server-devtools 0.1.5 → 0.1.8

package/dist/src/instrumentation/span-mapper.js

@@ -2,6 +2,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const api_1 = require("@opentelemetry/api");
 class SpanMapper {
+    redactionService;
+    constructor(redactionService) {
+        this.redactionService = redactionService;
+    }
     map(span) {
         const context = span.spanContext();
         const exceptionEvent = span?.events?.find((event) => event.name === 'exception');
@@ -13,9 +17,7 @@ class SpanMapper {
             name: span.name,
             startedAt: this.hrTimeToMilliseconds(span.startTime),
             durationMs: this.hrTimeToMilliseconds(span.duration),
-            attributes: {
-                ...span.attributes,
-            },
+            attributes: this.redactHeaderAttributes(span.attributes),
             status: {
                 code: span.status.code,
                 message: span.status.message,
@@ -29,6 +31,26 @@ class SpanMapper {
                 : undefined,
         };
     }
+    redactHeaderAttributes(attributes) {
+        const redactedAttributes = { ...attributes };
+        const headerPrefixes = [
+            "http.request.header.",
+            "http.response.header.",
+        ];
+        for (const [key, value] of Object.entries(attributes)) {
+            const normalizedKey = key.toLowerCase();
+            const prefix = headerPrefixes.find((candidate) => normalizedKey.startsWith(candidate));
+            if (!prefix) {
+                continue;
+            }
+            const headerName = key.slice(prefix.length);
+            const redactedHeader = this.redactionService.redactData({
+                [headerName]: value,
+            });
+            redactedAttributes[key] = redactedHeader[headerName];
+        }
+        return redactedAttributes;
+    }
     getType(span) {
         if (span.attributes['db.system.name']) {
             return 'database';

package/dist/src/instrumentation/span-mapper.js.map

@@ -1 +1 @@
-{"version":3,"file":"span-mapper.js","sourceRoot":"","sources":["../../../src/instrumentation/span-mapper.ts"],"names":[],"mappings":";;AAEA,4CAA8C;AAG9C;IAEI,GAAG,CAAC,IAAkB;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnC,MAAM,cAAc,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CACrC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,CACxC,CAAC;QAEF,OAAO;YACH,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,YAAY,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM;YAE5C,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YAExB,IAAI,EAAE,IAAI,CAAC,IAAI;YAEf,SAAS,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC;YACpD,UAAU,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAEpD,UAAU,EAAE;gBACR,GAAG,IAAI,CAAC,UAAU;aACrB;YAED,MAAM,EAAE;gBACJ,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;gBACtB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;aAC/B;YACD,KAAK,EAAE,cAAc;gBACjB,CAAC,CAAC;oBACE,IAAI,EACA,cAAc,CAAC,UAAU,EAAE,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE;oBAC7D,OAAO,EACH,cAAc,CAAC,UAAU,EAAE,CAAC,mBAAmB,CAAC,EAAE,QAAQ,EAAE;oBAChE,KAAK,EACD,cAAc,CAAC,UAAU,EAAE,CAAC,sBAAsB,CAAC,EAAE,QAAQ,EAAE;iBACtE;gBACD,CAAC,CAAC,SAAS;SAClB,CAAA;IACL,CAAC;IAEO,OAAO,CAAC,IAAkB;QAC9B,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpC,OAAO,UAAU,CAAC;QACtB,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAClC,OAAO,WAAW,CAAC;QACvB,CAAC;QAED,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAChB,KAAK,cAAQ,CAAC,MAAM;gBAChB,OAAO,aAAa,CAAC;YAEzB,KAAK,cAAQ,CAAC,MAAM;gBAChB,OAAO,aAAa,CAAC;YAEzB;gBACI,OAAO,SAAS,CAAC;QACzB,CAAC;IACL,CAAC;IAEO,oBAAoB,CAAC,IAAsB;QAC/C,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,IAAI,CAAC;QAEpC,OAAO,OAAO,GAAG,IAAI,GAAG,WAAW,GAAG,SAAS,CAAC;IACpD,CAAC;CAIJ"}
+{"version":3,"file":"span-mapper.js","sourceRoot":"","sources":["../../../src/instrumentation/span-mapper.ts"],"names":[],"mappings":";;AAEA,4CAA8C;AAI9C;IACiC,gBAAgB;IAA7C,YAA6B,gBAAkC;gCAAlC,gBAAgB;IAAsB,CAAC;IAEpE,GAAG,CAAC,IAAkB;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnC,MAAM,cAAc,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CACrC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,CACxC,CAAC;QAEF,OAAO;YACH,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,YAAY,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM;YAE5C,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YAExB,IAAI,EAAE,IAAI,CAAC,IAAI;YAEf,SAAS,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC;YACpD,UAAU,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAEpD,UAAU,EAAE,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC;YAExD,MAAM,EAAE;gBACJ,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;gBACtB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;aAC/B;YACD,KAAK,EAAE,cAAc;gBACjB,CAAC,CAAC;oBACE,IAAI,EACA,cAAc,CAAC,UAAU,EAAE,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE;oBAC7D,OAAO,EACH,cAAc,CAAC,UAAU,EAAE,CAAC,mBAAmB,CAAC,EAAE,QAAQ,EAAE;oBAChE,KAAK,EACD,cAAc,CAAC,UAAU,EAAE,CAAC,sBAAsB,CAAC,EAAE,QAAQ,EAAE;iBACtE;gBACD,CAAC,CAAC,SAAS;SAClB,CAAA;IACL,CAAC;IAEO,sBAAsB,CAC1B,UAAsC;QAEtC,MAAM,kBAAkB,GAA4B,EAAE,GAAG,UAAU,EAAE,CAAC;QACtE,MAAM,cAAc,GAAG;YACnB,sBAAsB;YACtB,uBAAuB;SAC1B,CAAC;QAEF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACpD,MAAM,aAAa,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC7C,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,CACtC,CAAC;YAEF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,SAAS;YACb,CAAC;YAED,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5C,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC;gBACpD,CAAC,UAAU,CAAC,EAAE,KAAK;aACtB,CAA4B,CAAC;YAE9B,kBAAkB,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,kBAAkB,CAAC;IAC9B,CAAC;IAEO,OAAO,CAAC,IAAkB;QAC9B,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpC,OAAO,UAAU,CAAC;QACtB,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAClC,OAAO,WAAW,CAAC;QACvB,CAAC;QAED,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAChB,KAAK,cAAQ,CAAC,MAAM;gBAChB,OAAO,aAAa,CAAC;YAEzB,KAAK,cAAQ,CAAC,MAAM;gBAChB,OAAO,aAAa,CAAC;YAEzB;gBACI,OAAO,SAAS,CAAC;QACzB,CAAC;IACL,CAAC;IAEO,oBAAoB,CAAC,IAAsB;QAC/C,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,IAAI,CAAC;QAEpC,OAAO,OAAO,GAAG,IAAI,GAAG,WAAW,GAAG,SAAS,CAAC;IACpD,CAAC;CAIJ"}

