feat(core-shared): PII scrubbers — beforeSend (R32) + beforeSendTransaction (R33)

packages/core-shared/src/instrumentation/sentry/scrub.test.ts

@@ -0,0 +1,139 @@
+// packages/core-shared/src/instrumentation/sentry/scrub.test.ts
+import { describe, it, expect } from "vitest";
+import { beforeSend, beforeSendTransaction } from "@/instrumentation/sentry/scrub";
+
+describe("beforeSend", () => {
+  it("redacts top-level keys whose names contain PII substrings", () => {
+    const event = {
+      extra: { email: "a@b.c", username: "alice" },
+      contexts: { custom: { password: "p", note: "ok" } },
+    } as Parameters<typeof beforeSend>[0];
+    const result = beforeSend(event, {} as Parameters<typeof beforeSend>[1]) as Record<
+      string,
+      unknown
+    >;
+    const extra = result["extra"] as Record<string, unknown>;
+    const contexts = result["contexts"] as { custom: Record<string, unknown> };
+    expect(extra["email"]).toBe("[redacted]");
+    expect(extra["username"]).toBe("alice");
+    expect(contexts.custom["password"]).toBe("[redacted]");
+    expect(contexts.custom["note"]).toBe("ok");
+  });
+
+  it("redacts derived key names (substring match): userEmail, accessToken, apiKey", () => {
+    const event = {
+      extra: { userEmail: "a@b.c", accessToken: "t", apiKey: "k", id: "u1" },
+    } as Parameters<typeof beforeSend>[0];
+    const result = beforeSend(event, {} as Parameters<typeof beforeSend>[1]) as Record<
+      string,
+      unknown
+    >;
+    const extra = result["extra"] as Record<string, unknown>;
+    expect(extra["userEmail"]).toBe("[redacted]");
+    expect(extra["accessToken"]).toBe("[redacted]");
+    expect(extra["apiKey"]).toBe("[redacted]");
+    expect(extra["id"]).toBe("u1");
+  });
+
+  it("redacts headers map keys case-insensitively", () => {
+    const event = {
+      request: {
+        headers: { Authorization: "Bearer x", "Set-Cookie": "session=abc", "User-Agent": "ua" },
+      },
+    } as Parameters<typeof beforeSend>[0];
+    const result = beforeSend(event, {} as Parameters<typeof beforeSend>[1]) as Record<
+      string,
+      unknown
+    >;
+    const request = result["request"] as { headers: Record<string, unknown> };
+    expect(request.headers["Authorization"]).toBe("[redacted]");
+    expect(request.headers["Set-Cookie"]).toBe("[redacted]");
+    expect(request.headers["User-Agent"]).toBe("ua");
+  });
+
+  it("redacts IPv4 addresses found in string values", () => {
+    const event = { extra: { note: "Connection from 192.168.1.10 failed" } } as Parameters<
+      typeof beforeSend
+    >[0];
+    const result = beforeSend(event, {} as Parameters<typeof beforeSend>[1]) as Record<
+      string,
+      unknown
+    >;
+    const extra = result["extra"] as Record<string, unknown>;
+    expect(extra["note"]).toBe("Connection from [redacted-ip] failed");
+  });
+
+  it("redacts IPv6 addresses found in string values", () => {
+    const event = { extra: { note: "Tunnel to fe80::1ff:fe23:4567:890a established" } } as Parameters<
+      typeof beforeSend
+    >[0];
+    const result = beforeSend(event, {} as Parameters<typeof beforeSend>[1]) as Record<
+      string,
+      unknown
+    >;
+    const extra = result["extra"] as Record<string, unknown>;
+    expect(extra["note"] as string).toContain("[redacted-ip]");
+  });
+
+  it("does not crash on null/undefined branches", () => {
+    expect(beforeSend({ extra: null } as Parameters<typeof beforeSend>[0], {} as Parameters<typeof beforeSend>[1])).toBeTruthy();
+    expect(beforeSend({} as Parameters<typeof beforeSend>[0], {} as Parameters<typeof beforeSend>[1])).toBeTruthy();
+  });
+
+  it("returns the event (not null) — keeps Sentry transport flowing", () => {
+    expect(
+      beforeSend({ extra: { ok: true } } as Parameters<typeof beforeSend>[0], {} as Parameters<typeof beforeSend>[1]),
+    ).toBeTruthy();
+  });
+});
+
+describe("beforeSendTransaction", () => {
+  it("strips PII query params from request.url", () => {
+    const event = {
+      request: { url: "https://app/api/foo?token=secret&user=alice&email=a@b.c" },
+    } as Parameters<typeof beforeSendTransaction>[0];
+    const result = beforeSendTransaction(
+      event,
+      {} as Parameters<typeof beforeSendTransaction>[1],
+    ) as Record<string, unknown>;
+    const request = result["request"] as { url: string };
+    expect(request.url).toContain("token=%5Bredacted%5D");
+    expect(request.url).toContain("email=%5Bredacted%5D");
+    expect(request.url).toContain("user=alice");
+  });
+
+  it("strips PII query params from event.transaction", () => {
+    const event = { transaction: "/foo?token=x&id=y" } as Parameters<
+      typeof beforeSendTransaction
+    >[0];
+    const result = beforeSendTransaction(
+      event,
+      {} as Parameters<typeof beforeSendTransaction>[1],
+    ) as Record<string, unknown>;
+    expect(result["transaction"] as string).toContain("token=%5Bredacted%5D");
+    expect(result["transaction"] as string).toContain("id=y");
+  });
+
+  it("matches derived param names (accessToken, ApiSecret)", () => {
+    const event = { request: { url: "https://x/y?accessToken=t&ApiSecret=z&safe=1" } } as Parameters<
+      typeof beforeSendTransaction
+    >[0];
+    const result = beforeSendTransaction(
+      event,
+      {} as Parameters<typeof beforeSendTransaction>[1],
+    ) as Record<string, unknown>;
+    const request = result["request"] as { url: string };
+    expect(request.url).toContain("accessToken=%5Bredacted%5D");
+    expect(request.url).toContain("ApiSecret=%5Bredacted%5D");
+    expect(request.url).toContain("safe=1");
+  });
+
+  it("returns the event when no URL present", () => {
+    expect(
+      beforeSendTransaction(
+        {} as Parameters<typeof beforeSendTransaction>[0],
+        {} as Parameters<typeof beforeSendTransaction>[1],
+      ),
+    ).toBeTruthy();
+  });
+});