trusera-sdk 1.1.0 → 1.1.1

package/dist/index.cjs

@@ -47,6 +47,7 @@ var TruseraClient = class {
   apiKey;
   baseUrl;
   batchSize;
+  maxQueueSize;
   flushInterval;
   debug;
   agentId;
@@ -66,6 +67,7 @@ var TruseraClient = class {
     this.baseUrl = options.baseUrl ?? "https://api.trusera.io";
     this.agentId = options.agentId;
     this.batchSize = options.batchSize ?? 100;
+    this.maxQueueSize = options.maxQueueSize ?? 1e4;
     this.flushInterval = options.flushInterval ?? 5e3;
     this.debug = options.debug ?? false;
     const envAuto = (typeof process !== "undefined" ? process.env?.TRUSERA_AUTO_REGISTER : void 0) ?? "";
@@ -111,7 +113,7 @@ var TruseraClient = class {
         name,
         framework,
         metadata: {
-          sdk_version: "0.1.0",
+          sdk_version: SDK_VERSION,
           runtime: "node",
           node_version: process.version
         }
@@ -141,10 +143,14 @@ var TruseraClient = class {
       metadata: {
         ...event.metadata,
         agent_id: this.agentId,
-        sdk_version: "0.1.0"
+        sdk_version: SDK_VERSION
       }
     };
     this.eventQueue.push(enrichedEvent);
+    while (this.eventQueue.length > this.maxQueueSize) {
+      this.eventQueue.shift();
+      this.log("Event queue overflow, dropping oldest event");
+    }
     this.log("Event tracked", { type: event.type, name: event.name, queueSize: this.eventQueue.length });
     if (this.eventQueue.length >= this.batchSize) {
       void this.flush();
@@ -214,7 +220,7 @@ var TruseraClient = class {
     if (typeof process === "undefined") return {};
     return {
       pid: process.pid,
-      argv: process.argv?.slice(0, 10),
+      argv: process.argv?.slice(0, 2),
       node_version: process.version,
       platform: process.platform,
       arch: process.arch
@@ -362,13 +368,47 @@ function tryRequire(moduleName) {
     return null;
   }
 }
+var SENSITIVE_HEADERS = /* @__PURE__ */ new Set([
+  "authorization",
+  "cookie",
+  "set-cookie",
+  "x-api-key",
+  "x-n8n-api-key",
+  "proxy-authorization"
+]);
+function redactHeaders(headers) {
+  const redacted = {};
+  for (const [key, value] of Object.entries(headers)) {
+    redacted[key] = SENSITIVE_HEADERS.has(key.toLowerCase()) ? "[REDACTED]" : value;
+  }
+  return redacted;
+}
+var MAX_PATTERN_LENGTH = 500;
+var EVIL_REGEX_PATTERNS = /(\.\*){2,}|(\w\+){2,}|\(\[^[^\]]*\]\*\)\*|\(\.\+\)\+/;
+function safeRegExp(pattern) {
+  if (pattern.length > MAX_PATTERN_LENGTH) {
+    console.warn(`[Trusera] Exclude pattern too long (${pattern.length} > ${MAX_PATTERN_LENGTH}), skipping`);
+    return null;
+  }
+  if (EVIL_REGEX_PATTERNS.test(pattern)) {
+    console.warn(`[Trusera] Potentially dangerous regex pattern detected, skipping: ${pattern.slice(0, 50)}`);
+    return null;
+  }
+  try {
+    return new RegExp(pattern);
+  } catch (e) {
+    console.warn(`[Trusera] Invalid regex pattern, skipping: ${pattern.slice(0, 50)}`);
+    return null;
+  }
+}
 var TruseraInterceptor = class {
   client = null;
   options = {
     enforcement: "log",
     policyUrl: "",
     excludePatterns: [],
-    debug: false
+    debug: false,
+    failClosed: false
   };
   excludeRegexes = [];
   isInstalled = false;
@@ -405,9 +445,10 @@ var TruseraInterceptor = class {
       enforcement: options.enforcement ?? "log",
       policyUrl: options.policyUrl ?? "",
       excludePatterns: options.excludePatterns ?? [],
-      debug: options.debug ?? false
+      debug: options.debug ?? false,
+      failClosed: options.failClosed ?? false
     };
-    this.excludeRegexes = this.options.excludePatterns.map((pattern) => new RegExp(pattern));
+    this.excludeRegexes = this.options.excludePatterns.map((pattern) => safeRegExp(pattern)).filter((r) => r !== null);
     if (originalFetch === null) {
       originalFetch = globalThis.fetch;
     }
@@ -454,7 +495,7 @@ var TruseraInterceptor = class {
     const event = createEvent(
       "api_call" /* API_CALL */,
       eventName,
-      { method, url, headers },
+      { method, url, headers: redactHeaders(headers) },
       { interception_mode: this.options.enforcement }
     );
     if (this.options.policyUrl) {
@@ -729,7 +770,7 @@ var TruseraInterceptor = class {
             response.headers.forEach((v, k) => {
               h[k] = v;
             });
-            return h;
+            return redactHeaders(h);
           })()
         }
       );
@@ -774,7 +815,7 @@ var TruseraInterceptor = class {
         body = "[Binary data]";
       }
     }
-    return { headers, body };
+    return { headers: redactHeaders(headers), body };
   }
   /**
    * Evaluates request against Cedar policies.
@@ -801,11 +842,21 @@ var TruseraInterceptor = class {
       });
       if (!response.ok) {
         console.error(`[Trusera] Policy evaluation failed: ${response.status}`);
+        if (this.options.failClosed && this.options.enforcement === "block") {
+          console.warn("[Trusera] FAIL-CLOSED: Policy service returned error, denying request");
+          return { decision: "Deny", reasons: [`Policy service error: ${response.status}`] };
+        }
+        console.warn("[Trusera] FAIL-OPEN: Policy service returned error, allowing request");
         return { decision: "Allow" };
       }
       return await response.json();
     } catch (error) {
       console.error("[Trusera] Policy evaluation error:", error);
+      if (this.options.failClosed && this.options.enforcement === "block") {
+        console.warn("[Trusera] FAIL-CLOSED: Policy evaluation failed, denying request");
+        return { decision: "Deny", reasons: ["Policy evaluation failed (fail-closed mode)"] };
+      }
+      console.warn("[Trusera] FAIL-OPEN: Policy evaluation failed, allowing request");
       return { decision: "Allow" };
     }
   }
@@ -1010,6 +1061,24 @@ var CedarEvaluator = class {
 };
 