package/dist/src/security/auth.service.d.ts

@@ -4,7 +4,13 @@ declare class AuthService {
     private readonly username;
     private readonly password;
     private readonly storage;
+    private readonly sessionKey;
+    private verifier;
     constructor(username: string, password: string, storage: SQLiteStorage);
+    private initializeSessions;
+    private deriveCredentialHash;
+    private credentialsMatch;
+    private reconcileCredentialVerifier;
     private generateSessionToken;
     private hashSessionToken;
     validateCredentials(username: string, password: string): boolean;

package/dist/src/security/auth.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../src/security/auth.service.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAIpC,cAAM,WAAW;IAET,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAH5B,YACqB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,aAAa,EAG1C;IAED,OAAO,CAAC,oBAAoB;IAI5B,OAAO,CAAC,gBAAgB;IAQxB,mBAAmB,CACf,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACjB,OAAO,CAMT;IAGD,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAwBtC;IAED,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CA4B9C;IAED,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CASjC;CACJ;eAGc,WAAW"}
+{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../src/security/auth.service.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAA2B,QAAQ,EAAE,MAAM,UAAU,CAAC;AAI7D,cAAM,WAAW;IAOT,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAN5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAA2B;IAE3C,YACqB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,aAAa,EAa1C;IAED,OAAO,CAAC,kBAAkB;IAY1B,OAAO,CAAC,oBAAoB;IAY5B,OAAO,CAAC,gBAAgB;IAUxB,OAAO,CAAC,2BAA2B;IAenC,OAAO,CAAC,oBAAoB;IAI5B,OAAO,CAAC,gBAAgB;IAQxB,mBAAmB,CACf,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACjB,OAAO,CAUT;IAGD,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAkCtC;IAED,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CA6B9C;IAED,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CASjC;CACJ;eAGc,WAAW"}

