securenow 5.4.0 → 5.6.0

package/cli.js

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
 'use strict';
 
 const ui = require('./cli/ui');

package/nextjs.js

@@ -5,18 +5,36 @@
  * 
  * Usage in Next.js app:
  * 
- * 1. Create instrumentation.ts (or .js) in your project root:
+ * 1. Add serverExternalPackages to next.config.js (REQUIRED to avoid webpack bundling issues):
+ * 
+ *    const nextConfig = {
+ *      serverExternalPackages: [
+ *        "securenow",
+ *        "@opentelemetry/sdk-node",
+ *        "@opentelemetry/auto-instrumentations-node",
+ *        "@opentelemetry/instrumentation-http",
+ *        "@opentelemetry/exporter-trace-otlp-http",
+ *        "@opentelemetry/exporter-logs-otlp-http",
+ *        "@opentelemetry/sdk-logs",
+ *        "@opentelemetry/instrumentation",
+ *        "@opentelemetry/resources",
+ *        "@opentelemetry/semantic-conventions",
+ *        "@opentelemetry/api",
+ *        "@opentelemetry/api-logs",
+ *        "@vercel/otel",
+ *      ],
+ *    };
+ * 
+ * 2. Create instrumentation.ts (or .js) in your project root:
  * 
  *    import { registerSecureNow } from 'securenow/nextjs';
  *    export function register() {
  *      registerSecureNow();
  *    }
  * 
- * 2. Set environment variables:
+ * 3. Set environment variables:
  *    SECURENOW_APPID=my-nextjs-app
  *    SECURENOW_INSTANCE=http://your-otlp-backend:4318
- * 
- * That's it! 🎉 No webpack warnings!
  */
 
 const { v4: uuidv4 } = require('uuid');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "5.4.0",
+  "version": "5.6.0",
   "description": "OpenTelemetry instrumentation for Node.js and Next.js - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
   "main": "register.js",
@@ -64,6 +64,7 @@
       "default": "./nextjs-wrapper.js"
     },
     "./nextjs-webpack-config": "./nextjs-webpack-config.js",
+    "./package.json": "./package.json",
     "./register-vite": "./register-vite.js",
     "./web-vite": {
       "import": "./web-vite.mjs",
@@ -105,7 +106,7 @@
     "@opentelemetry/instrumentation": "0.47.0",
     "@opentelemetry/instrumentation-document-load": "0.47.0",
     "@opentelemetry/instrumentation-fetch": "0.47.0",
-    "@opentelemetry/instrumentation-http": "^0.208.0",
+    "@opentelemetry/instrumentation-http": "0.47.0",
     "@opentelemetry/instrumentation-user-interaction": "0.47.0",
     "@opentelemetry/instrumentation-xml-http-request": "0.47.0",
     "@opentelemetry/resources": "1.20.0",

package/tracing.d.ts

@@ -178,5 +178,6 @@ export const loggerProvider: LoggerProvider | null;
  * - SECURENOW_DISABLE_INSTRUMENTATIONS=pkg1,pkg2
  * - OTEL_LOG_LEVEL=info|debug
  * - SECURENOW_TEST_SPAN=1
+ * - SECURENOW_TRUSTED_PROXIES=ip1,ip2       # Additional trusted proxy IPs for X-Forwarded-For
  * - OTEL_EXPORTER_OTLP_LOGS_ENDPOINT=...    # Override logs endpoint
  */

package/tracing.js

@@ -1,7 +1,10 @@
 'use strict';
 
 /**
- * Preload with: NODE_OPTIONS="-r securenow/register"
+ * Preload with: node --require securenow/register app.js
+ *
+ * For ESM apps ("type": "module" in package.json), you MUST also add the ESM loader hook:
+ *   node --import @opentelemetry/instrumentation/hook.mjs --require securenow/register app.js
  *
  * Env:
  *   SECURENOW_APPID=logical-name              # or OTEL_SERVICE_NAME=logical-name
@@ -97,6 +100,27 @@ function redactGraphQLQuery(query, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
   return redacted;
 }
 
+// -------- ESM detection --------
+(() => {
+  try {
+    const fs = require('fs');
+    const path = require('path');
+    const pkgPath = path.resolve(process.cwd(), 'package.json');
+    if (fs.existsSync(pkgPath)) {
+      const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+      if (pkg.type === 'module') {
+        const execArgv = process.execArgv.join(' ');
+        const hasEsmHook = execArgv.includes('hook.mjs') || execArgv.includes('import-in-the-middle');
+        if (!hasEsmHook) {
+          console.warn('[securenow] ⚠️  ESM app detected ("type": "module") but no ESM loader hook found.');
+          console.warn('[securenow]    Instrumentations will NOT work without the ESM hook.');
+          console.warn('[securenow]    Fix: node --import @opentelemetry/instrumentation/hook.mjs --require securenow/register app.js');
+        }
+      }
+    }
+  } catch (_) {}
+})();
+
 // -------- diagnostics --------
 (() => {
   const L = (env('OTEL_LOG_LEVEL') || '').toLowerCase();
@@ -164,11 +188,74 @@ const maxBodySize = parseInt(env('SECURENOW_MAX_BODY_SIZE') || '10240'); // 10KB
 const customSensitiveFields = (env('SECURENOW_SENSITIVE_FIELDS') || '').split(',').map(s => s.trim()).filter(Boolean);
 const allSensitiveFields = [...DEFAULT_SENSITIVE_FIELDS, ...customSensitiveFields];
 
