securenow 8.23.0 → 8.25.0

package/nextjs.js

@@ -7,24 +7,32 @@
  * 
  * 1. Add securenow to serverExternalPackages and standalone output tracing
  *    includes in next.config.js:
- * 
+ *
  *    const nextConfig = {
  *      serverExternalPackages: ["securenow"],
  *      outputFileTracingIncludes: {
  *        "/*": ["<securenow package glob>"],
  *      },
  *    };
- * 
- * 2. Create instrumentation.ts (or .js) in your project root:
- * 
+ *
+ * 2. Create instrumentation.ts (or .js) in your project root (`npx securenow init` writes it):
+ *
  *    export async function register() {
- *      if (process.env.NEXT_RUNTIME !== "nodejs") return;
- *      const securenowNext = await import(/* webpackIgnore: true *\/ "securenow/nextjs");
- *      const registerSecureNow = securenowNext.registerSecureNow || securenowNext.default?.registerSecureNow;
- *      registerSecureNow({ captureBody: true });
- *      await import(/* webpackIgnore: true *\/ "securenow/nextjs-auto-capture");
+ *      if (process.env.NEXT_RUNTIME === "nodejs") {
+ *        try {
+ *          const securenowNext = await import("securenow/nextjs");
+ *          const registerSecureNow = securenowNext.registerSecureNow || securenowNext.default?.registerSecureNow;
+ *          registerSecureNow({ captureBody: true });
+ *          await import("securenow/nextjs-auto-capture");
+ *        } catch (error) {
+ *          console.error("[securenow] SecureNow did not start; the app is running without it:", error);
+ *        }
+ *      }
  *    }
- * 
+ *
+ *    The import stays inside the nodejs block, without webpackIgnore, so Next.js leaves it out
+ *    of the Edge build and traces securenow and its dependencies into standalone output.
+ *
  * 3. Run `npx securenow login` and `npx securenow init`.
  *    The SDK reads app identity, collector, firewall, capture, and
  *    deploymentEnvironment from .securenow/credentials.json.
@@ -34,7 +42,6 @@ const { randomUUID } = require('crypto');
 const { nodeSdkDefaultTelemetryOptions } = require('./otel-defaults');
 const appConfig = require('./app-config');
 const { resolveClientIpWithDetails } = require('./resolve-ip');
-const otelResources = require('@opentelemetry/resources');
 
 const nodeSdkTelemetryOptions = nodeSdkDefaultTelemetryOptions();
 
@@ -50,6 +57,10 @@ function requireNodeBuiltin(name) {
 }
 
 function createResource(attributes) {
+  // Required here, not at the top of the file: a bundle that lacks the OpenTelemetry packages
+  // (an incomplete standalone image) must still load this module, so the firewall starts and
+  // the app keeps serving.
+  const otelResources = require('@opentelemetry/resources');
   if (typeof otelResources.resourceFromAttributes === 'function') {
     return otelResources.resourceFromAttributes(attributes);
   }
@@ -59,158 +70,12 @@ function createResource(attributes) {
   throw new Error('Unsupported @opentelemetry/resources version');
 }
 