package/dist/src/security/auth.service.js

@@ -9,23 +9,76 @@ class AuthService {
     username;
     password;
     storage;
+    // Session hashes are keyed by the configured credentials so that changing
+    // the username or password invalidates every previously issued session.
+    sessionKey;
+    verifier;
     constructor(username, password, storage) {
         this.username = username;
         this.password = password;
         this.storage = storage;
         this.username = this.username ? this.username?.toLowerCase()?.trim() : '';
+        this.sessionKey = node_crypto_1.default
+            .createHash("sha256")
+            .update(JSON.stringify([
+            "server-devtools-session-v1",
+            this.username,
+            this.password,
+        ]))
+            .digest();
+        this.initializeSessions();
+    }
+    initializeSessions() {
+        try {
+            this.reconcileCredentialVerifier();
+            this.storage.deleteExpiredSessions(Date.now());
+        }
+        catch (error) {
+            (0, logger_1.debugLog)("Dashboard session initialization failed", {
+                errorName: error instanceof Error ? error.name : typeof error,
+            });
+            throw error;
+        }
+    }
+    deriveCredentialHash(salt) {
+        return node_crypto_1.default.scryptSync(JSON.stringify([
+            "server-devtools-credentials-v1",
+            this.username,
+            this.password,
+        ]), salt, 32);
+    }
+    credentialsMatch(salt, hash) {
+        const expected = Buffer.from(hash, "hex");
+        const actual = this.deriveCredentialHash(Buffer.from(salt, "hex"));
+        return expected.length === actual.length &&
+            node_crypto_1.default.timingSafeEqual(expected, actual);
+    }
+    // Sessions are deleted whenever the stored verifier is missing or does not
+    // match, because they may have been issued under different credentials.
+    reconcileCredentialVerifier() {
+        this.verifier = this.storage.reconcileAuthCredentialVerifier(stored => this.credentialsMatch(stored.salt, stored.hash), () => {
+            const salt = node_crypto_1.default.randomBytes(16);
+            return {
+                salt: salt.toString("hex"),
+                hash: this.deriveCredentialHash(salt).toString("hex"),
+                updatedAt: Date.now(),
+            };
+        });
     }
     generateSessionToken() {
         return node_crypto_1.default.randomBytes(32).toString("base64url");
     }
     hashSessionToken(token) {
         return node_crypto_1.default
-            .createHash("sha256")
+            .createHmac("sha256", this.sessionKey)
             .update(token)
             .digest("hex");
     }
     validateCredentials(username, password) {
-        const normalizedUsername = username ? username?.toLowerCase()?.trim() : null;
+        if (typeof username !== "string" || typeof password !== "string") {
+            return false;
+        }
+        const normalizedUsername = username ? username.toLowerCase().trim() : null;
         return (normalizedUsername === this.username &&
             password === this.password);
     }
@@ -36,12 +89,15 @@ class AuthService {
         const expiresAt = createdAt + (24 * 60 * 60 * 1000);
         const normalizedUsername = username?.toLowerCase()?.trim();
         try {
-            this.storage.saveSession({
+            const saved = this.storage.saveSessionForVerifier({
                 sessionHash,
                 username: normalizedUsername,
                 createdAt,
                 expiresAt,
-            });
+            }, this.verifier, createdAt);
+            if (!saved) {
+                throw new Error("Dashboard credentials changed since this process started");
+            }
         }
         catch (error) {
             (0, logger_1.debugLog)("Session creation persistence failed", {
@@ -66,6 +122,8 @@ class AuthService {
         }
         if (!session)
             return undefined;
+        if (session.username !== this.username)
+            return undefined;
         const hasExpired = session.expiresAt <= currentDate;
         if (hasExpired) {
             try {

