securenow 8.11.1 → 8.11.3

package/nuxt-server-plugin.mjs

@@ -42,14 +42,18 @@ function createResource(attributes) {
   throw new Error('Unsupported @opentelemetry/resources version');
 }
 
+const { OTP_SENSITIVE_FIELDS, matchesSensitiveField, redactOtpQuery, withOtpRedactionExporter, redactOtpGraphQL } = nodeRequire('./otp-redaction');
+
 // Default sensitive fields to redact from request bodies.
-// Matched substring-wise against lowercased keys (see redactSensitiveData),
+// OTP/code aliases use exact normalized matching; other fields are matched
+// substring-wise against lowercased keys (see redactSensitiveData),
 // so e.g. 'card' also catches 'creditCard' and 'account' also catches
 // 'accountNumber'. Over-redaction here is intentional: a falsely-redacted
 // telemetry value is always safer than a leaked secret. Entries are kept
 // specific enough to avoid nuking broad benign keys (e.g. we use
 // 'firstname'/'lastname'/'fullname', never bare 'name').
 const DEFAULT_SENSITIVE_FIELDS = [
+  ...OTP_SENSITIVE_FIELDS,
   // credentials / auth
   'password', 'passwd', 'pwd', 'secret', 'token', 'api_key', 'apikey',
   'access_token', 'auth', 'authorization', 'bearer', 'credentials',
@@ -107,7 +111,10 @@ function luhnValid(digits) {
  */
 function redactSensitiveValue(value) {
   if (typeof value !== 'string' || value.length === 0) return value;
-  if (value.length > MAX_VALUE_SCAN_LENGTH) return value; // bound the work
+  // Credential assignments in GraphQL/query strings need field-aware
+  // redaction even though a short numeric OTP has no unique value shape.
+  value = redactOtpQuery(redactOtpGraphQL(value));
+  if (value.length > MAX_VALUE_SCAN_LENGTH) return value; // bound shape scans
   let out = value;
   for (const r of VALUE_REDACTORS) {
     r.re.lastIndex = 0;
@@ -128,8 +135,7 @@ function redactSensitiveData(obj, fields = DEFAULT_SENSITIVE_FIELDS) {
   if (!obj || typeof obj !== 'object') return obj;
   const redacted = Array.isArray(obj) ? [...obj] : { ...obj };
   for (const key of Object.keys(redacted)) {
-    const lower = key.toLowerCase();
-    if (fields.some((f) => lower.includes(f.toLowerCase()))) {
+    if (matchesSensitiveField(key, fields)) {
       redacted[key] = '[REDACTED]';
     } else if (typeof redacted[key] === 'object' && redacted[key] !== null) {
       redacted[key] = redactSensitiveData(redacted[key], fields);
@@ -299,7 +305,7 @@ export default defineNitroPlugin(async (nitroApp) => {
   }));
 
   // ── Trace exporter + SDK ──
-  const traceExporter = new OTLPTraceExporter({ url: tracesUrl, headers });
+  const traceExporter = withOtpRedactionExporter(new OTLPTraceExporter({ url: tracesUrl, headers }));
 