-const { OTP_SENSITIVE_FIELDS, isOtpCodeField, matchesSensitiveField, redactOtpGraphQL, redactOtpQuery, withOtpRedactionExporter } = require('./otp-redaction');
-
-// Default sensitive fields to redact from request bodies.
-// OTP/code aliases use exact normalized matching; other fields are matched
-// substring-wise against lowercased keys (see redactSensitiveData),
-// so e.g. 'card' also catches 'creditCard' and 'account' also catches
-// 'accountNumber'. Over-redaction here is intentional: a falsely-redacted
-// telemetry value is always safer than a leaked secret. Entries are kept
-// specific enough to avoid nuking broad benign keys (e.g. we use
-// 'firstname'/'lastname'/'fullname', never bare 'name').
-const DEFAULT_SENSITIVE_FIELDS = [
-  ...OTP_SENSITIVE_FIELDS,
-  // credentials / auth
-  'password', 'passwd', 'pwd', 'secret', 'token', 'api_key', 'apikey',
-  'access_token', 'auth', 'authorization', 'bearer', 'credentials',
-  'mysql_pwd', 'otp', 'mfa', 'totp', 'sessionid', 'session_id',
-  'cookie', 'set-cookie',
-  // financial
-  'stripeToken', 'card', 'cardnumber', 'ccv', 'cvc', 'cvv',
-  'iban', 'account', 'accountnumber', 'routing', 'sortcode', 'taxid',
-  // PII
-  'ssn', 'pin', 'email', 'e_mail', 'phone', 'mobile', 'dob', 'birthdate',
-  'firstname', 'lastname', 'fullname', 'address', 'postcode', 'zip',
-  'passport', 'license',
-];
-
-// Conservative value-shape redactors. Key-name matching misses secrets that
-// land in free-form string values (GraphQL bodies, message fields, etc.), so
-// as a second layer we scrub string VALUES that *look like* a secret/PII.
-// These are intentionally precise/bounded so they don't garble normal prose,
-// and they only ever transform captured telemetry strings (read-only) — never
-// the actual request/response stream. Compiled once at module load.
-const VALUE_REDACTORS = [
-  // JWT: three base64url segments. Anchored to the eyJ header so it won't
-  // match arbitrary dotted tokens.
-  { name: 'jwt', re: /eyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/g },
-  // Bearer/Basic auth header value embedded in a body string.
-  { name: 'bearer', re: /\b(?:Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi },
-  // Stripe-style / SecureNow live+test API keys.
-  { name: 'apikey', re: /\b(?:sk|pk|rk|snk)_(?:live|test)_[A-Za-z0-9]{8,}/g },
-  // Email addresses (bounded local/domain parts).
-  { name: 'email', re: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,24}\b/g },
-  // Credit-card-like: 13–19 digit runs that pass a Luhn check, allowing
-  // space/dash grouping. Luhn-gated to avoid clobbering ordinary long numbers.
-  { name: 'card', re: /\b(?:\d[ -]?){13,19}\b/g, luhn: true },
-];
-
-// Skip the value-shape scan on very large strings to bound per-body cost.
-const MAX_VALUE_SCAN_LENGTH = 16384;
-
-function luhnValid(digits) {
-  let sum = 0;
-  let alt = false;
-  for (let i = digits.length - 1; i >= 0; i--) {
-    let d = digits.charCodeAt(i) - 48;
-    if (d < 0 || d > 9) return false;
-    if (alt) { d *= 2; if (d > 9) d -= 9; }
-    sum += d;
-    alt = !alt;
-  }
-  return sum % 10 === 0;
-}
-
-/**
- * Redact obvious secret/PII shapes inside a captured string VALUE.
- * Returns the input unchanged when nothing matches (cheap common case).
- */
-function redactSensitiveValue(value) {
-  if (typeof value !== 'string' || value.length === 0) return value;
-  // Credential assignments in GraphQL/query strings need field-aware
-  // redaction even though a short numeric OTP has no unique value shape.
-  value = redactOtpQuery(redactOtpGraphQL(value));
-  if (value.length > MAX_VALUE_SCAN_LENGTH) return value; // bound shape scans
-  let out = value;
-  for (const r of VALUE_REDACTORS) {
-    r.re.lastIndex = 0;
-    if (r.luhn) {
-      out = out.replace(r.re, (m) => {
-        const digits = m.replace(/[ -]/g, '');
-        if (digits.length < 13 || digits.length > 19) return m;
-        return luhnValid(digits) ? '[REDACTED]' : m;
-      });
-    } else {
-      out = out.replace(r.re, '[REDACTED]');
-    }
-  }
-  return out;
-}
-
-/**
- * Redact sensitive fields from an object
- */
-function redactSensitiveData(obj, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
-  if (!obj || typeof obj !== 'object') return obj;
-
-  const redacted = Array.isArray(obj) ? [...obj] : { ...obj };
-
-  for (const key of Object.keys(redacted)) {
-
-    if (matchesSensitiveField(key, sensitiveFields)) {
-      redacted[key] = '[REDACTED]';
-    } else if (typeof redacted[key] === 'object' && redacted[key] !== null) {
-      // Recursively redact nested objects
-      redacted[key] = redactSensitiveData(redacted[key], sensitiveFields);
-    } else if (typeof redacted[key] === 'string') {
-      // Second layer: even if the key name looks benign, scrub values that
-      // *look like* a secret/PII (JWT, bearer token, API key, email, card).
-      redacted[key] = redactSensitiveValue(redacted[key]);
-    }
-  }
-
-  return redacted;
-}
-
-function escapeRegex(str) {
-  return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-
-/**
- * Redact sensitive data from GraphQL query strings
- */
-function redactGraphQLQuery(query, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
-  if (!query || typeof query !== 'string') return query;
-  
-  let redacted = query;
-  
-  // Redact sensitive fields in GraphQL arguments and variables
-  // Matches patterns like: password: "value" or password:"value" or password:'value'
-  sensitiveFields.filter(field => field === 'otp' || !isOtpCodeField(field)).forEach(field => {
-    const escaped = escapeRegex(field);
-    const patterns = [
-      new RegExp(`(${escaped}\\s*:\\s*["'])([^"']+)(["'])`, 'gi'),
-      new RegExp(`(${escaped}\\s*:\\s*)([^\\s,})\n]+)`, 'gi'),
-    ];
-    
-    patterns.forEach(pattern => {
-      redacted = redacted.replace(pattern, (match, prefix, value, suffix) => {
-        if (suffix) {
-          return `${prefix}[REDACTED]${suffix}`;
-        } else {
-          return `${prefix}[REDACTED]`;
-        }
-      });
-    });
-  });
+const { redactOtpQuery, withOtpRedactionExporter } = require('./otp-redaction');
+const { createRequestCapture } = require('./request-capture');
 
