mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-26 18:31:34 +01:00
Resubmits #5820 by @echokos. The original PR's head fork could not accept maintainer edits (organization-owned fork without cross-org maintainer-edit access), so we've resubmitted the commits here with original authorship preserved. Thanks to @echokos for the contribution. --- ## Thinking Path > - Paperclip orchestrates AI agents for zero-human companies; the server is an Express app with structured HTTP logging via pino-http. > - The middleware in `server/src/middleware/logger.ts` defines a `customProps` hook that attaches request context (`req.body` / `req.params` / `req.query`) to every 4xx/5xx log entry so operators can diagnose failed requests. > - That hook copies the body verbatim. Better Auth's `POST /api/auth/sign-in/email` carries an `{ email, password }` body — on a wrong-password attempt the request lands in the 4xx branch and the plaintext password is written to `~/.paperclip/logs/server.log`. > - Two existing issues raise this (#3072 plaintext-password leak, #4759 similar concerns) and neither has a fix. > - Same exposure surface applies to sign-up, reset-password, API key creation, and any endpoint that accepts a credential in the body and can return 4xx. > - This pull request introduces a small `redactSensitive` walker that returns a shallow copy of the input with values for known credential-shaped keys replaced with `[REDACTED]`, and applies it at every body/params/query log site in `customProps`. > - The benefit is that operators can keep diagnostic logging on without their disk silently accumulating user passwords and bearer tokens. ## What Changed - `server/src/middleware/redact-sensitive.ts` (new): depth-capped, case-insensitive walker. Sensitive keys covered: `password`, `currentPassword`, `newPassword`, `passwordConfirmation`, `passwordConfirm`, `confirmPassword` (+ snake_case variants), `secret`, `client_secret`, `access_token`, `refresh_token`, `id_token`, `auth_token`, `session_token`, `api_key`, `authorization`, `private_key`. Bare `token` deliberately not in the list — pagination cursors and CSRF tokens are not credentials (per Greptile review). - `server/src/middleware/logger.ts`: wraps the six log sites in `customProps` (3 ctx-path + 3 fallback-path) with `redactSensitive`. - `server/src/__tests__/redact-sensitive.test.ts` (new): covers plaintext password, case-insensitive matching, multiple credential keys, nested objects/arrays, bare `token` left untouched, primitives untouched, cycle safety. - Depth-cap returns `undefined` (field absent from log line) rather than a sentinel string, per Greptile review. ## Verification - `pnpm --filter @paperclipai/server test redact-sensitive` should run the new test file green. - Manual: tail `~/.paperclip/logs/server.log`, hit `POST /api/auth/sign-in/email` with a deliberately wrong password, confirm the logged `reqBody.password` reads `[REDACTED]` (not the plaintext) and the surrounding fields still appear for diagnosis. ## Risks Low. The walker only rewrites values at the log-emit boundary — the actual `req.body` object handed to downstream handlers is unchanged because `redactSensitive` returns a new object. Standard log fields (email, route path, status code) remain visible. The sensitive-key list is conservative enough that the only risk is over-redacting a non-credential field that happens to share a name with a known credential; the bare `token` carve-out in this revision addresses the most obvious such case. ## Model Used - Claude Opus 4.7 (`claude-opus-4-7`), Anthropic, extended thinking mode, working through Claude Code CLI. