Skip to content

Log redacted+truncated HTTP bodies at debug level #187

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
parthban-db wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

Log redacted+truncated HTTP bodies at debug level #187

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 37 additions & 0 deletions packages/accessmanagement/src/v1/client.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ import {VERSION as AUTH_VERSION} from '@databricks/sdk-auth';
import {createDefault} from '@databricks/sdk-core/clientinfo';
import type {Logger} from '@databricks/sdk-core/logger';
import {NoOpLogger} from '@databricks/sdk-core/logger';
import {DEFAULT_DEBUG_TRUNCATE_BYTES} from '@databricks/sdk-core/logger/debug';
import type {CallOptions} from '@databricks/sdk-options/call';
import type {ClientOptions} from '@databricks/sdk-options/client';
import type {HttpClient} from '@databricks/sdk-core/http';
Expand Down Expand Up @@ -76,6 +77,9 @@ export class AccessManagementClient {
private readonly workspaceId: string | undefined;
private readonly httpClient: HttpClient;
private readonly logger: Logger;
// Resolved debug-logging toggles passed into each HTTP call.
private readonly debugHeaders: boolean;
private readonly debugTruncateBytes: number;
// User-Agent header value. Composed once at construction from
// createDefault() merged with this package's identity and the active
// credential's name.
Expand All @@ -89,6 +93,9 @@ export class AccessManagementClient {
this.accountId = options.accountId;
this.workspaceId = options.workspaceId;
this.logger = options.logger ?? new NoOpLogger();
this.debugHeaders = options.debugHeaders ?? false;
this.debugTruncateBytes =
options.debugTruncateBytes ?? DEFAULT_DEBUG_TRUNCATE_BYTES;
const info = createDefault()
.with(PACKAGE_SEGMENT)
.with({key: 'sdk-js-auth', value: AUTH_VERSION})
Expand All @@ -112,6 +119,8 @@ export class AccessManagementClient {
request: httpReq,
httpClient: this.httpClient,
logger: this.logger,
debugHeaders: this.debugHeaders,
debugTruncateBytes: this.debugTruncateBytes,
});
resp = parseResponse(
respBody,
Expand Down Expand Up @@ -140,6 +149,8 @@ export class AccessManagementClient {
request: httpReq,
httpClient: this.httpClient,
logger: this.logger,
debugHeaders: this.debugHeaders,
debugTruncateBytes: this.debugTruncateBytes,
});
resp = parseResponse(
respBody,
Expand Down Expand Up @@ -168,6 +179,8 @@ export class AccessManagementClient {
request: httpReq,
httpClient: this.httpClient,
logger: this.logger,
debugHeaders: this.debugHeaders,
debugTruncateBytes: this.debugTruncateBytes,
});
resp = parseResponse(
respBody,
Expand Down Expand Up @@ -200,6 +213,8 @@ export class AccessManagementClient {
request: httpReq,
httpClient: this.httpClient,
logger: this.logger,
debugHeaders: this.debugHeaders,
debugTruncateBytes: this.debugTruncateBytes,
});
resp = parseResponse(
respBody,
Expand Down Expand Up @@ -240,6 +255,8 @@ export class AccessManagementClient {
request: httpReq,
httpClient: this.httpClient,
logger: this.logger,
debugHeaders: this.debugHeaders,
debugTruncateBytes: this.debugTruncateBytes,
});
resp = parseResponse(respBody, unmarshalRuleSetSchema);
};
Expand Down Expand Up @@ -277,6 +294,8 @@ export class AccessManagementClient {
request: httpReq,
httpClient: this.httpClient,
logger: this.logger,
debugHeaders: this.debugHeaders,
debugTruncateBytes: this.debugTruncateBytes,
});