-  // Second layer: scrub secret/PII *shapes* anywhere in the (free-form) query
-  // body — catches values the key-name pass above can't see.
-  redacted = redactOtpGraphQL(redactSensitiveValue(redacted));
-
-  return redacted;
-}
+// Set once the HTTP layer has captured a request in this process: nextjs-auto-capture then
+// leaves bodies to it instead of attaching a second copy to Next.js's own span.
+const HTTP_CAPTURE_ACTIVE = Symbol.for('securenow.nextjs.httpCaptureActive');
 
 /**
  * Register SecureNow OpenTelemetry for Next.js using @vercel/otel
@@ -275,15 +140,19 @@ function registerSecureNow(options = {}) {
     const otelLogLevel = String(appConfig.configValue('otel.logLevel', '') || '').toLowerCase();
     const isDevelopmentRuntime = process.env.NODE_ENV === 'development';
 
-    console.log('[securenow] Next.js App -> service.name=%s', serviceName);
+    console.log('[securenow] Next.js App -> service.name=%s apiKey=%s credentials=%s', serviceName,
+      appConfig.resolveApiKey() ? 'set' : 'missing', appConfig.describeCredentialsSource());
     console.log('[securenow] Environment: %s', deploymentEnvironment);
 
     // -------- Body Capture Configuration --------
     // Opt-out default: set config.capture.body=false (or options.captureBody=false) to disable.
-    const captureBody = options.captureBody ?? appConfig.boolConfig('capture.body', true);
-    const maxBodySize = appConfig.numberConfig('capture.maxBodySize', 10240, 1024);
-    const customSensitiveFields = appConfig.listConfig('capture.sensitiveFields');
-    const allSensitiveFields = [...DEFAULT_SENSITIVE_FIELDS, ...customSensitiveFields];
+    const requestCapture = createRequestCapture({
+      captureBody: options.captureBody ?? appConfig.boolConfig('capture.body', true),
+      captureMultipart: appConfig.boolConfig('capture.multipart', true),
+      maxBodySize: appConfig.numberConfig('capture.maxBodySize', 10240, 1024),
+      customSensitiveFields: appConfig.listConfig('capture.sensitiveFields'),
+    });
+    const { captureBody } = requestCapture;
 
     // -------- Log environment detection --------
     if (!isVercel) {
@@ -432,11 +301,13 @@ function registerSecureNow(options = {}) {
             );
           }
 
-          // -------- Request Body NOT captured at HTTP instrumentation level --------
-          // IMPORTANT: Do NOT attempt to read request.body or listen to 'data' events
-          // Next.js manages request streams internally and reading them here causes conflicts
-          // Body capture must be done in Next.js middleware using request.clone()
-          
+          // Headers (redacted) and body, the same attributes as every other SecureNow integration.
+          // The body is observed through the request's own emit('data') while Next.js reads it:
+          // no listener is added and nothing is read on Next.js's behalf.
+          requestCapture.captureHeaders(span, request);
+          requestCapture.observeBody(span, request);
+          globalThis[HTTP_CAPTURE_ACTIVE] = true;
+
         } catch (error) {
           // Silently fail to not break the request
           if (otelLogLevel === 'debug') {
@@ -519,7 +390,10 @@ function registerSecureNow(options = {}) {
     let _crashLoggerProvider = null;
     require('./crash-capture').installCrashCapture({
       getLogger: () => (_crashLoggerProvider ? _crashLoggerProvider.getLogger('securenow.crash', '1.0.0') : null),
-      flush: () => (_crashLoggerProvider ? _crashLoggerProvider.forceFlush() : undefined),
+      flush: () => Promise.all([
+        _crashLoggerProvider ? _crashLoggerProvider.forceFlush() : undefined,
+        require('./crash-capture').flushTracerProvider(),
+      ]),
       isSdkError: (e) => _isOtlpTransientError(e) && (_looksLikeOtlpStack(e) || _looksLikeConfiguredOtlpEndpoint(e)),
       onSdkError: _reportSuppressedOtlpError,
     });
@@ -565,10 +439,16 @@ function registerSecureNow(options = {}) {
         headers
       }));
       
