mirror of
https://github.com/jason5ng32/MyIP.git
synced 2026-11-04 08:55:47 +00:00
jason5ng32andClaude Opus 5.5
c29e48687b
common/ had become the backend's library: 30 of its 41 modules were imported by nothing in the frontend, so the name no longer said what belonged there. It now holds only what the frontend or the build imports too; backend-only code moved to server/, flat except for datasets/ (the dataset engine and its readers). The *-db/ dataset directories stay in common/: self-hosting docs and Docker volumes mount those paths. frontend/utils/ keeps its app-wide modules at the root and gains ip/ (IP / ASN shaping and validation), report/ (the report pipeline) and features/ (the pure layer of a single feature). Paths only — no logic changes. The Dockerfile copies server/, and the AGENTS.md files say where a new module goes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
82 lines
3.2 KiB
JavaScript
82 lines
3.2 KiB
JavaScript
// Scrubbing helpers for backend Sentry telemetry. Query strings on
|
|
// upstream calls carry API keys — redact those param values everywhere
|
|
// (breadcrumbs, spans, event request contexts) before sending. The rest
|
|
// of the query is kept on purpose: it is debugging context. Wired into
|
|
// Sentry.init hooks in sentry-instrument.js;
|
|
// kept here as pure functions so they stay testable without loading the SDK.
|
|
|
|
// Param names whose values must never reach Sentry.
|
|
const SENSITIVE_PARAMS = /^(key|api[-_]?key|token|secret|password|auth)$/i;
|
|
|
|
// Breadcrumb / span / trace attributes that may hold a URL, or a bare
|
|
// query string.
|
|
const URL_ATTRS = ['url', 'url.full', 'http.url', 'http.target'];
|
|
const QUERY_ATTRS = ['url.query', 'http.query'];
|
|
|
|
// Redact sensitive values in a bare query string ("q=1&key=abc"). Node's
|
|
// http instrumentation stores query attributes with a leading `?`
|
|
// ("?key=abc&ip=…") — tolerate it so the first param still matches.
|
|
export const redactQueryString = (query) => {
|
|
if (typeof query !== 'string') return query;
|
|
return query.split('&').map((pair) => {
|
|
const eq = pair.indexOf('=');
|
|
if (eq === -1) return pair;
|
|
const rawName = pair.slice(0, eq);
|
|
const name = rawName.charAt(0) === '?' ? rawName.slice(1) : rawName;
|
|
return SENSITIVE_PARAMS.test(name) ? `${rawName}=[redacted]` : pair;
|
|
}).join('&');
|
|
};
|
|
|
|
// Redact sensitive query params in a full or relative URL. Anything
|
|
// before the first `?` passes through untouched.
|
|
export const redactUrlQuery = (value) => {
|
|
if (typeof value !== 'string') return value;
|
|
const q = value.indexOf('?');
|
|
if (q === -1) return value;
|
|
return value.slice(0, q + 1) + redactQueryString(value.slice(q + 1));
|
|
};
|
|
|
|
const scrubAttributes = (data) => {
|
|
if (!data) return;
|
|
for (const attr of URL_ATTRS) {
|
|
if (typeof data[attr] === 'string') data[attr] = redactUrlQuery(data[attr]);
|
|
}
|
|
for (const attr of QUERY_ATTRS) {
|
|
if (typeof data[attr] === 'string') data[attr] = redactQueryString(data[attr]);
|
|
}
|
|
};
|
|
|
|
// beforeBreadcrumb: the http integration records the outgoing URL across
|
|
// several data attributes (url, http.query, …) — scrub them all.
|
|
export const scrubBreadcrumb = (breadcrumb) => {
|
|
scrubAttributes(breadcrumb?.data);
|
|
return breadcrumb;
|
|
};
|
|
|
|
// beforeSendSpan: http client spans carry the URL both in attributes and
|
|
// in the description ("GET https://host/path?query").
|
|
export const scrubSpan = (span) => {
|
|
if (!span) return span;
|
|
if (typeof span.description === 'string') {
|
|
span.description = redactUrlQuery(span.description);
|
|
}
|
|
scrubAttributes(span.data);
|
|
return span;
|
|
};
|
|
|
|
// beforeSend / beforeSendTransaction: inbound request context plus the
|
|
// root span's trace attributes.
|
|
export const scrubEventRequest = (event) => {
|
|
if (!event) return event;
|
|
if (event.request) {
|
|
if (typeof event.request.url === 'string') {
|
|
event.request.url = redactUrlQuery(event.request.url);
|
|
}
|
|
if (typeof event.request.query_string === 'string') {
|
|
event.request.query_string = redactQueryString(event.request.query_string);
|
|
}
|
|
}
|
|
scrubAttributes(event.contexts?.trace?.data);
|
|
return event;
|
|
};
|