feat(server): introduces serializeError and redactError

lib/deep-map.js

@@ -1,20 +1,12 @@
-function filterError (input) {
-  return {
-    errorType: input.name,
-    message: input.message,
-    stack: input.stack,
-    ...(input.code ? { code: input.code } : {}),
-    ...(input.statusCode ? { statusCode: input.statusCode } : {}),
-  }
-}
+const { serializedError } = require('./error')
 
 const deepMap = (input, handler = v => v, path = ['$'], seen = new Set([input])) => {
   // this is in an effort to maintain bole's error logging behavior
   if (path.join('.') === '$' && input instanceof Error) {
-    return deepMap({ err: filterError(input) }, handler, path, seen)
+    return deepMap({ err: serializedError(input) }, handler, path, seen)
   }
   if (input instanceof Error) {
-    return deepMap(filterError(input), handler, path, seen)
+    return deepMap(serializedError(input), handler, path, seen)
   }
   if (input instanceof Buffer) {
     return `[unable to log instanceof buffer]`

lib/error.js

@@ -0,0 +1,49 @@
+/** takes an error object and serializes it to a plan object */
+function serializedError (input) {
+  if (!(input instanceof Error)) {
+    if (typeof input === 'string') {
+      const error = new Error(`attempted to serialize a non-error, string String, "${input}"`)
+      return serializedError(error)
+    }
+    const error = new Error(`attempted to serialize a non-error, ${typeof input} ${input?.constructor?.name}`)
+    return serializedError(error)
+  }
+  // different error objects store status code differently
+  // AxiosError uses `status`, other services use `statusCode`
+  const statusCode = input.statusCode ?? input.status
+  // CAUTION: what we serialize here gets add to the size of logs
+  return {
+    errorType: input.errorType ?? input.constructor.name,
+    ...(input.message ? { message: input.message } : {}),
+    ...(input.stack ? { stack: input.stack } : {}),
+    // think of this as error code
+    ...(input.code ? { code: input.code } : {}),
+    // think of this as http status code
+    ...(statusCode ? { statusCode } : {}),
+  }
+}
+
+/** takes an error returns new error keeping some custom properties */
+function safeError (input) {
+  const { message, ...data } = serializedError(input)
+  const output = new Error(message)
+  return Object.assign(output, data)
+}
+
+/** runs a function within try / catch and throws safeError */
+async function safeThrow (func) {
+  if (typeof func !== 'function') {
+    throw new Error('safeThrow expects a function')
+  }
+  try {
+    return await func()
+  } catch (error) {
+    throw safeError(error)
+  }
+}
+
+module.exports = {
+  safeThrow,
+  serializedError,
+  safeError,
+}

package.json

@@ -6,6 +6,7 @@
   "exports": {
     ".": "./lib/index.js",
     "./server": "./lib/server.js",
+    "./error": "./lib/error.js",
     "./package.json": "./package.json"
   },
   "scripts": {

