log.ts · Source

log.tsapps/worker/src/processors/automations/log.tsraw ← automations4,767 B← Back to the app
1/**
2 * apps/worker — automation run log writer (TASK-0113 §3/§7/§Security).
3 *
4 * Every run gets ≥1 `automation_log`. This module is the SINGLE place
5 * `AutomationLog` rows are written, so two things are applied centrally and
6 * no executor can bypass them:
7 *  - REDACTION: a fixed set of sensitive key NAMES (Authorization,
8 *    X-Api-Key, Cookie, Set-Cookie, token, password, webhook-secret, … — see
9 *    SENSITIVE_KEYS) matched case-insensitively by EXACT name (not substring,
10 *    so a legitimate `keyboard` field is never masked). A matching key's value
11 *    is replaced with `***` before storage, so webhook headers, secrets, and
12 *    any credential that lands in a log's `data` are scrubbed here.
13 *  - TRUNCATION: a `data` blob larger than `LOG_DATA_MAX_BYTES` (32 KB) is
14 *    truncated to a JSON-safe prefix + `{ truncated: true }` so one runaway
15 *    log row cannot bloat the table.
16 *
17 * `runLog` never throws — a failed log write is a WARN, not a run failure
18 * (the run outcome is what matters; the log is observability).
19 */
20import type { PrismaClient } from "@prisma/client";
21import { asJson } from "../../lib/prisma.js";
22import { getLogger } from "../../logger.js";
23 
24const log = getLogger("automation-log");
25 
26/** Hard cap on a single log row's `data` JSON size. */
27export const LOG_DATA_MAX_BYTES = 32 * 1024;
28 
29/** Sensitive key names (matched case-insensitively) → value becomes "***". */
30const SENSITIVE_KEYS = new Set([
31  "authorization",
32  "proxy-authorization",
33  "cookie",
34  "set-cookie",
35  "x-api-key",
36  "api-key",
37  "apikey",
38  "x-auth-token",
39  "authorization-header",
40  "secret",
41  "secret-hash",
42  "secret-encrypted",
43  "token",
44  "access-token",
45  "refresh-token",
46  "password",
47  "pass",
48  "passwd",
49  "private-key",
50  "signing-key",
51  "webhook-secret",
52  "x-hub-signature",
53  "x-webhook-signature",
54  "x-authorization"
55]);
56 
57/**
58 * Recursively redact sensitive keys in a (plain) object. Arrays and scalars
59 * pass through; objects are walked. Keys are compared lowercase.
60 */
61export function redact(value: unknown): unknown {
62  if (Array.isArray(value)) return value.map(redact);
63  if (value && typeof value === "object") {
64    const out: Record<string, unknown> = {};
65    for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
66      out[k] = SENSITIVE_KEYS.has(k.toLowerCase()) ? "***" : redact(v);
67    }
68    return out;
69  }
70  return value;
71}
72 
73/**
74 * Truncate a `data` blob to LOG_DATA_MAX_BYTES while preserving structure:
75 * string leaves are shortened (with a `…[truncated]` marker) until the whole
76 * blob fits. A top-level `truncated: true` flag is set whenever anything was
77 * cut (the spec's "truncated: true" flag). Pure (no DB).
78 */
79export function truncateLogData(data: unknown): unknown {
80  if (data === undefined || data === null) return data;
81  const json = JSON.stringify(data);
82  if (json === undefined) return data;
83  if (Buffer.byteLength(json, "utf8") <= LOG_DATA_MAX_BYTES) return data;
84 
85  let truncated = false;
86  const shorten = (v: unknown): unknown => {
87    if (typeof v === "string") {
88      if (v.length > 500) {
89        truncated = true;
90        return `${v.slice(0, 500)}…[truncated ${v.length - 500} chars]`;
91      }
92      return v;
93    }
94    if (Array.isArray(v)) return v.map(shorten);
95    if (v && typeof v === "object") {
96      const out: Record<string, unknown> = {};
97      for (const [k, val] of Object.entries(v as Record<string, unknown>)) out[k] = shorten(val);
98      return out;
99    }
100    return v;
101  };
102  const result = shorten(data);
103  if (result && typeof result === "object" && !Array.isArray(result)) {
104    (result as Record<string, unknown>).truncated = true;
105  }
106  // Final guard: if still over (pathologically many medium strings), collapse
107  // to a marker object so a row can never exceed the cap.
108  if (JSON.stringify(result) && Buffer.byteLength(JSON.stringify(result), "utf8") > LOG_DATA_MAX_BYTES) {
109    return {
110      truncated: true,
111      note: "automation log data exceeded the 32 KB cap and was truncated"
112    };
113  }
114  void truncated;
115  return result;
116}
117 
118/**
119 * Write one automation_log row. Redacts + truncates `data` centrally. Never
120 * throws (a log failure is a WARN, not a run failure).
121 */
122export async function runLog(
123  prisma: PrismaClient,
124  runId: string,
125  level: "info" | "warn" | "error",
126  message: string,
127  data?: Record<string, unknown>
128): Promise<void> {
129  try {
130    const safeData = data ? (truncateLogData(redact(data)) as Record<string, unknown>) : undefined;
131    await prisma.automationLog.create({
132      data: { runId, level, message, data: asJson(safeData ?? undefined) }
133    });
134  } catch (err) {
135    log.warn({ err: (err as Error).message, runId, level }, "automation log write failed (non-fatal)");
136  }
137}
138