resp = parseResponse(respBody, unmarshalRuleSetSchema);
};
Expand Down Expand Up @@ -311,6 +330,8 @@ export class AccessManagementClient {
request: httpReq,
httpClient: this.httpClient,
logger: this.logger,
debugHeaders: this.debugHeaders,
debugTruncateBytes: this.debugTruncateBytes,
});
resp = parseResponse(
respBody,
Expand Down Expand Up @@ -348,6 +369,8 @@ export class AccessManagementClient {
request: httpReq,
httpClient: this.httpClient,
logger: this.logger,
debugHeaders: this.debugHeaders,
debugTruncateBytes: this.debugTruncateBytes,
});
resp = parseResponse(
respBody,
Expand Down Expand Up @@ -380,6 +403,8 @@ export class AccessManagementClient {
request: httpReq,
httpClient: this.httpClient,
logger: this.logger,
debugHeaders: this.debugHeaders,
debugTruncateBytes: this.debugTruncateBytes,
});
resp = parseResponse(respBody, unmarshalRuleSetSchema);
};
Expand Down Expand Up @@ -409,6 +434,8 @@ export class AccessManagementClient {
request: httpReq,
httpClient: this.httpClient,
logger: this.logger,
debugHeaders: this.debugHeaders,
debugTruncateBytes: this.debugTruncateBytes,
});
resp = parseResponse(respBody, unmarshalRuleSetSchema);
};
Expand Down Expand Up @@ -437,6 +464,8 @@ export class AccessManagementClient {
request: httpReq,
httpClient: this.httpClient,
logger: this.logger,
debugHeaders: this.debugHeaders,
debugTruncateBytes: this.debugTruncateBytes,
});
resp = parseResponse(respBody, unmarshalPermissionsResponseSchema);
};
Expand Down Expand Up @@ -465,6 +494,8 @@ export class AccessManagementClient {
request: httpReq,
httpClient: this.httpClient,
logger: this.logger,
debugHeaders: this.debugHeaders,
debugTruncateBytes: this.debugTruncateBytes,
});
resp = parseResponse(
respBody,
Expand Down Expand Up @@ -497,6 +528,8 @@ export class AccessManagementClient {
request: httpReq,
httpClient: this.httpClient,
logger: this.logger,
debugHeaders: this.debugHeaders,
debugTruncateBytes: this.debugTruncateBytes,
});
resp = parseResponse(respBody, unmarshalPermissionsResponseSchema);
};
Expand Down Expand Up @@ -529,6 +562,8 @@ export class AccessManagementClient {
request: httpReq,
httpClient: this.httpClient,
logger: this.logger,
debugHeaders: this.debugHeaders,
debugTruncateBytes: this.debugTruncateBytes,
});
resp = parseResponse(respBody, unmarshalPermissionsResponseSchema);
};
Expand Down Expand Up @@ -586,6 +621,8 @@ export class AccessManagementClient {
request: httpReq,
httpClient: this.httpClient,
logger: this.logger,
debugHeaders: this.debugHeaders,
debugTruncateBytes: this.debugTruncateBytes,
});
resp = parseResponse(respBody, unmarshalCheckPolicyResponseSchema);
};
Expand Down
44 changes: 39 additions & 5 deletions packages/accessmanagement/src/v1/utils.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,10 @@ import type {
HttpResponse,
} from '@databricks/sdk-core/http';
import type {Logger} from '@databricks/sdk-core/logger';
import {
redactedDumpBody,
redactHeaders,
} from '@databricks/sdk-core/logger/debug';
import type {CallOptions} from '@databricks/sdk-options/call';
import JSONBig from 'json-bigint';
import type {z} from 'zod';
Expand All @@ -22,6 +26,10 @@ export interface HttpCallOptions {
readonly request: HttpRequest;
readonly httpClient: HttpClient;
readonly logger: Logger;
// When true, redacted request/response headers are logged at debug level.
readonly debugHeaders: boolean;
// Per-value byte budget for debug-level body and header logs.
readonly debugTruncateBytes: number;
}