+// -------- Trusted proxy IP resolution --------
+// Only trust X-Forwarded-For / X-Real-IP when the direct connection comes from
+// a known proxy (loopback, private RFC-1918/RFC-4193, or an explicit allowlist).
+// This prevents end-users from spoofing their IP via custom headers.
+const os = require('os');
+const LOOPBACK_RE = /^(127\.|::1$|::ffff:127\.)/;
+const PRIVATE_IP_RE = /^(127\.|::1|::ffff:127\.|10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|fc|fd)/;
+const trustedProxyCsv = (env('SECURENOW_TRUSTED_PROXIES') || '').trim();
+const trustedProxySet = trustedProxyCsv ? new Set(trustedProxyCsv.split(',').map(s => s.trim()).filter(Boolean)) : null;
+
+// Resolve the host's actual network IP once at startup (used when socket is loopback)
+let _hostIp = null;
+function getHostIp() {
+  if (_hostIp !== null) return _hostIp;
+  try {
+    const ifaces = os.networkInterfaces();
+    for (const name of Object.keys(ifaces)) {
+      for (const iface of ifaces[name]) {
+        if (!iface.internal && iface.family === 'IPv4') { _hostIp = iface.address; return _hostIp; }
+      }
+    }
+  } catch (_) {}
+  _hostIp = '';
+  return _hostIp;
+}
+
+function isFromTrustedProxy(socketIp) {
+  if (!socketIp) return false;
+  const normalized = socketIp.replace(/^::ffff:/, '');
+  if (trustedProxySet && trustedProxySet.has(normalized)) return true;
+  return PRIVATE_IP_RE.test(socketIp);
+}
+
+function resolveClientIp(request) {
+  const socketIp = request.socket?.remoteAddress || '';
+  if (!isFromTrustedProxy(socketIp)) return socketIp;
+
+  // Connection is from a trusted proxy — read the leftmost untrusted IP
+  const fwd = request.headers['x-forwarded-for'];
+  if (fwd) {
+    const chain = String(fwd).split(',').map(s => s.trim()).filter(Boolean);
+    for (let i = chain.length - 1; i >= 0; i--) {
+      if (!isFromTrustedProxy(chain[i])) return chain[i];
+    }
+    return chain[0] || socketIp;
+  }
+  const headerIp = request.headers['x-real-ip'];
+  if (headerIp) return headerIp;
+
+  // Loopback means the client is on this machine — use the host's network IP
+  // so traces are attributed to the actual machine, not a useless ::1 / 127.0.0.1
+  if (LOOPBACK_RE.test(socketIp)) {
+    const hostIp = getHostIp();
+    if (hostIp) return hostIp;
+  }
+  return socketIp;
+}
+
 // Configure HTTP instrumentation with body capture
 const { HttpInstrumentation } = require('@opentelemetry/instrumentation-http');
 const httpInstrumentation = new HttpInstrumentation({
   requestHook: (span, request) => {
     try {
+      const clientIp = resolveClientIp(request);
+      if (clientIp) {
+        span.setAttribute('http.client_ip', clientIp);
+      }
+
       if (captureBody && request.method && ['POST', 'PUT', 'PATCH'].includes(request.method)) {
         const contentType = request.headers['content-type'] || '';
         
@@ -269,6 +356,26 @@ if (loggingEnabled) {
     resource: sharedResource,
   });
   loggerProvider.addLogRecordProcessor(batchLogProcessor);
+
+  // Auto-patch console.* so every log/warn/error becomes an OTel log record
+  const _logger = loggerProvider.getLogger('console', '1.0.0');
+  const _orig = { log: console.log, info: console.info, warn: console.warn, error: console.error, debug: console.debug };
+  const SEV = { DEBUG: 5, INFO: 9, WARN: 13, ERROR: 17 };
+  function _emit(sn, st, args) {
+    try {
+      _logger.emit({
+        severityNumber: sn,
+        severityText: st,
+        body: args.map(a => (typeof a === 'object' && a !== null) ? JSON.stringify(a) : String(a)).join(' '),
+        attributes: { 'log.source': 'console', 'log.method': st.toLowerCase() },
+      });
+    } catch (_) {}
+  }
+  console.log   = function (...a) { _emit(SEV.INFO,  'INFO',  a); _orig.log.apply(console, a); };
+  console.info  = function (...a) { _emit(SEV.INFO,  'INFO',  a); _orig.info.apply(console, a); };
+  console.warn  = function (...a) { _emit(SEV.WARN,  'WARN',  a); _orig.warn.apply(console, a); };
+  console.error = function (...a) { _emit(SEV.ERROR, 'ERROR', a); _orig.error.apply(console, a); };
+  console.debug = function (...a) { _emit(SEV.DEBUG, 'DEBUG', a); _orig.debug.apply(console, a); };
 }
 
 // -------- SDK --------