zod secret mixin (#41)

Author: evantahler

README.md

@@ -155,6 +155,23 @@ Actions which have a `task` property can be scheduled as a task. A `queue` prope
 task = { queue: "default", frequency: 1000 * 60 * 60 }; // run the task every hour
 ```
 
+## Marking Secret Fields in Action Inputs
+
+You can mark sensitive fields in your zod schemas as secret using the custom `.secret()` mixin. This is useful for fields like passwords, API keys, or tokens that should never be logged or exposed in logs.
+
+**How to use:**
+
+```ts
+inputs = z.object({
+  email: z.string().email(),
+  password: z.string().min(8).secret(), // This field will be redacted in logs
+});
+```
+
+When an action is executed, any field marked with `.secret()` will be replaced with `[[secret]]` in logs and not exposed in any logging output, even if the action fails or validation errors occur.
+
+This works for any zod field type (string, number, etc). Simply chain `.secret()` to the field definition.
+
 ## Intentional changes from ActionHero
 
 **Multiple Applications**

backend/.prettierignore

@@ -0,0 +1 @@
+types/

backend/__tests__/actions/user.test.ts

@@ -3,6 +3,7 @@ import { api, type ActionResponse } from "../../api";
 import type { UserCreate, UserEdit } from "../../actions/user";
 import { config } from "../../config";
 import type { SessionCreate } from "../../actions/session";
+import { logger } from "../../api";
 
 const url = config.server.web.applicationUrl;
 
@@ -68,6 +69,41 @@ describe("user:create", () => {
     expect(response.error?.key).toEqual("name");
     expect(response.error?.value).toEqual("x");
   });
+
+  test("secret fields are redacted in logs", async () => {
+    // Mock the logger to capture log messages
+    const originalInfo = logger.info;
+    const logMessages: string[] = [];
+    logger.info = (message: string) => {
+      logMessages.push(message);
+    };
+
+    try {
+      const formData = new FormData();
+      formData.append("name", "Test User");
+      formData.append("email", "test@example.com");
+      formData.append("password", "secretpassword123");
+
+      const res = await fetch(url + "/api/user", {
+        method: "PUT",
+        body: formData,
+      });
+
+      // Find the log message that contains the action execution
+      const actionLogMessage = logMessages.find(
+        (msg) => msg.includes("[ACTION:") && msg.includes("user:create"),
+      );
+
+      expect(actionLogMessage).toBeDefined();
+      expect(actionLogMessage).toContain('"name":"Test User"');
+      expect(actionLogMessage).toContain('"email":"test@example.com"');
+      expect(actionLogMessage).toContain('"password":"[[secret]]"');
+      expect(actionLogMessage).not.toContain('"password":"secretpassword123"');
+    } finally {
+      // Restore original logger
+      logger.info = originalInfo;
+    }
+  });
 });
 
 describe("user:edit", () => {

backend/actions/session.ts

@@ -27,7 +27,8 @@ export class SessionCreate implements Action {
     password: z
       .string()
       .min(8, "Password must be at least 8 characters")
-      .describe("The user's password"),
+      .describe("The user's password")
+      .secret(),
   });
 
   // @ts-ignore - this is a valid action and response type, but sometimes the compiler doesn't like it

backend/actions/user.ts

@@ -30,7 +30,8 @@ export class UserCreate implements Action {
       .string()
       .min(8, "Password must be at least 8 characters")
       .max(256, "Password must be less than 256 characters")
-      .describe("The user's password"),
+      .describe("The user's password")
+      .secret(),
   });
 
   async run(params: ActionParams<UserCreate>) {
@@ -68,7 +69,7 @@ export class UserEdit implements Action {
   inputs = z.object({
     name: z.string().min(1).max(256).optional(),
     email: z.string().email().toLowerCase().optional(),
-    password: z.string().min(8).max(256).optional(),
+    password: z.string().min(8).max(256).optional().secret(),
   });
 
   async run(params: ActionParams<UserEdit>, connection: Connection) {

backend/classes/Connection.ts

@@ -6,6 +6,7 @@ import { ErrorType, TypedError } from "./TypedError";
 import type { SessionData } from "../initializers/session";
 import { randomUUID } from "crypto";
 import type { PubSubMessage } from "../initializers/pubsub";
+import "../util/zodSecretsMixin";
 
 export class Connection<T extends Record<string, any> = Record<string, any>> {
   type: string;
@@ -232,10 +233,26 @@ const REDACTED = "[[secret]]" as const;
 
 const sanitizeParams = (params: FormData, action: Action | undefined) => {
   const sanitizedParams: Record<string, any> = {};
+
+  // Get secret fields from the action's zod schema if it exists
+  const secretFields = new Set<string>();
+  if (action?.inputs && typeof action.inputs === "object") {
+    const zodSchema = action.inputs as any;
+    if (zodSchema._def?.typeName === "ZodObject" && zodSchema.shape) {
+      for (const [fieldName, fieldSchema] of Object.entries(zodSchema.shape)) {
+        if ((fieldSchema as any)._def?.isSecret) {
+          secretFields.add(fieldName);
+        }
+      }
+    }
+  }
+
   params.forEach((v, k) => {
-    // For now, we don't have a way to mark fields as secret in zod schemas
-    // This could be added later with a custom zod extension if needed
-    sanitizedParams[k] = v;
+    if (secretFields.has(k)) {
+      sanitizedParams[k] = REDACTED;
+    } else {
+      sanitizedParams[k] = v;
+    }
   });
 
   return sanitizedParams;

backend/util/formatters.ts

@@ -0,0 +1,64 @@
+import { z, type ZodTypeAny, type ZodRawShape } from "zod";
+
+// Custom zod extension to mark fields as secret
+// This module augmentation and prototype extension allows .secret() to be used on zod fields
+
+declare module "zod" {
+  interface ZodString {
+    secret(): ZodString;
+  }
+  interface ZodNumber {
+    secret(): ZodNumber;
+  }
+  interface ZodBoolean {
+    secret(): ZodBoolean;
+  }
+  interface ZodArray<T extends ZodTypeAny> {
+    secret(): ZodArray<T>;
+  }
+  interface ZodObject<T extends ZodRawShape> {
+    secret(): ZodObject<T>;
+  }
+  interface ZodOptional<T extends ZodTypeAny> {
+    secret(): ZodOptional<T>;
+  }
+  interface ZodNullable<T extends ZodTypeAny> {
+    secret(): ZodNullable<T>;
+  }
+  interface ZodDefault<T extends ZodTypeAny> {
+    secret(): ZodDefault<T>;
+  }
+}
+
+z.ZodString.prototype.secret = function () {
+  this._def.isSecret = true;
+  return this;
+};
+z.ZodNumber.prototype.secret = function () {
+  this._def.isSecret = true;
+  return this;
+};
+z.ZodBoolean.prototype.secret = function () {
+  this._def.isSecret = true;
+  return this;
+};
+z.ZodArray.prototype.secret = function () {
+  this._def.isSecret = true;
+  return this;
+};
+z.ZodObject.prototype.secret = function () {
+  this._def.isSecret = true;
+  return this;
+};
+z.ZodOptional.prototype.secret = function () {
+  this._def.isSecret = true;
+  return this;
+};
+z.ZodNullable.prototype.secret = function () {
+  this._def.isSecret = true;
+  return this;
+};
+z.ZodDefault.prototype.secret = function () {
+  this._def.isSecret = true;
+  return this;
+};

backend/util/zodSecretsMixin.ts

@@ -1 +1,2 @@
 .next/*
+types/