test/error.js

@@ -0,0 +1,184 @@
+const { serializedError, safeError, safeThrow } = require('../lib/error')
+const t = require('tap')
+
+class CustomError extends Error {
+  constructor (message, data) {
+    super(message)
+    this.sensitive = data
+  }
+}
+
+class NoMessageNoStackError extends Error {
+  constructor (message) {
+    super(message)
+    delete this.message
+    delete this.stack
+  }
+}
+
+t.test('serializedError', async t => {
+  await t.test('native error', async t => {
+    const exampleError = new Error('hello world')
+
+    t.same(
+      serializedError(exampleError),
+      {
+        errorType: 'Error',
+        message: 'hello world',
+        stack: exampleError.stack,
+      },
+      'should serialize error'
+    )
+  })
+
+  await t.test('attached error (status not statusCode)', async t => {
+    const exampleError = new Error('hello world')
+    exampleError.code = 'E12345'
+    exampleError.status = 404
+
+    t.same(
+      serializedError(exampleError),
+      {
+        errorType: 'Error',
+        message: 'hello world',
+        stack: exampleError.stack,
+        code: 'E12345',
+        statusCode: 404,
+      },
+      'should serialize error with code / statusCode'
+    )
+  })
+
+  await t.test('attached error', async t => {
+    const exampleError = new Error('hello world')
+    exampleError.code = 'E12345'
+    exampleError.statusCode = 404
+
+    t.same(
+      serializedError(exampleError),
+      {
+        errorType: 'Error',
+        message: 'hello world',
+        stack: exampleError.stack,
+        code: 'E12345',
+        statusCode: 404,
+      },
+      'should serialize error with code / statusCode'
+    )
+  })
+
+  await t.test('assigned error', async t => {
+    const exampleError = new Error('hello world')
+    Object.assign(exampleError, {
+      code: 'E12345',
+      statusCode: 404,
+    })
+
+    t.same(
+      serializedError(exampleError),
+      {
+        errorType: 'Error',
+        message: 'hello world',
+        stack: exampleError.stack,
+        code: 'E12345',
+        statusCode: 404,
+      },
+      'should serialize error with code / statusCode'
+    )
+  })
+
+  await t.test('custom error', async t => {
+    const exampleError = new CustomError('hello world', 'sensitive data')
+    t.same(
+      serializedError(exampleError),
+      {
+        errorType: 'CustomError',
+        message: 'hello world',
+        stack: exampleError.stack,
+      },
+      'should serialize error'
+    )
+  })
+
+  await t.test('no-message no-stack', async t => {
+    const exampleError = new NoMessageNoStackError('hello world')
+    t.same(
+      serializedError(exampleError),
+      {
+        errorType: 'NoMessageNoStackError',
+      },
+      'should serialize error'
+    )
+  })
+
+  await t.test('undefined', async t => {
+    const results = serializedError(undefined)
+    t.same(results.errorType, 'Error', 'should serialize error')
+    t.same(results.message, 'attempted to serialize a non-error, undefined undefined', 'should serialize message')
+  })
+
+  await t.test('date', async t => {
+    const results = serializedError(new Date())
+    t.same(results.errorType, 'Error', 'should serialize error')
+    t.same(results.message, 'attempted to serialize a non-error, object Date', 'should serialize message')
+  })
+
+  await t.test('string', async t => {
+    const results = serializedError('hello world')
+    t.same(results.errorType, 'Error', 'should serialize error')
+    t.same(results.message, 'attempted to serialize a non-error, string String, "hello world"', 'should serialize message')
+  })
+})
+
+t.test('safeError', async t => {
+  await t.test('native error', async t => {
+    const badError = new Error('hello world')
+    Object.assign(badError, {
+      sensitive: 'sensitive data',
+    })
+    const goodError = safeError(badError)
+
+    t.same(badError.sensitive, 'sensitive data', 'should have sensitive field')
+    t.same(goodError.sensitive, undefined, 'should not have sensitive field')
+  })
+  await t.test('custom error', async t => {
+    const badError = new CustomError('hello world', 'sensitive data')
+    const goodError = safeError(badError)
+
+    t.same(badError.sensitive, 'sensitive data', 'should have sensitive field')
+    t.same(goodError.sensitive, undefined, 'should not have sensitive field')
+  })
+})
+
+t.test('safeThrow', async t => {
+  await t.test('successfully throws error', async t => {
+    const badError = new CustomError('hello world', 'sensitive data')
+    t.same(badError.sensitive, 'sensitive data', 'should have sensitive field')
+    try {
+      await safeThrow(async () => {
+        throw badError
+      })
+      t.fail('should throw')
+    } catch (goodError) {
+      t.same(goodError.sensitive, undefined, 'should not have sensitive field')
+    }
+  })
+  t.test('invalid argument not function', async t => {
+    try {
+      await safeThrow('hello world')
+      t.fail('should throw')
+    } catch (error) {
+      t.same(error.message, 'safeThrow expects a function', 'should throw with correct message')
+    }
+  })
+})
+
+t.test('serialize a safeError', async t => {
+  const badError = new CustomError('hello world', 'sensitive data')
+  const goodError = safeError(badError)
+  const serialized = serializedError(goodError)
+  t.same(serialized.errorType, 'CustomError', 'should serialize error')
+  t.same(serialized.message, 'hello world', 'should serialize message')
+  t.same(serialized.stack, goodError.stack, 'should serialize stack')
+  t.same(serialized.sensitive, undefined, 'should not serialize sensitive data')
+})

test/server.js

@@ -0,0 +1,32 @@
+const t = require('tap')
+const { redact } = require('../lib/server')
+const matchers = require('../lib/matchers')
+const examples = require('./fixtures/examples')
+
+t.test('redact', async t => {
+  await t.test('error has npm secret in message', async t => {
+    const error = new Error(`message contains npm secret: ${examples.NPM_SECRET.npm_36}`)
+    t.same(error.message, `message contains npm secret: ${examples.NPM_SECRET.npm_36}`)
+    const output = redact({ error })
+    t.same(output, {
+      error: {
+        errorType: 'Error',
+        message: `message contains npm secret: ${matchers.NPM_SECRET.replacement}`,
+        stack: error.stack.replace(examples.NPM_SECRET.npm_36, matchers.NPM_SECRET.replacement),
+      },
+    })
+  })
+  await t.test('error has npm secret in statusCode', async t => {
+    const x = new Error(`message`)
+    const error = Object.assign(x, { statusCode: examples.NPM_SECRET.npm_36 })
+    const output = redact({ error })
+    t.same(output, {
+      error: {
+        errorType: 'Error',
+        message: `message`,
+        stack: error.stack,
+        statusCode: matchers.NPM_SECRET.replacement,
+      },
+    })
+  })
+})