   const sdk = new NodeSDK({
     ...nodeSdkTelemetryOptions,

package/nuxt.mjs

@@ -1,75 +1,75 @@
-/**
- * SecureNow Nuxt 3 Module
- *
- * Usage in nuxt.config.ts:
- *
- *   export default defineNuxtConfig({
- *     modules: ['securenow/nuxt'],
- *     securenow: {            // optional overrides
- *       serviceName: 'my-nuxt-app',
- *     },
- *   });
- *
- * Environment variables (same as all SecureNow integrations):
+/**
+ * SecureNow Nuxt 3 Module
+ *
+ * Usage in nuxt.config.ts:
+ *
+ *   export default defineNuxtConfig({
+ *     modules: ['securenow/nuxt'],
+ *     securenow: {            // optional overrides
+ *       serviceName: 'my-nuxt-app',
+ *     },
+ *   });
+ *
+ * Environment variables (same as all SecureNow integrations):
  *   Configuration is read from .securenow/credentials.json.
- */
-
-import { defineNuxtModule, createResolver, addServerPlugin } from '@nuxt/kit';
-
-const OTEL_EXTERNALS = [
-  'securenow',
-  '@opentelemetry/api',
-  '@opentelemetry/api-logs',
-  '@opentelemetry/sdk-node',
-  '@opentelemetry/sdk-logs',
-  '@opentelemetry/auto-instrumentations-node',
-  '@opentelemetry/instrumentation',
-  '@opentelemetry/instrumentation-http',
-  '@opentelemetry/exporter-trace-otlp-http',
-  '@opentelemetry/exporter-logs-otlp-http',
-  '@opentelemetry/resources',
-  '@opentelemetry/semantic-conventions',
-];
-
-export default defineNuxtModule({
-  meta: {
-    name: 'securenow',
-    configKey: 'securenow',
-    compatibility: { nuxt: '>=3.0.0' },
-  },
-
-  defaults: {
-    serviceName: undefined,
-    endpoint: undefined,
-    noUuid: undefined,
-    captureBody: undefined,
-    logging: undefined,
-  },
-
-  setup(options, nuxt) {
-    const { resolve } = createResolver(import.meta.url);
-
-    // ── Externalize OTel packages so Nitro doesn't bundle them ──
-    nuxt.hook('nitro:config', (nitroConfig) => {
-      nitroConfig.externals = nitroConfig.externals || {};
-      nitroConfig.externals.external = [
-        ...(nitroConfig.externals.external || []),
-        ...OTEL_EXTERNALS,
-      ];
-    });
-
-    // ── Pass module options to the server plugin via runtimeConfig ──
-    nuxt.options.runtimeConfig.securenow = {
-      serviceName: options.serviceName,
-      endpoint: options.endpoint,
-      noUuid: options.noUuid,
-      captureBody: options.captureBody,
-      logging: options.logging,
-    };
-
-    // ── Register Nitro server plugin ──
-    addServerPlugin(resolve('./nuxt-server-plugin'));
-
-    console.log('[securenow] Nuxt module loaded — server plugin registered');
-  },
-});
+ */
+
+import { defineNuxtModule, createResolver, addServerPlugin } from '@nuxt/kit';
+
+const OTEL_EXTERNALS = [
+  'securenow',
+  '@opentelemetry/api',
+  '@opentelemetry/api-logs',
+  '@opentelemetry/sdk-node',
+  '@opentelemetry/sdk-logs',
+  '@opentelemetry/auto-instrumentations-node',
+  '@opentelemetry/instrumentation',
+  '@opentelemetry/instrumentation-http',
+  '@opentelemetry/exporter-trace-otlp-http',
+  '@opentelemetry/exporter-logs-otlp-http',
+  '@opentelemetry/resources',
+  '@opentelemetry/semantic-conventions',
+];
+
+export default defineNuxtModule({
+  meta: {
+    name: 'securenow',
+    configKey: 'securenow',
+    compatibility: { nuxt: '>=3.0.0' },
+  },
+
+  defaults: {
+    serviceName: undefined,
+    endpoint: undefined,
+    noUuid: undefined,
+    captureBody: undefined,
+    logging: undefined,
+  },
+
+  setup(options, nuxt) {
+    const { resolve } = createResolver(import.meta.url);
+
+    // ── Externalize OTel packages so Nitro doesn't bundle them ──
+    nuxt.hook('nitro:config', (nitroConfig) => {
+      nitroConfig.externals = nitroConfig.externals || {};
+      nitroConfig.externals.external = [
+        ...(nitroConfig.externals.external || []),
+        ...OTEL_EXTERNALS,
+      ];
+    });
+
+    // ── Pass module options to the server plugin via runtimeConfig ──
+    nuxt.options.runtimeConfig.securenow = {
+      serviceName: options.serviceName,
+      endpoint: options.endpoint,
+      noUuid: options.noUuid,
+      captureBody: options.captureBody,
+      logging: options.logging,
+    };
+
+    // ── Register Nitro server plugin ──
+    addServerPlugin(resolve('./nuxt-server-plugin'));
+
+    console.log('[securenow] Nuxt module loaded — server plugin registered');
+  },
+});