package/dist/src/security/auth.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../../src/security/auth.service.ts"],"names":[],"mappings":";;;;;AAEA,4CAA2C;AAC3C,8DAAiC;AAEjC,MAAM,WAAW;IAEQ,QAAQ;IACR,QAAQ;IACR,OAAO;IAH5B,YACqB,QAAgB,EAChB,QAAgB,EAChB,OAAsB;wBAFtB,QAAQ;wBACR,QAAQ;uBACR,OAAO;QAExB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC7E,CAAC;IAEO,oBAAoB;QACxB,OAAO,qBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxD,CAAC;IAEO,gBAAgB,CAAC,KAAa;QAClC,OAAO,qBAAM;aACR,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAGD,mBAAmB,CACf,QAAgB,EAChB,QAAgB;QAEhB,MAAM,kBAAkB,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QAC5E,OAAO,CACH,kBAAkB,KAAK,IAAI,CAAC,QAAQ;YACpC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAC7B,CAAC;IACN,CAAC;IAGD,aAAa,CAAC,QAAgB;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAEjD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAEpD,MAAM,kBAAkB,GAAG,QAAQ,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAA;QAE1D,IAAI,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;gBACrB,WAAW;gBACX,QAAQ,EAAE,kBAAkB;gBAC5B,SAAS;gBACT,SAAS;aACZ,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAA,iBAAQ,EAAC,qCAAqC,EAAE;gBAC5C,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK;aAChE,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QAChB,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,UAAU,CAAC,KAAa;QACpB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC9B,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAA;QAChD,IAAI,OAA6B,CAAC;QAElC,IAAI,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAA;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAA,iBAAQ,EAAC,uBAAuB,EAAE;gBAC9B,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK;aAChE,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAA;QAC9B,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,IAAI,WAAW,CAAA;QACnD,IAAI,UAAU,EAAE,CAAC;YACb,IAAI,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,CAAA;YAC3C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAA,iBAAQ,EAAC,gCAAgC,EAAE;oBACvC,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK;iBAChE,CAAC,CAAC;YACP,CAAC;YACD,OAAO,SAAS,CAAA;QACpB,CAAC;QAED,OAAO,OAAO,CAAA;IAClB,CAAC;IAED,aAAa,CAAC,KAAa;QACvB,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAA;QAChD,IAAI,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,CAAA;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAA,iBAAQ,EAAC,yBAAyB,EAAE;gBAChC,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK;aAChE,CAAC,CAAC;QACP,CAAC;IACL,CAAC;CACJ;kBAGc,WAAW"}
+{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../../src/security/auth.service.ts"],"names":[],"mappings":";;;;;AAEA,4CAA2C;AAC3C,8DAAiC;AAEjC,MAAM,WAAW;IAOQ,QAAQ;IACR,QAAQ;IACR,OAAO;IAR5B,0EAA0E;IAC1E,wEAAwE;IACvD,UAAU,CAAS;IAC5B,QAAQ,CAA2B;IAE3C,YACqB,QAAgB,EAChB,QAAgB,EAChB,OAAsB;wBAFtB,QAAQ;wBACR,QAAQ;uBACR,OAAO;QAExB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACzE,IAAI,CAAC,UAAU,GAAG,qBAAM;aACnB,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YACnB,4BAA4B;YAC5B,IAAI,CAAC,QAAQ;YACb,IAAI,CAAC,QAAQ;SAChB,CAAC,CAAC;aACF,MAAM,EAAE,CAAC;QAEd,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC9B,CAAC;IAEO,kBAAkB;QACtB,IAAI,CAAC;YACD,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACnC,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAA,iBAAQ,EAAC,yCAAyC,EAAE;gBAChD,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK;aAChE,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;IAEO,oBAAoB,CAAC,IAAY;QACrC,OAAO,qBAAM,CAAC,UAAU,CACpB,IAAI,CAAC,SAAS,CAAC;YACX,gCAAgC;YAChC,IAAI,CAAC,QAAQ;YACb,IAAI,CAAC,QAAQ;SAChB,CAAC,EACF,IAAI,EACJ,EAAE,CACL,CAAC;IACN,CAAC;IAEO,gBAAgB,CAAC,IAAY,EAAE,IAAY;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAEnE,OAAO,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;YACpC,qBAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,2EAA2E;IAC3E,wEAAwE;IAChE,2BAA2B;QAC/B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,+BAA+B,CACxD,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EACzD,GAAG,EAAE;YACD,MAAM,IAAI,GAAG,qBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAEpC,OAAO;gBACH,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC1B,IAAI,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACrD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACxB,CAAC;QACN,CAAC,CACJ,CAAC;IACN,CAAC;IAEO,oBAAoB;QACxB,OAAO,qBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxD,CAAC;IAEO,gBAAgB,CAAC,KAAa;QAClC,OAAO,qBAAM;aACR,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;aACrC,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAGD,mBAAmB,CACf,QAAgB,EAChB,QAAgB;QAEhB,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC/D,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,MAAM,kBAAkB,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QAC1E,OAAO,CACH,kBAAkB,KAAK,IAAI,CAAC,QAAQ;YACpC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAC7B,CAAC;IACN,CAAC;IAGD,aAAa,CAAC,QAAgB;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAEjD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAEpD,MAAM,kBAAkB,GAAG,QAAQ,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAA;QAE1D,IAAI,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAC7C;gBACI,WAAW;gBACX,QAAQ,EAAE,kBAAkB;gBAC5B,SAAS;gBACT,SAAS;aACZ,EACD,IAAI,CAAC,QAAQ,EACb,SAAS,CACZ,CAAC;YAEF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CACX,0DAA0D,CAC7D,CAAC;YACN,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAA,iBAAQ,EAAC,qCAAqC,EAAE;gBAC5C,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK;aAChE,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QAChB,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,UAAU,CAAC,KAAa;QACpB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC9B,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAA;QAChD,IAAI,OAA6B,CAAC;QAElC,IAAI,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAA;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAA,iBAAQ,EAAC,uBAAuB,EAAE;gBAC9B,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK;aAChE,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAA;QAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAA;QACxD,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,IAAI,WAAW,CAAA;QACnD,IAAI,UAAU,EAAE,CAAC;YACb,IAAI,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,CAAA;YAC3C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAA,iBAAQ,EAAC,gCAAgC,EAAE;oBACvC,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK;iBAChE,CAAC,CAAC;YACP,CAAC;YACD,OAAO,SAAS,CAAA;QACpB,CAAC;QAED,OAAO,OAAO,CAAA;IAClB,CAAC;IAED,aAAa,CAAC,KAAa;QACvB,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAA;QAChD,IAAI,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,CAAA;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAA,iBAAQ,EAAC,yBAAyB,EAAE;gBAChC,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK;aAChE,CAAC,CAAC;QACP,CAAC;IACL,CAAC;CACJ;kBAGc,WAAW"}

package/dist/src/security/redaction.service.d.ts

@@ -0,0 +1,8 @@
+declare class RedactionService {
+    private readonly redactFields;
+    private readonly allowRedacting;
+    constructor(allowRedacting: boolean, redactFields: string[]);
+    redactData(data: unknown): unknown;
+}
+export default RedactionService;
+//# sourceMappingURL=redaction.service.d.ts.map

package/dist/src/security/redaction.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.service.d.ts","sourceRoot":"","sources":["../../../src/security/redaction.service.ts"],"names":[],"mappings":"AAIA,cAAM,gBAAgB;IAClB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAc;IAC3C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IAExC,YACI,cAAc,EAAE,OAAO,EACvB,YAAY,EAAE,MAAM,EAAE,EAQzB;IAED,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAuBjC;CAIJ;eAEc,gBAAgB"}

package/dist/src/security/redaction.service.js

@@ -0,0 +1,35 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const config_1 = __importDefault(require("../config"));
+class RedactionService {
+    redactFields;
+    allowRedacting;
+    constructor(allowRedacting, redactFields) {
+        this.allowRedacting = allowRedacting;
+        this.redactFields = new Set(redactFields
+            .map(field => field?.trim().toLowerCase())
+            .filter(Boolean));
+    }
+    redactData(data) {
+        if (!this.allowRedacting)
+            return data;
+        if (Array.isArray(data)) {
+            return data.map(item => this.redactData(item));
+        }
+        if (data !== null && typeof data === "object") {
+            return Object.fromEntries(Object.entries(data).map(([key, value]) => {
+                if (this.redactFields.has(key.toLowerCase()) &&
+                    value !== undefined) {
+                    return [key, config_1.default.REDACTED_KEY];
+                }
+                return [key, this.redactData(value)];
+            }));
+        }
+        return data;
+    }
+}
+exports.default = RedactionService;
+//# sourceMappingURL=redaction.service.js.map