/**
Expand Down Expand Up @@ -71,10 +79,27 @@ async function readAll(
export async function executeHttpCall(
opts: HttpCallOptions
): Promise<Uint8Array> {
opts.logger.debug('HTTP request', {
const requestLog: Record<string, unknown> = {
method: opts.request.method,
url: opts.request.url,
});
};
// Bodies are logged independent of debugHeaders, matching the Go SDK.
if (typeof opts.request.body === 'string') {
requestLog.requestBody = redactedDumpBody(
opts.request.body,
opts.debugTruncateBytes
);
} else if (opts.request.body !== undefined && opts.request.body !== null) {
// A streaming body is not drained, matching the Go SDK's <io.Reader>.
requestLog.requestBody = '<stream>';
}
if (opts.debugHeaders) {
requestLog.headers = redactHeaders(
opts.request.headers,
opts.debugTruncateBytes
);
}
opts.logger.debug('HTTP request', requestLog);

let resp: HttpResponse;
try {
Expand All @@ -86,10 +111,19 @@ export async function executeHttpCall(

const body = await readAll(resp.body);

opts.logger.debug('HTTP response', {
// Secret-bearing fields are redacted by key and every value is truncated, so
// the body is safe to log; matches the Go SDK.
const responseLog: Record<string, unknown> = {
statusCode: resp.statusCode,
body: new TextDecoder().decode(body),
});
body: redactedDumpBody(
new TextDecoder().decode(body),
opts.debugTruncateBytes
),
};
if (opts.debugHeaders) {
responseLog.headers = redactHeaders(resp.headers, opts.debugTruncateBytes);
}
opts.logger.debug('HTTP response', responseLog);

const apiErr = ApiError.fromHttpError(resp.statusCode, resp.headers, body);
if (apiErr !== undefined) {
Expand Down
17 changes: 17 additions & 0 deletions packages/alerts/src/v1/client.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ import {VERSION as AUTH_VERSION} from '@databricks/sdk-auth';
import {createDefault} from '@databricks/sdk-core/clientinfo';
import type {Logger} from '@databricks/sdk-core/logger';
import {NoOpLogger} from '@databricks/sdk-core/logger';
import {DEFAULT_DEBUG_TRUNCATE_BYTES} from '@databricks/sdk-core/logger/debug';
import type {CallOptions} from '@databricks/sdk-options/call';
import type {ClientOptions} from '@databricks/sdk-options/client';
import type {HttpClient} from '@databricks/sdk-core/http';
Expand Down Expand Up @@ -49,6 +50,9 @@ export class AlertsClient {
private readonly workspaceId: string | undefined;
private readonly httpClient: HttpClient;
private readonly logger: Logger;
// Resolved debug-logging toggles passed into each HTTP call.
private readonly debugHeaders: boolean;
private readonly debugTruncateBytes: number;
// User-Agent header value. Composed once at construction from
// createDefault() merged with this package's identity and the active
// credential's name.
Expand All @@ -61,6 +65,9 @@ export class AlertsClient {
this.host = options.host.replace(/\/$/, '');
this.workspaceId = options.workspaceId;
this.logger = options.logger ?? new NoOpLogger();
this.debugHeaders = options.debugHeaders ?? false;
this.debugTruncateBytes =
options.debugTruncateBytes ?? DEFAULT_DEBUG_TRUNCATE_BYTES;
const info = createDefault()
.with(PACKAGE_SEGMENT)
.with({key: 'sdk-js-auth', value: AUTH_VERSION})
Expand Down Expand Up @@ -88,6 +95,8 @@ export class AlertsClient {
request: httpReq,
httpClient: this.httpClient,
logger: this.logger,
debugHeaders: this.debugHeaders,
debugTruncateBytes: this.debugTruncateBytes,
});
resp = parseResponse(respBody, unmarshalAlertSchema);
};
Expand All @@ -113,6 +122,8 @@ export class AlertsClient {
request: httpReq,
httpClient: this.httpClient,
logger: this.logger,
debugHeaders: this.debugHeaders,
debugTruncateBytes: this.debugTruncateBytes,
});
resp = parseResponse(respBody, unmarshalAlertSchema);
};
Expand Down Expand Up @@ -150,6 +161,8 @@ export class AlertsClient {
request: httpReq,
httpClient: this.httpClient,
logger: this.logger,
debugHeaders: this.debugHeaders,
debugTruncateBytes: this.debugTruncateBytes,
});
resp = parseResponse(respBody, unmarshalListAlertsResponseSchema);
};
Expand Down Expand Up @@ -195,6 +208,8 @@ export class AlertsClient {
request: httpReq,
httpClient: this.httpClient,
logger: this.logger,
debugHeaders: this.debugHeaders,
debugTruncateBytes: this.debugTruncateBytes,
});
resp = parseResponse(respBody, unmarshalEmptySchema);
};
Expand Down Expand Up @@ -224,6 +239,8 @@ export class AlertsClient {
request: httpReq,
httpClient: this.httpClient,
logger: this.logger,
debugHeaders: this.debugHeaders,
debugTruncateBytes: this.debugTruncateBytes,
});
resp = parseResponse(respBody, unmarshalAlertSchema);
};
Expand Down
44 changes: 39 additions & 5 deletions packages/alerts/src/v1/utils.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,10 @@ import type {
HttpResponse,
} from '@databricks/sdk-core/http';
import type {Logger} from '@databricks/sdk-core/logger';
import {
redactedDumpBody,
redactHeaders,
} from '@databricks/sdk-core/logger/debug';
import type {CallOptions} from '@databricks/sdk-options/call';
import JSONBig from 'json-bigint';
import type {z} from 'zod';
Expand All @@ -22,6 +26,10 @@ export interface HttpCallOptions {
readonly request: HttpRequest;
readonly httpClient: HttpClient;
readonly logger: Logger;
// When true, redacted request/response headers are logged at debug level.
readonly debugHeaders: boolean;
// Per-value byte budget for debug-level body and header logs.
readonly debugTruncateBytes: number;
}