+      // The batch exporter NodeSDK would build from traceExporter, plus the processor that puts Next.js's
+      // route on the request's HTTP span (see next-route.js).
+      const { BatchSpanProcessor } = require('@opentelemetry/sdk-trace-base');
       const sdk = new NodeSDK({
         ...nodeSdkTelemetryOptions,
         serviceName: serviceName,
-        traceExporter: traceExporter,
+        spanProcessors: [
+          new BatchSpanProcessor(traceExporter),
+          require('./next-route').createNextRouteProcessor(),
+        ],
         instrumentations: [httpInstrumentation],
         resource: createResource({
           [SemanticResourceAttributes.SERVICE_NAME]: serviceName,
@@ -599,16 +479,21 @@ function registerSecureNow(options = {}) {
               [SemanticResourceAttributes.DEPLOYMENT_ENVIRONMENT]: deploymentEnvironment,
             }),
             // sdk-logs >= 0.220 takes a single options object ({ exporter }).
-            processors: [new BatchLogRecordProcessor({ exporter: logExporter })],
+            // Secret shapes in log lines are redacted before export (log-redaction.js).
+            processors: require('./log-redaction').logProcessors(appConfig, new BatchLogRecordProcessor({ exporter: logExporter })),
           });
           _crashLoggerProvider = loggerProvider;
 
-          // Patch console to forward logs as OTLP log records
+          // Patch console to forward logs as OTLP log records, formatted like the Node preload's
+          // (printf placeholders, JSON objects, errors with their stack).
           const logger = loggerProvider.getLogger('console', '1.0.0');
-          const SeverityNumber = { INFO: 9, WARN: 13, ERROR: 17 };
+          const SeverityNumber = { DEBUG: 5, INFO: 9, WARN: 13, ERROR: 17 };
           const origLog = console.log;
+          const origInfo = console.info;
           const origWarn = console.warn;
           const origError = console.error;
+          const origDebug = console.debug;
+          const { formatLogArgs } = require('./log-format');
 
           const { context: otelContext, trace: otelTrace } = require('@opentelemetry/api');
           function _emitLog(sn, st, args) {
@@ -618,7 +503,8 @@ function registerSecureNow(options = {}) {
               logger.emit({
                 severityNumber: sn,
                 severityText: st,
-                body: args.map(String).join(' '),
+                body: formatLogArgs(args),
+                attributes: { 'log.source': 'console', 'log.method': st.toLowerCase() },
                 ...(spanCtx && { context: activeCtx }),
               });
             } catch (_) {}
@@ -627,6 +513,10 @@ function registerSecureNow(options = {}) {
             origLog.apply(console, args);
             _emitLog(SeverityNumber.INFO, 'INFO', args);
           };
+          console.info = (...args) => {
+            origInfo.apply(console, args);
+            _emitLog(SeverityNumber.INFO, 'INFO', args);
+          };
           console.warn = (...args) => {
             origWarn.apply(console, args);
             _emitLog(SeverityNumber.WARN, 'WARN', args);
@@ -635,6 +525,10 @@ function registerSecureNow(options = {}) {
             origError.apply(console, args);
             _emitLog(SeverityNumber.ERROR, 'ERROR', args);
           };
+          console.debug = (...args) => {
+            origDebug.apply(console, args);
+            _emitLog(SeverityNumber.DEBUG, 'DEBUG', args);
+          };
 
           console.log('[securenow] Logging: ENABLED -> %s', logsUrl);
 
@@ -708,10 +602,7 @@ function registerSecureNow(options = {}) {
     console.log('[securenow]    - Geographic data (Vercel/Cloudflare)');
     console.log('[securenow]    - Request IDs, CSRF tokens, Auth presence');
     console.log('[securenow]    - Response status, content-type, content-length');
-    console.log('[securenow] Body capture DISABLED at HTTP instrumentation level (prevents Next.js conflicts)');
-    if (captureBody) {
-      console.log('[securenow] For body capture in Next.js, use: import "securenow/nextjs-auto-capture"');
-    }
+    console.log('[securenow]    - Request headers (redacted)%s', captureBody ? ' and JSON/form/GraphQL bodies (redacted)' : '');
 
     // Optional test span
     if (appConfig.boolConfig('runtime.testSpan', false)) {
@@ -757,6 +648,8 @@ function registerSecureNow(options = {}) {
         aws: firewallOptions.aws,
         gcp: firewallOptions.gcp,
       });
+      // Zero-code session revocation / session-theft capture (config.sessions.guard / .capture).
+      requireRuntimeModule('./sessions').installHttpGuard(appConfig.resolveSessionsOptions());
     } catch (e) {
       console.warn('[securenow] Firewall init failed:', e.message);
     }