package/dist/src/security/redaction.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.service.js","sourceRoot":"","sources":["../../../src/security/redaction.service.ts"],"names":[],"mappings":";;;;;AAAA,uDAA+B;AAI/B,MAAM,gBAAgB;IACD,YAAY,CAAc;IAC1B,cAAc,CAAS;IAExC,YACI,cAAuB,EACvB,YAAsB;QAEtB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAA;QACpC,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,CACvB,YAAY;aACP,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aACzC,MAAM,CAAC,OAAO,CAAC,CACvB,CAAC;IACN,CAAC;IAED,UAAU,CAAC,IAAa;QACpB,IAAI,CAAC,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QAEtC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,WAAW,CACrB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;gBACtC,IACI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACxC,KAAK,KAAK,SAAS,EACrB,CAAC;oBACC,OAAO,CAAC,GAAG,EAAE,gBAAM,CAAC,YAAY,CAAC,CAAC;gBACtC,CAAC;gBAED,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;YACzC,CAAC,CAAC,CACL,CAAC;QACN,CAAC;QAED,OAAO,IAAI,CAAC;IAChB,CAAC;CAIJ;kBAEc,gBAAgB"}

package/dist/src/storage/sqlite-storage.d.ts

@@ -1,5 +1,7 @@
-import { IDevToolsCurrentUser, IDevToolsSpan, IDevToolsTrace, IHttpClientDetails, ISession, ITraceMetadata, ITraceSummary } from "../types";
+import { DashboardOverviewRange, IAuthCredentialVerifier, IDevToolsCurrentUser, IDevToolsSpan, IDevToolsTrace, IHttpClientDetails, IOverviewMetrics, ISession, ITraceMetadata, ITraceSummary } from "../types";
 import EncryptDecryptService from "../security/encrypt-decrypt.service";
+export type TraceSummarySortField = "startedAt" | "durationMs" | "statusCode" | "method" | "path";
+export type TraceSummarySortDirection = "asc" | "desc";
 export default class SQLiteStorage {
     private readonly encryptionService?;
     private readonly db;
@@ -7,7 +9,9 @@ export default class SQLiteStorage {
     private getSchemaVersion;
     private setSchemaVersion;
     private initializeV1Schema;
+    private initializeV2Schema;
     private initialize;
+    private runImmediateTransaction;
     private deserializeSensitiveValue;
     private serializeSensitiveValue;
     saveSpan(span: IDevToolsSpan): void;
@@ -15,10 +19,11 @@ export default class SQLiteStorage {
     getTrace(traceId: string): IDevToolsTrace | undefined;
     saveTraceSummary(span: IDevToolsSpan): void;
     getTraceSummaries(): ITraceSummary[];
-    getPaginatedTraceSummaries(page: number, limit: number, search?: string, method?: string, statusCode?: number): {
+    getPaginatedTraceSummaries(page: number, limit: number, search?: string, method?: string, statusCode?: number, startedAtFrom?: number, startedAtTo?: number, sortField?: TraceSummarySortField, sortDirection?: TraceSummarySortDirection): {
         summaries: ITraceSummary[];
         total: number;
     };
+    getOverview(range: DashboardOverviewRange, now?: number): IOverviewMetrics;
     saveRequestBody(traceId: string, body: unknown): void;
     saveResponseBody(traceId: string, body: unknown): void;
     getTraceMetadata(traceId: string): ITraceMetadata | undefined;
@@ -27,6 +32,10 @@ export default class SQLiteStorage {
     saveSession(session: ISession): void;
     getSessionByHash(sessionHash: string): ISession | undefined;
     deleteSession(sessionHash: string): void;
+    deleteExpiredSessions(now: number): number;
+    getAuthCredentialVerifier(): IAuthCredentialVerifier | undefined;
+    reconcileAuthCredentialVerifier(matches: (stored: IAuthCredentialVerifier) => boolean, createVerifier: () => IAuthCredentialVerifier): IAuthCredentialVerifier;
+    saveSessionForVerifier(session: ISession, verifier: IAuthCredentialVerifier, now: number): boolean;
     saveCurrentUser(traceId: string, user: IDevToolsCurrentUser): void;
     updateHttpClientDetails(spanId: string, details: Partial<Omit<IHttpClientDetails, "spanId">>): void;
     getHttpClientDetails(spanId: string): IHttpClientDetails | undefined;