 // src/standalone.ts
+var MAX_PATTERN_LENGTH2 = 500;
+var EVIL_REGEX_PATTERNS2 = /(\.\*){2,}|(\w\+){2,}|\(\[^[^\]]*\]\*\)\*|\(\.\+\)\+/;
+function safeRegExp2(pattern) {
+  if (pattern.length > MAX_PATTERN_LENGTH2) {
+    console.warn(`[Trusera Standalone] Exclude pattern too long, skipping`);
+    return null;
+  }
+  if (EVIL_REGEX_PATTERNS2.test(pattern)) {
+    console.warn(`[Trusera Standalone] Potentially dangerous regex pattern, skipping`);
+    return null;
+  }
+  try {
+    return new RegExp(pattern);
+  } catch {
+    console.warn(`[Trusera Standalone] Invalid regex pattern, skipping`);
+    return null;
+  }
+}
 var activeStandaloneInterceptor = null;
 var originalFetch2 = null;
 var StandaloneInterceptor = class {
@@ -1026,9 +1095,7 @@ var StandaloneInterceptor = class {
       excludePatterns: options.excludePatterns ?? [],
       debug: options.debug ?? false
     };
-    this.excludeRegexes = this.options.excludePatterns.map(
-      (pattern) => new RegExp(pattern)
-    );
+    this.excludeRegexes = this.options.excludePatterns.map((pattern) => safeRegExp2(pattern)).filter((r) => r !== null);
   }
   /**
    * Installs the standalone interceptor.