package/otp-redaction.js

@@ -0,0 +1,99 @@
+'use strict';
+
+// Match credential names exactly after case/separator normalization. Treating
+// "code" as a substring would also hide status_code/error_code forensic data.
+const OTP_SENSITIVE_FIELDS = Object.freeze([
+  'code', 'otp', 'otpCode', 'oneTimeCode', 'oneTimePassword', 'passcode',
+  'verificationCode', 'confirmationCode', 'emailCode', 'smsCode', 'loginCode',
+  'signInCode', 'authCode', 'authenticationCode', 'mfaCode', 'totpCode', '2faCode',
+  'securityCode', 'recoveryCode', 'backupCode',
+]);
+const canonical = (key) => String(key).replace(/[^a-z0-9]/gi, '').toLowerCase();
+const OTP_NAMES = new Set(OTP_SENSITIVE_FIELDS.map(canonical));
+
+function isOtpCodeField(key) {
+  let name = String(key);
+  // Support individually captured header attributes and nested form keys.
+  name = name.replace(/^http\.(?:request|response)\.header[s]?\./i, '');
+  const nested = name.match(/(?:\[|\.)([^\[\].]+)\]?$/);
+  if (nested) name = nested[1];
+  name = name.replace(/^x[-_]/i, '');
+  return OTP_NAMES.has(canonical(name));
+}
+
+function matchesSensitiveField(key, fields) {
+  if (isOtpCodeField(key)) return true;
+  const lower = String(key).toLowerCase();
+  return fields.some((field) => (canonical(field) === 'otp' || !isOtpCodeField(field)) && lower.includes(String(field).toLowerCase()));
+}
+
+function redactOtpData(value) {
+  if (typeof value === 'string') return redactOtpQuery(redactOtpGraphQL(value));
+  if (!value || typeof value !== 'object') return value;
+  const out = Array.isArray(value) ? [...value] : { ...value };
+  for (const key of Object.keys(out)) {
+    out[key] = isOtpCodeField(key) ? '[REDACTED]' : redactOtpData(out[key]);
+  }
+  return out;
+}
+
+function redactOtpGraphQL(query) {
+  return query.replace(/\b([A-Za-z_][\w]*)(\s*:\s*)("(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\s,})]+)/g,
+    (match, key, separator) => isOtpCodeField(key) ? `${key}${separator}"[REDACTED]"` : match);
+}
+
+// Preserve the exact bytes of harmless query parameters, including attack
+// payloads. Also covers duplicate and percent-encoded credential keys.
+function redactOtpQuery(value, marker = 'REDACTED') {
+  if (typeof value !== 'string' || !value.includes('?')) return value;
+  return value.replace(/([?&])([^?&#=\s]+)=([^&#\s]*)/g, (part, separator, rawKey) => {
+    let key = rawKey;
+    try { key = decodeURIComponent(rawKey.replace(/\+/g, ' ')); } catch (_) {}
+    return isOtpCodeField(key) ? `${separator}${rawKey}=${marker}` : part;
+  });
+}
+
+function redactOtpAttributes(attributes = {}) {
+  const out = { ...attributes };
+  for (const [key, value] of Object.entries(out)) {
+    if (isOtpCodeField(key)) {
+      out[key] = '[REDACTED]';
+    } else if (typeof value === 'string') {
+      if (/^http\.(request|response)\.(body|headers|multipart\.fields)$/.test(key)) {
+        try {
+          // Scrub each string value before serializing. Running URL matching on
+          // the serialized JSON would consume closing quotes after query values.
+          out[key] = JSON.stringify(redactOtpData(JSON.parse(value)));
+          continue;
+        } catch (_) {}
+      }
+      out[key] = redactOtpQuery(out[key]);
+      // Stable URL semconv stores the query without a leading question mark.
+      if (key === 'url.query') out[key] = redactOtpQuery(`?${value}`).slice(1);
+    } else if (Array.isArray(value) && /^http\.(request|response)\.header\./.test(key)) {
+      out[key] = value.map((item) => redactOtpQuery(item));
+    }
+  }
+  return out;
+}
+
+// Export a view rather than mutating the completed span or the real request.
+// The final pass catches Next.js/Nitro/fetch attributes written after HTTP hooks.
+function withOtpRedactionExporter(exporter) {
+  return {
+    export(spans, callback) {
+      return exporter.export(spans.map((span) => Object.create(span, {
+        attributes: { value: redactOtpAttributes(span.attributes), enumerable: true },
+        name: { value: redactOtpQuery(span.name), enumerable: true },
+        events: { value: (span.events || []).map((event) => ({ ...event, attributes: redactOtpAttributes(event.attributes) })), enumerable: true },
+      })), callback);
+    },
+    shutdown: () => exporter.shutdown(),
+    forceFlush: () => typeof exporter.forceFlush === 'function' ? exporter.forceFlush() : Promise.resolve(),
+  };
+}
+
+module.exports = {
+  OTP_SENSITIVE_FIELDS, isOtpCodeField, matchesSensitiveField, redactOtpData,
+  redactOtpGraphQL, redactOtpQuery, redactOtpAttributes, withOtpRedactionExporter,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "8.11.1",
+  "version": "8.11.3",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
   "main": "register.js",
@@ -10,7 +10,7 @@
     "securenow-mcp": "mcp/server.js"
   },
   "scripts": {
-    "test": "node test-app-config.js && node test-resolve-ip.js && node test-otel-defaults.js && node test-telemetry.js && node test-legacy-semconv.js && node test-internal-thread.js && node test-package-contents.js"
+    "test": "node test-app-config.js && node test-resolve-ip.js && node test-otel-defaults.js && node test-telemetry.js && node test-legacy-semconv.js && node test-otp-redaction.js && node test-internal-thread.js && node test-package-contents.js"
   },
   "keywords": [
     "opentelemetry",
@@ -161,6 +161,7 @@
     "otel-defaults.js",
     "internal-thread.js",
     "legacy-semconv.js",
+    "otp-redaction.js",
     "rate-limits.js",
     "rate-limits.d.ts",
     "firewall-only.js",

