contrib: add PII redaction helper for consumer-supplied logging hooks - #343
Merged
davedumto merged 1 commit intoAug 31, 2026
Merged
Conversation
Self-contained reference for issue Vellar-Wallet#291 under contrib/examples. The SDK hands structured details objects to consumer-supplied hooks like onDebugLog, which hosts typically pipe straight into their own logger. Those details can carry wallet-linkable identifiers: session-key public keys, the smart-account contract id, the WebAuthn credential id, and server-side session ids. Adds redactSensitiveFields, a pure helper that replaces any field matching a known-sensitive name with a redacted marker, case-insensitively, through nested objects and arrays, without flattening non-plain values like Error or Date and without looping on circular references. withRedaction wraps a hook once so no call site can forget to redact. Includes 15 tests, covering the redaction logic and verifying that raw sensitive values never appear in anything the wrapped hook receives, plus a README documenting the flagged fields and the redaction guidance.
|
@arandomogg is attempting to deploy a commit to the david's projects Team on Vercel. A member of the Team first needs to authorize it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a self-contained reference implementation under
contrib/examples/issue-291-pii-redaction-logging-hooks/for redacting known-sensitive fields before they reach a consumer-supplied logging hook.Scoped entirely to
contrib/per CONTRIBUTING.md andcontrib/README.md.The problem
The SDK never logs anything itself, but it does hand structured
detailsobjects to consumer-supplied hooks —onDebugLogoncreatePasskeyKitConnector(src/passkeykit-connector.ts) today — that a host typically pipes straight into their own logger or telemetry pipeline. Those objects can carry fields identifying a specific user or wallet. None are secrets the SDK holds, but they are stable, wallet-linkable identifiers a log aggregator or support export should not retain in plaintext.SDK-internal fields flagged as sensitive
secretKey,secret,privateKeypublicKey,previousPublicKey,newPublicKeyonDebugLogby session-key rotation.accountId,contractIdkeyIdWalletSession.keyId) — identifies the passkey/device.sessionId,serverSessionIdsignatureFiles
pii-redaction-logging-hooks.ts—SENSITIVE_LOG_FIELDS,redactSensitiveFields(value, options?), andwithRedaction(hook)which wraps a hook once so no call site can forget. Includes a runnablemain()demo.pii-redaction-logging-hooks.test.ts— 15 tests.README.md— the flagged-field table, usage both ways, and the redaction guidance.Non-plain values (
Error,Date, class/XDR instances) pass through untouched rather than being flattened; circular references become"[circular]"; a configurablemaxDepthbounds the walk;extraFieldscovers consumer-specific fields.Requirements checklist
contrib/)Test plan
15 tests, all passing — including two that assert the raw sensitive value never appears anywhere in what the wrapped hook received, checked by string search over the full captured payload rather than only structural equality.
closes #291