.",
   "keywords": [
     "test-report",