package/register.d.ts

@@ -1,11 +1,11 @@
-/**
- * SecureNow Register Module TypeScript Declarations
- * 
- * Main entry point for Node.js/Express/Fastify/NestJS applications.
- * This module is automatically loaded when using NODE_OPTIONS="-r securenow/register"
- */
-
-/**
+/**
+ * SecureNow Register Module TypeScript Declarations
+ * 
+ * Main entry point for Node.js/Express/Fastify/NestJS applications.
+ * This module is automatically loaded when using NODE_OPTIONS="-r securenow/register"
+ */
+
+/**
  * Configuration:
  *
  * Local development reads .securenow/credentials.json. Run
@@ -17,28 +17,28 @@
  * generated JSON to .securenow/credentials.json in the running app.
  *
  * Legacy env vars are fallback-only for existing installs.
- */
-
-// This module has side effects (initializes OpenTelemetry)
-// It's typically used via NODE_OPTIONS, not imported directly
-export {};
-
-/**
- * @example
- * ```bash
- * # Using with Node.js preload
- * NODE_OPTIONS="-r securenow/register" node app.js
- * ```
- * 
- * @example
- * ```bash
- * # Using with PM2
- * pm2 start app.js --node-args="-r securenow/register"
- * ```
- * 
- * @example
- * ```javascript
- * // ecosystem.config.js
+ */
+
+// This module has side effects (initializes OpenTelemetry)
+// It's typically used via NODE_OPTIONS, not imported directly
+export {};
+
+/**
+ * @example
+ * ```bash
+ * # Using with Node.js preload
+ * NODE_OPTIONS="-r securenow/register" node app.js
+ * ```
+ * 
+ * @example
+ * ```bash
+ * # Using with PM2
+ * pm2 start app.js --node-args="-r securenow/register"
+ * ```
+ * 
+ * @example
+ * ```javascript
+ * // ecosystem.config.js
  * module.exports = {
  *   apps: [{
  *     name: 'my-app',
@@ -47,15 +47,15 @@ export {};
  *     // Local and production use .securenow/credentials.json.
  *   }]
  * };
- * ```
- * 
- * @example
- * ```typescript
- * // Explicit import (optional, mainly for side effects)
- * import 'securenow/register';
- * 
- * import express from 'express';
- * const app = express();
- * // Your app code...
- * ```
- */
+ * ```
+ * 
+ * @example
+ * ```typescript
+ * // Explicit import (optional, mainly for side effects)
+ * import 'securenow/register';
+ * 
+ * import express from 'express';
+ * const app = express();
+ * // Your app code...
+ * ```
+ */