package/dist/src/storage/sqlite-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sqlite-storage.d.ts","sourceRoot":"","sources":["../../../src/storage/sqlite-storage.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC5I,OAAO,qBAAqB,MAAM,qCAAqC,CAAC;AAUxE,MAAM,CAAC,OAAO,OAAO,aAAa;IAI1B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAHvC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAe;IAElC,YAAY,IAAI,EAAE,MAAM,EACH,iBAAiB,CAAC,EAAE,qBAAqB,YAAA,EAK7D;IAED,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,kBAAkB;IA0E1B,OAAO,CAAC,UAAU;IAsBlB,OAAO,CAAC,yBAAyB;IAQjC,OAAO,CAAC,uBAAuB;IAQ/B,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAyClC;IAED,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAkClD;IAED,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAoBpD;IAED,gBAAgB,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CA+E1C;IAED,iBAAiB,IAAI,aAAa,EAAE,CAmCnC;IAED,0BAA0B,CACtB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,MAAM,SAAK,EACX,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,MAAM,GACpB;QACC,SAAS,EAAE,aAAa,EAAE,CAAC;QAC3B,KAAK,EAAE,MAAM,CAAC;KACjB,CAgFA;IAED,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAmBpD;IAED,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAmBrD;IAED,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAsD5D;IAED,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAuBjC;IAED,YAAY,IAAI,IAAI,CAenB;IAED,WAAW,CAAC,OAAO,EAAE,QAAQ,GAAG,IAAI,CAenC;IAED,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAmB1D;IAED,aAAa,CAAC,WAAW,EAAE,MAAM,QAKhC;IAED,eAAe,CACX,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,oBAAoB,QAiB7B;IAED,uBAAuB,CACnB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,GACrD,IAAI,CAsEN;IAED,oBAAoB,CAChB,MAAM,EAAE,MAAM,GACf,kBAAkB,GAAG,SAAS,CA6ChC;IAED,KAAK,IAAI,IAAI,CAEZ;CACJ"}
+{"version":3,"file":"sqlite-storage.d.ts","sourceRoot":"","sources":["../../../src/storage/sqlite-storage.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC/M,OAAO,qBAAqB,MAAM,qCAAqC,CAAC;AAGxE,MAAM,MAAM,qBAAqB,GAC3B,WAAW,GACX,YAAY,GACZ,YAAY,GACZ,QAAQ,GACR,MAAM,CAAC;AACb,MAAM,MAAM,yBAAyB,GAAG,KAAK,GAAG,MAAM,CAAC;AAQvD,MAAM,CAAC,OAAO,OAAO,aAAa;IAI1B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAHvC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAe;IAElC,YAAY,IAAI,EAAE,MAAM,EACH,iBAAiB,CAAC,EAAE,qBAAqB,YAAA,EAK7D;IAED,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,kBAAkB;IA0E1B,OAAO,CAAC,kBAAkB;IAW1B,OAAO,CAAC,UAAU;IA2BlB,OAAO,CAAC,uBAAuB;IA6B/B,OAAO,CAAC,yBAAyB;IAQjC,OAAO,CAAC,uBAAuB;IAQ/B,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAyClC;IAED,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAkClD;IAED,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAoBpD;IAED,gBAAgB,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAkF1C;IAED,iBAAiB,IAAI,aAAa,EAAE,CAmCnC;IAED,0BAA0B,CACtB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,MAAM,SAAK,EACX,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,MAAM,EACnB,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,MAAM,EACpB,SAAS,GAAE,qBAAmC,EAC9C,aAAa,GAAE,yBAAkC,GAClD;QACC,SAAS,EAAE,aAAa,EAAE,CAAC;QAC3B,KAAK,EAAE,MAAM,CAAC;KACjB,CA6GA;IAED,WAAW,CACP,KAAK,EAAE,sBAAsB,EAC7B,GAAG,SAAa,GACjB,gBAAgB,CAsElB;IAED,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAmBpD;IAED,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAmBrD;IAED,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAsD5D;IAED,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAuBjC;IAED,YAAY,IAAI,IAAI,CAenB;IAED,WAAW,CAAC,OAAO,EAAE,QAAQ,GAAG,IAAI,CAenC;IAED,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAmB1D;IAED,aAAa,CAAC,WAAW,EAAE,MAAM,QAKhC;IAED,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAOzC;IAED,yBAAyB,IAAI,uBAAuB,GAAG,SAAS,CAc/D;IAED,+BAA+B,CAC3B,OAAO,EAAE,CAAC,MAAM,EAAE,uBAAuB,KAAK,OAAO,EACrD,cAAc,EAAE,MAAM,uBAAuB,GAC9C,uBAAuB,CAuBzB;IAED,sBAAsB,CAClB,OAAO,EAAE,QAAQ,EACjB,QAAQ,EAAE,uBAAuB,EACjC,GAAG,EAAE,MAAM,GACZ,OAAO,CAYT;IAED,eAAe,CACX,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,oBAAoB,QAiB7B;IAED,uBAAuB,CACnB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,GACrD,IAAI,CAsEN;IAED,oBAAoB,CAChB,MAAM,EAAE,MAAM,GACf,kBAAkB,GAAG,SAAS,CA6ChC;IAED,KAAK,IAAI,IAAI,CAEZ;CACJ"}