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [ ] I have run tests locally and they pass (no `node_modules` in my disposable PR-prep checkout; CI vitest will exercise) - [x] I have added or updated tests where applicable - [ ] If this change affects the UI, I have included before/after screenshots (N/A — server-only) - [ ] I have updated relevant documentation to reflect my changes (no doc surface affected) - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge Closes #3072. Refs #4759. --- ## Original Context `customProps` in the HTTP logger copies `req.body` / `req.params` / `req.query` verbatim into 4xx/5xx log entries. Better Auth's wrong-password flow therefore writes: ``` {"reqBody":{"email":"…","password":"founding6gomez6croaking"},"msg":"POST /api/auth/sign-in/email 401"} ``` …to disk. This PR rewrites credential-shaped values to `[REDACTED]` at that boundary. --- ## Cross-references and status (maintainer) Closes #5820 Closes #3095 Closes #4760 Closes #4886 --------- Co-authored-by: Aurora <aurora@majorimpact.com> Co-authored-by: Paperclip <noreply@paperclip.ing>
97 lines
3.0 KiB
TypeScript
97 lines
3.0 KiB
TypeScript
import path from "node:path";
|
|
import fs from "node:fs";
|
|
import pino from "pino";
|
|
import { pinoHttp } from "pino-http";
|
|
import { readConfigFile } from "../config-file.js";
|
|
import { resolveDefaultLogsDir, resolveHomeAwarePath } from "../home-paths.js";
|
|
import { shouldSilenceHttpSuccessLog } from "./http-log-policy.js";
|
|
import { redactSensitive } from "./redact-sensitive.js";
|
|
|
|
function resolveServerLogDir(): string {
|
|
const envOverride = process.env.PAPERCLIP_LOG_DIR?.trim();
|
|
if (envOverride) return resolveHomeAwarePath(envOverride);
|
|
|
|
const fileLogDir = readConfigFile()?.logging.logDir?.trim();
|
|
if (fileLogDir) return resolveHomeAwarePath(fileLogDir);
|
|
|
|
return resolveDefaultLogsDir();
|
|
}
|
|
|
|
const logDir = resolveServerLogDir();
|
|
fs.mkdirSync(logDir, { recursive: true });
|
|
|
|
const logFile = path.join(logDir, "server.log");
|
|
|
|
const sharedOpts = {
|
|
translateTime: "SYS:HH:MM:ss",
|
|
ignore: "pid,hostname",
|
|
singleLine: true,
|
|
};
|
|
|
|
export const logger = pino({
|
|
level: "debug",
|
|
redact: ["req.headers.authorization"],
|
|
}, pino.transport({
|
|
targets: [
|
|
{
|
|
target: "pino-pretty",
|
|
options: { ...sharedOpts, ignore: "pid,hostname,req,res,responseTime", colorize: true, destination: 1 },
|
|
level: "info",
|
|
},
|
|
{
|
|
target: "pino-pretty",
|
|
options: { ...sharedOpts, colorize: false, destination: logFile, mkdir: true },
|
|
level: "debug",
|
|
},
|
|
],
|
|
}));
|
|
|
|
export const httpLogger = pinoHttp({
|
|
logger,
|
|
customLogLevel(_req, res, err) {
|
|
if (shouldSilenceHttpSuccessLog(_req.method, _req.url, res.statusCode)) {
|
|
return "silent";
|
|
}
|
|
if (err || res.statusCode >= 500) return "error";
|
|
if (res.statusCode >= 400) return "warn";
|
|
return "info";
|
|
},
|
|
customSuccessMessage(req, res) {
|
|
return `${req.method} ${req.url} ${res.statusCode}`;
|
|
},
|
|
customErrorMessage(req, res, err) {
|
|
const ctx = (res as any).__errorContext;
|
|
const errMsg = ctx?.error?.message || err?.message || (res as any).err?.message || "unknown error";
|
|
return `${req.method} ${req.url} ${res.statusCode} — ${errMsg}`;
|
|
},
|
|
customProps(req, res) {
|
|
if (res.statusCode >= 400) {
|
|
const ctx = (res as any).__errorContext;
|
|
if (ctx) {
|
|
return {
|
|
errorContext: ctx.error,
|
|
reqBody: redactSensitive(ctx.reqBody),
|
|
reqParams: redactSensitive(ctx.reqParams),
|
|
reqQuery: redactSensitive(ctx.reqQuery),
|
|
};
|
|
}
|
|
const props: Record<string, unknown> = {};
|
|
const { body, params, query } = req as any;
|
|
if (body && typeof body === "object" && Object.keys(body).length > 0) {
|
|
props.reqBody = redactSensitive(body);
|
|
}
|
|
if (params && typeof params === "object" && Object.keys(params).length > 0) {
|
|
props.reqParams = redactSensitive(params);
|
|
}
|
|
if (query && typeof query === "object" && Object.keys(query).length > 0) {
|
|
props.reqQuery = redactSensitive(query);
|
|
}
|
|
if ((req as any).route?.path) {
|
|
props.routePath = (req as any).route.path;
|
|
}
|
|
return props;
|
|
}
|
|
return {};
|
|
},
|
|
});
|