fix(core): redact secrets from structured log messages

Author: carderne

packages/core/src/logger.ts

@@ -38,9 +38,9 @@ const DEFAULT_FILTERED_KEYS = [
   "completedwaitpoints",
 ];
 
-// Belt-and-braces value-shape check: catches secrets that land under a field name we didn't
-// think to deny-list (a live trigger.dev API key, a bearer token, or an OpenAI-style secret key).
-const SECRET_VALUE_PATTERN = /^(tr_[a-zA-Z0-9_-]{4,}|sk-[a-zA-Z0-9_-]{4,}|Bearer\s+\S+)/;
+// Belt-and-braces value-shape check: catches secrets anywhere in values that land under a field
+// name we didn't think to deny-list (a trigger.dev API key, bearer token, or OpenAI-style key).
+const SECRET_VALUE_PATTERN = /(tr_[a-zA-Z0-9_-]{4,}|sk-[a-zA-Z0-9_-]{4,}|Bearer\s+\S+)/;
 
 // Per-field and per-structure caps so a single unbounded object (a run payload, a batch of
 // items, a DB row) can't blow up log line size or CPU. Truncation keeps the field present and
@@ -159,7 +159,7 @@ export class Logger {
     const currentSpan = trace.getSpan(context.active());
 
     const structuredError = extractStructuredErrorFromArgs(this.#filteredKeys, ...args);
-    const structuredMessage = extractStructuredMessageFromArgs(...args);
+    const structuredMessage = extractStructuredMessageFromArgs(this.#filteredKeys, ...args);
 
     const structuredLog = {
       ...structureArgs(safeJsonClone(args) as Record<string, unknown>[], this.#filteredKeys),
@@ -225,19 +225,23 @@ function extractStructuredErrorFromArgs(
       message: filterKeys(nestedError.message, filteredKeys),
       stack: filterKeys(nestedError.stack, filteredKeys),
       name: nestedError.name,
-      metadata: "metadata" in nestedError ? filterKeys(nestedError.metadata, filteredKeys) : undefined,
+      metadata:
+        "metadata" in nestedError ? filterKeys(nestedError.metadata, filteredKeys) : undefined,
     };
   }
 
   return;
 }
 
-function extractStructuredMessageFromArgs(...args: Array<Record<string, unknown> | undefined>) {
+function extractStructuredMessageFromArgs(
+  filteredKeys: Set<string>,
+  ...args: Array<Record<string, unknown> | undefined>
+) {
   // Check to see if there is a `message` key in the args, and if so, return it
   const structuredMessage = args.find((arg) => arg?.message);
 
   if (structuredMessage) {
-    return structuredMessage.message;
+    return filterKeys(structuredMessage.message, filteredKeys);
   }
 
   return;

packages/core/test/logger.test.ts

@@ -94,13 +94,13 @@ describe("Logger redaction", () => {
     expect(JSON.stringify(line)).not.toContain("tr_prod_secret_value");
   });
 
-  it("redacts values that look like a secret even under a non-denied key", () => {
+  it("redacts values that contain a secret even under a non-denied key", () => {
     const logger = new Logger("test", "info");
 
     const line = captureLogLine(() =>
       logger.info("value pattern check", {
-        someRandomField: "tr_live_abcdef123456",
-        anotherField: "Bearer some.jwt.value",
+        someRandomField: "request failed with tr_live_abcdef123456",
+        anotherField: "authorization used Bearer some.jwt.value",
         normalField: "just some text",
       })
     );
@@ -110,6 +110,19 @@ describe("Logger redaction", () => {
     expect(line.normalField).toBe("just some text");
   });
 
+  it("redacts a structured message before assigning it to $message", () => {
+    const logger = new Logger("test", "info");
+
+    const line = captureLogLine(() =>
+      logger.info("structured message check", {
+        message: "request failed with Bearer secret.jwt.value",
+      })
+    );
+
+    expect(line.$message).toMatch(/^\[filtered/);
+    expect(JSON.stringify(line)).not.toContain("secret.jwt.value");
+  });
+
   it("truncates strings longer than the per-field cap", () => {
     const logger = new Logger("test", "info");
     const longValue = "a".repeat(20_000);