package/dist/src/storage/sqlite-storage.js

@@ -91,23 +91,64 @@ class SQLiteStorage {
             this.db.exec(`ALTER TABLE trace_metadata ADD COLUMN user_json TEXT`);
         }
     }
+    initializeV2Schema() {
+        this.db.exec(`
+        CREATE TABLE IF NOT EXISTS auth_credentials (
+            id INTEGER PRIMARY KEY CHECK (id = 1),
+            salt TEXT NOT NULL,
+            hash TEXT NOT NULL,
+            updated_at INTEGER NOT NULL
+        );
+    `);
+    }
     initialize() {
-        const version = this.getSchemaVersion();
-        if (version === config_1.default.STORAGE.SCHEMA_VERSION) {
+        if (this.getSchemaVersion() >= config_1.default.STORAGE.SCHEMA_VERSION) {
             return;
         }
-        if (version === 0) {
-            this.db.exec("BEGIN");
-            try {
+        this.runImmediateTransaction(() => {
+            // Another process may have migrated while this one waited for the lock.
+            const version = this.getSchemaVersion();
+            if (version >= config_1.default.STORAGE.SCHEMA_VERSION) {
+                return;
+            }
+            if (version < 1) {
                 this.initializeV1Schema();
-                this.setSchemaVersion(1);
+            }
+            if (version < 2) {
+                this.initializeV2Schema();
+            }
+            this.setSchemaVersion(config_1.default.STORAGE.SCHEMA_VERSION);
+        });
+    }
+    // Takes the write lock up front and waits for other processes holding it,
+    // so read-check-write sequences cannot interleave across connections.
+    runImmediateTransaction(operation) {
+        const { timeout: previousTimeout } = this.db
+            .prepare("PRAGMA busy_timeout")
+            .get();
+        this.db.exec(`PRAGMA busy_timeout = ${Math.max(0, Math.floor(config_1.default.STORAGE.BUSY_TIMEOUT_MS))}`);
+        try {
+            this.db.exec("BEGIN IMMEDIATE");
+            try {
+                const result = operation();
                 this.db.exec("COMMIT");
+                return result;
             }
             catch (error) {
-                this.db.exec("ROLLBACK");
+                if (this.db.isTransaction) {
+                    try {
+                        this.db.exec("ROLLBACK");
+                    }
+                    catch {
+                        // Preserve the original failure.
+                    }
+                }
                 throw error;
             }
         }
+        finally {
+            this.db.exec(`PRAGMA busy_timeout = ${previousTimeout}`);
+        }
     }
     deserializeSensitiveValue(value) {
         const parsed = JSON.parse(value);
@@ -142,7 +183,7 @@ class SQLiteStorage {
             : null);
         // Handles the case where the trace summary already exists
         // when an errored child span arrives.
-        if (span.error) {
+        if (span.status.code === 2 || span.error !== undefined) {
             this.db.prepare(`
             UPDATE traces
             SET has_error = 1
@@ -218,7 +259,10 @@ class SQLiteStorage {
         SELECT 1
         FROM spans
         WHERE trace_id = ?
-          AND error_json IS NOT NULL
+          AND (
+              json_extract(status_json, '$.code') = 2
+              OR error_json IS NOT NULL
+          )
         LIMIT 1
     `).get(span.traceId);
         const hasError = errorSpan ? 1 : 0;
@@ -287,14 +331,15 @@ class SQLiteStorage {
             };
         });
     }
-    getPaginatedTraceSummaries(page, limit, search = "", method, statusCode) {
+    getPaginatedTraceSummaries(page, limit, search = "", method, statusCode, startedAtFrom, startedAtTo, sortField = "startedAt", sortDirection = "desc") {
         const offset = (page - 1) * limit;
         const conditions = [];
         const parameters = [];
         const normalizedSearch = search.trim();
         if (normalizedSearch) {
             conditions.push(`(
-                t.path LIKE ? COLLATE NOCASE ESCAPE '\\'
+                t.trace_id LIKE ? COLLATE NOCASE ESCAPE '\\'
+                OR t.path LIKE ? COLLATE NOCASE ESCAPE '\\'
                 OR t.route LIKE ? COLLATE NOCASE ESCAPE '\\'
                 OR EXISTS (
                     SELECT 1
@@ -303,10 +348,18 @@ class SQLiteStorage {
                       AND s.span_id = t.root_span_id
                       AND s.name LIKE ? COLLATE NOCASE ESCAPE '\\'
                 )
+                OR EXISTS (
+                    SELECT 1
+                    FROM spans s
+                    WHERE s.trace_id = t.trace_id
+                      AND s.span_id = t.root_span_id
+                      AND json_extract(s.attributes_json, '$."url.query"')
+                          LIKE ? COLLATE NOCASE ESCAPE '\\'
+                )
             )`);
             const escapedSearch = normalizedSearch.replace(/[\\%_]/g, character => `\\${character}`);
             const searchPattern = `%${escapedSearch}%`;
-            parameters.push(searchPattern, searchPattern, searchPattern);
+            parameters.push(searchPattern, searchPattern, searchPattern, searchPattern, searchPattern);
         }
         const normalizedMethod = method?.trim();
         if (normalizedMethod) {
@@ -317,9 +370,27 @@ class SQLiteStorage {
             conditions.push("t.status_code = ?");
             parameters.push(statusCode);
         }
+        if (startedAtFrom !== undefined) {
+            conditions.push("t.started_at >= ?");
+            parameters.push(startedAtFrom);
+        }
+        if (startedAtTo !== undefined) {
+            conditions.push("t.started_at < ?");
+            parameters.push(startedAtTo);
+        }
         const whereClause = conditions.length > 0