/**
Expand Down Expand Up @@ -71,10 +79,27 @@ async function readAll(
export async function executeHttpCall(
opts: HttpCallOptions
): Promise<Uint8Array> {
opts.logger.debug('HTTP request', {
const requestLog: Record<string, unknown> = {
method: opts.request.method,
url: opts.request.url,
});
};
// Bodies are logged independent of debugHeaders, matching the Go SDK.
if (typeof opts.request.body === 'string') {
requestLog.requestBody = redactedDumpBody(
opts.request.body,
opts.debugTruncateBytes
);
} else if (opts.request.body !== undefined && opts.request.body !== null) {
// A streaming body is not drained, matching the Go SDK's <io.Reader>.
requestLog.requestBody = '<stream>';
}
if (opts.debugHeaders) {
requestLog.headers = redactHeaders(
opts.request.headers,
opts.debugTruncateBytes
);
}
opts.logger.debug('HTTP request', requestLog);

let resp: HttpResponse;
try {
Expand All @@ -86,10 +111,19 @@ export async function executeHttpCall(

const body = await readAll(resp.body);

opts.logger.debug('HTTP response', {
// Secret-bearing fields are redacted by key and every value is truncated, so
// the body is safe to log; matches the Go SDK.
const responseLog: Record<string, unknown> = {
statusCode: resp.statusCode,
body: new TextDecoder().decode(body),
});
body: redactedDumpBody(
new TextDecoder().decode(body),
opts.debugTruncateBytes
),
};
if (opts.debugHeaders) {
responseLog.headers = redactHeaders(resp.headers, opts.debugTruncateBytes);
}
opts.logger.debug('HTTP response', responseLog);

const apiErr = ApiError.fromHttpError(resp.statusCode, resp.headers, body);
if (apiErr !== undefined) {
Expand Down
Loading
Loading