package/register.js

@@ -1,44 +1,44 @@
-// securenow/register.js — the only preload customers need:
-//   node --require securenow/register app.js
-//
-// For ESM apps ("type": "module"), this file auto-registers the
-// OpenTelemetry ESM loader hook via module.register() (Node >=20.6).
-// On older Node versions it falls back to a warning.
-'use strict';
-
-// Do nothing inside Node's internal ESM-hooks thread (see internal-thread.js).
-if (require('./internal-thread').inInternalThread()) return;
-
-// 1. Auto-register the ESM loader hook so customers never need --import
-(() => {
-  try {
-    const fs = require('fs');
-    const path = require('path');
-    const pkgPath = path.resolve(process.cwd(), 'package.json');
-    if (!fs.existsSync(pkgPath)) return;
-
-    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8').replace(/^\uFEFF/, ''));
-    if (pkg.type !== 'module') return;
-
-    // Already registered via --import?
-    const execArgv = process.execArgv.join(' ');
-    if (execArgv.includes('hook.mjs') || execArgv.includes('import-in-the-middle')) return;
-
-    // Node >=20.6 exposes module.register() for programmatic ESM hooks
-    const mod = require('node:module');
-    if (typeof mod.register !== 'function') {
-      console.warn('[securenow] ESM app detected but Node %s lacks module.register().', process.version);
-      console.warn('[securenow]    Upgrade to Node >=20.6 or add: --import @opentelemetry/instrumentation/hook.mjs');
-      return;
-    }
-
-    const { pathToFileURL } = require('node:url');
-    mod.register('@opentelemetry/instrumentation/hook.mjs', pathToFileURL(__filename));
-    console.log('[securenow] ESM loader hook auto-registered (module.register)');
-  } catch (_) {
-    // Non-fatal — tracing.js will show its own ESM warning if the hook is missing
-  }
-})();
-
-// 2. Run the OTel SDK setup
-require('./tracing');
+// securenow/register.js — the only preload customers need:
+//   node --require securenow/register app.js
+//
+// For ESM apps ("type": "module"), this file auto-registers the
+// OpenTelemetry ESM loader hook via module.register() (Node >=20.6).
+// On older Node versions it falls back to a warning.
+'use strict';
+
+// Do nothing inside Node's internal ESM-hooks thread (see internal-thread.js).
+if (require('./internal-thread').inInternalThread()) return;
+
+// 1. Auto-register the ESM loader hook so customers never need --import
+(() => {
+  try {
+    const fs = require('fs');
+    const path = require('path');
+    const pkgPath = path.resolve(process.cwd(), 'package.json');
+    if (!fs.existsSync(pkgPath)) return;
+
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8').replace(/^\uFEFF/, ''));
+    if (pkg.type !== 'module') return;
+
+    // Already registered via --import?
+    const execArgv = process.execArgv.join(' ');
+    if (execArgv.includes('hook.mjs') || execArgv.includes('import-in-the-middle')) return;
+
+    // Node >=20.6 exposes module.register() for programmatic ESM hooks
+    const mod = require('node:module');
+    if (typeof mod.register !== 'function') {
+      console.warn('[securenow] ESM app detected but Node %s lacks module.register().', process.version);
+      console.warn('[securenow]    Upgrade to Node >=20.6 or add: --import @opentelemetry/instrumentation/hook.mjs');
+      return;
+    }
+
+    const { pathToFileURL } = require('node:url');
+    mod.register('@opentelemetry/instrumentation/hook.mjs', pathToFileURL(__filename));
+    console.log('[securenow] ESM loader hook auto-registered (module.register)');
+  } catch (_) {
+    // Non-fatal — tracing.js will show its own ESM warning if the hook is missing
+  }
+})();
+
+// 2. Run the OTel SDK setup
+require('./tracing');

package/resolve-ip.js

@@ -1,5 +1,5 @@
-'use strict';
-
+'use strict';
+
 const os = require('os');
 const appConfig = require('./app-config');
 
@@ -121,20 +121,20 @@ function resolveClientIpWithDetails(request) {
 
   return details;
 }
-
-/**
- * Resolve the real client IP from an HTTP request, respecting trusted proxies.
- * Reads X-Forwarded-For / X-Real-IP only when the direct connection comes
- * from a private/trusted proxy IP. Prevents client-side IP spoofing.
- */
+
+/**
+ * Resolve the real client IP from an HTTP request, respecting trusted proxies.
+ * Reads X-Forwarded-For / X-Real-IP only when the direct connection comes
+ * from a private/trusted proxy IP. Prevents client-side IP spoofing.
+ */
 function resolveClientIp(request) {
   return resolveClientIpWithDetails(request).ip || '';
 }
-
-/**
- * Resolve IP from a raw TCP socket (no HTTP headers available).
- * Normalizes IPv6-mapped IPv4 addresses.
- */
+
+/**
+ * Resolve IP from a raw TCP socket (no HTTP headers available).
+ * Normalizes IPv6-mapped IPv4 addresses.
+ */
 function resolveSocketIp(socket) {
   const raw = socket?.remoteAddress || '';
   return normalizeIp(raw);

package/telemetry-schema.json

@@ -111,12 +111,14 @@
       "userId": "attributes_string['enduser.id']",
       "sessionId": "attributes_string['session.id']",
       "ip": "attributes_string['http.client_ip']",
-      "userAgent": "attributes_string['http.user_agent']",
+      "userAgent": "attributes_string['user_agent.original']",
       "severity": "severity_text",
       "attributes.string": "attributes_string['<custom-key>']",
       "attributes.number": "attributes_number['<custom-key>']",
       "attributes.boolean": "attributes_bool['<custom-key>']"
     },
+    "reservedAttributePrefixes": ["event.", "enduser.", "session.", "http.", "service.", "securenow.", "client."],
+    "reservedAttributeNote": "Custom attribute keys with a reserved prefix are stored as attr.<key>. Events keep the sender-supplied timestamp and carry no event ID. client.asn / client.as_org are added from ip only when the instance has ASN enrichment.",
     "recommendedAuthenticationEvents": [
       "auth.login.failure",
       "auth.login.success",