             ? `WHERE ${conditions.join(" AND ")}`
             : "";
+        const sortColumns = {
+            startedAt: "t.started_at",
+            durationMs: "t.duration_ms",
+            statusCode: "t.status_code",
+            method: "t.method",
+            path: "t.path",
+        };
+        const sortColumn = sortColumns[sortField];
+        const sortNullsLast = `CASE WHEN ${sortColumn} IS NULL THEN 1 ELSE 0 END ASC`;
+        const sortOrder = `${sortColumn} ${sortDirection.toUpperCase()}`;
         const totalRow = this.db.prepare(`
         SELECT COUNT(*) AS total
         FROM traces t
@@ -335,7 +406,7 @@ class SQLiteStorage {
         LEFT JOIN trace_metadata tm
             ON tm.trace_id = t.trace_id
         ${whereClause}
-        ORDER BY t.started_at DESC
+        ORDER BY ${sortNullsLast}, ${sortOrder}, t.trace_id ASC
         LIMIT ? OFFSET ?
     `).all(...parameters, limit, offset);
         const summaries = rows.map((row) => {
@@ -361,6 +432,64 @@ class SQLiteStorage {
         });
         return { summaries, total: totalRow.total };
     }
+    getOverview(range, now = Date.now()) {
+        const rangeMs = {
+            "15m": 15 * 60 * 1000,
+            "1h": 60 * 60 * 1000,
+            "6h": 6 * 60 * 60 * 1000,
+            "24h": 24 * 60 * 60 * 1000,
+        };
+        const to = now;
+        const from = to - rangeMs[range];
+        const bucketCount = range === "15m" ? 15 : range === "1h" ? 12 : 24;
+        const bucketWidth = rangeMs[range] / bucketCount;
+        const rows = this.db.prepare(`
+            SELECT trace_id, started_at, duration_ms, method, path, route, status_code, has_error
+            FROM traces
+            WHERE started_at >= ? AND started_at < ?
+            ORDER BY started_at DESC
+        `).all(from, to);
+        const durations = rows
+            .map(row => row.duration_ms)
+            .filter((duration) => duration !== null && Number.isFinite(duration));
+        const failures = rows
+            .filter(row => row.status_code !== null && row.status_code >= 500 && row.status_code < 600)
+            .slice(0, 10)
+            .map(row => ({
+            id: row.trace_id,
+            method: row.method ?? "—",
+            path: row.path ?? "—",
+            route: row.route ?? undefined,
+            statusCode: row.status_code ?? undefined,
+            durationMs: row.duration_ms ?? undefined,
+            startedAt: row.started_at,
+            hasError: row.has_error === 1,
+        }));
+        const volume = Array.from({ length: bucketCount }, (_, index) => {
+            const startAt = from + index * bucketWidth;
+            const endAt = index === bucketCount - 1 ? to : startAt + bucketWidth;
+            return {
+                startAt,
+                endAt,
+                count: rows.filter(row => row.started_at >= startAt && row.started_at < endAt).length,
+            };
+        });
+        return {
+            range,
+            from,
+            to,
+            totalRequests: rows.length,
+            errorRate: rows.length === 0 ? 0 : failures.length > 0
+                ? rows.filter(row => row.status_code !== null && row.status_code >= 500 && row.status_code < 600).length / rows.length
+                : 0,
+            averageLatencyMs: durations.length === 0
+                ? 0
+                : durations.reduce((sum, duration) => sum + duration, 0) / durations.length,
+            slowRequests: durations.filter(duration => duration > 500).length,
+            volume,
+            recentFailures: failures,
+        };
+    }
     saveRequestBody(traceId, body) {
         const statement = this.db.prepare(`
         INSERT INTO trace_metadata (
@@ -507,6 +636,58 @@ class SQLiteStorage {
             WHERE session_hash = ?
         `).run(sessionHash);
     }
+    deleteExpiredSessions(now) {
+        const result = this.db.prepare(`
+            DELETE FROM sessions
+            WHERE expires_at <= ?
+        `).run(now);
+        return Number(result.changes);
+    }
+    getAuthCredentialVerifier() {
+        const row = this.db.prepare(`
+            SELECT salt, hash, updated_at
+            FROM auth_credentials
+            WHERE id = 1
+        `).get();
+        if (!row)
+            return undefined;
+        return {
+            salt: row.salt,
+            hash: row.hash,
+            updatedAt: row.updated_at,
+        };
+    }
+    reconcileAuthCredentialVerifier(matches, createVerifier) {
+        return this.runImmediateTransaction(() => {
+            const stored = this.getAuthCredentialVerifier();
+            if (stored && matches(stored)) {
+                return stored;
+            }
+            const verifier = createVerifier();
+            this.db.exec("DELETE FROM sessions");
+            this.db.prepare(`
+                INSERT OR REPLACE INTO auth_credentials (
+                    id,
+                    salt,
+                    hash,
+                    updated_at
+                )
+                VALUES (1, ?, ?, ?)
+            `).run(verifier.salt, verifier.hash, verifier.updatedAt);
+            return verifier;
+        });
+    }
+    saveSessionForVerifier(session, verifier, now) {
+        return this.runImmediateTransaction(() => {
+            const stored = this.getAuthCredentialVerifier();
+            if (!stored || stored.salt !== verifier.salt || stored.hash !== verifier.hash) {
+                return false;
+            }
+            this.deleteExpiredSessions(now);
+            this.saveSession(session);
+            return true;
+        });
+    }
     saveCurrentUser(traceId, user) {
         const processedUser = this.encryptionService
             ? this.encryptionService.encryptData(user)