Class: OAuth2::SanitizedLogFormatter Private

Inherits:
Faraday::Logging::Formatter
  • Object
show all
Defined in:
lib/oauth2/sanitized_log_formatter.rb

Overview

This class is part of a private API. You should avoid using this class if possible, as it may be removed or be changed in the future.

Faraday logging formatter that redacts sensitive values from Hash and Array
request/response bodies BEFORE Faraday renders them (via pretty_inspect).

Text-level sanitization ({OAuth2::AUTH_SANITIZER::SanitizedLogger}) remains as a
second layer for headers, query strings, and already-serialized bodies.

Redaction rules:

  • keys matching any filtered key (case-insensitive) are redacted, nested at any depth
  • the authorization code is redacted only in an authorization_code grant context,
    detected from the request URL query or the body itself, so non-secret codes
    (e.g. error codes) are preserved
  • cyclic structures are tolerated

Requires Faraday >= 1.0 (Faraday::Logging::Formatter). On Faraday 0.17 this
class is not defined and the caller falls back to text-level sanitization only.

Constant Summary collapse

CONTEXTUAL_KEYS =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

Keys redacted only in an authorization_code grant context.

%w[code].freeze

Instance Method Summary collapse

Constructor Details

#initialize(filtered_keys: nil, label: nil, **options) ⇒ SanitizedLogFormatter

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Faraday instantiates formatters itself with (logger:, options:), so the
redaction configuration falls back to the current OAuth2.config values.

Parameters:

  • filtered_keys (Array<String>, nil) (defaults to: nil) —

    key names to redact unconditionally

  • label (String, nil) (defaults to: nil) —

    replacement label

  • options (Hash) —

    Faraday formatter options



41
42
43
44
45
46
47
 
# File 'lib/oauth2/sanitized_log_formatter.rb', line 41

def initialize(filtered_keys: nil, label: nil, **options)
  super(**options)
  config = OAuth2.config
  @filtered_keys = (filtered_keys || config[:filtered_debug_keys]).map { |key| key.to_s.downcase }.freeze
  @label = (label || config[:filtered_label]).to_s
  @code_context = false
end

Instance Method Details

#dump_body(body) ⇒ String

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Redact structured bodies before rendering; leave everything else to the parent.

Parameters:

  • body (Object) —

    request or response body

Returns:

  • (String) —

    rendered body for logging



76
77
78
79
80
81
82
83
84
85
 
# File 'lib/oauth2/sanitized_log_formatter.rb', line 76

def dump_body(body)
  case body
  when Hash, Array
    super(redact_structured(body, seen: {}, code_sensitive: @code_context))
  when String
    super(@code_context ? redact_code_in_string(body) : body)
  else
    super
  end
end

#request(env) ⇒ Object

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Log the request, detecting authorization_code context from the URL and body.

Parameters:

  • env (Faraday::Env) —

    request environment



52
53
54
55
56
57
58
59
60
61
62
63
 
# File 'lib/oauth2/sanitized_log_formatter.rb', line 52

def request(env)
  with_code_context(env) do
    if @code_context && env.respond_to?(:url) && env.url && env.url.query.to_s.include?("code=")
      # Log a sanitized COPY of the env; the real request must keep its URL.
      sanitized_env = env.dup
      sanitized_env.url = sanitize_url_code(env.url)
      super(sanitized_env)
    else
      super
    end
  end
end

#response(env) ⇒ Object

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Log the response, detecting authorization_code context from the URL and body.

Parameters:

  • env (Faraday::Env) —

    response environment



68
69
70
 
# File 'lib/oauth2/sanitized_log_formatter.rb', line 68

def response(env)
  with_code_context(env) { super }
end