Keep the API token out of the errors the client throws

`ApiError` stored the options of the failed query verbatim, so
`error.options.token` held the API token in clear text — and travelled with the
error wherever it went: into `console.error()` output shipped to log
aggregators, into error trackers, and into any HTTP handler that caught it and
echoed it back to its caller. Our own tech starters did the latter, which turned
a 500 into a way to read the token.

The token is now replaced by `[REDACTED, ending in abcd]`, which still tells two
tokens apart while debugging; the real one only ever reaches the `Authorization`
header. For the same reason `query`, `options` and `response` are no longer
enumerable: reading `error.options` explicitly works exactly as before, as the
README documents, but the details of the failed query stop travelling through
`JSON.stringify()`, object spread or `serialize-error` by accident.

Claude-Session: https://claude.ai/code/session_01VQGrgtFYHo3vSXkifJ1bom

Author: stefanoverna

.changeset/quiet-tokens-hide.md

@@ -0,0 +1,17 @@
+---
+'@datocms/cda-client': patch
+---
+
+Keep the API token out of the errors the client throws
+
+`ApiError` stored the options of the failed query verbatim, so `error.options.token`
+held the API token in clear text — and travelled with the error into
+`console.error()` output shipped to log aggregators, into error trackers, and
+into any HTTP handler that echoed the error back to its caller.
+
+The token is now replaced by `[REDACTED, ending in abcd]`, which still tells two
+tokens apart while debugging; the real one only ever reaches the `Authorization`
+header. For the same reason `query`, `options` and `response` are now
+non-enumerable: reading `error.options` explicitly works exactly as before, but
+the details of the failed query no longer travel through `JSON.stringify()`,
+object spread or `serialize-error` by accident.

README.md

@@ -260,7 +260,9 @@ try {
   console.log(result);
 } catch (e) {
   if (e instanceof ApiError) {
-    // Information about the failed request
+    // Information about the failed request. The API token is redacted from
+    // `e.options`: an error tends to end up in logs and error trackers, which
+    // are no place for a token.
     console.log(e.query);
     console.log(e.options);
 

src/ApiError.ts

@@ -17,6 +17,41 @@ export type ApiErrorResponse = {
  */
 const API_ERROR = Symbol.for('@datocms/cda-client:ApiError');
 
+/**
+ * Returns a copy of the options with the API token blanked out.
+ *
+ * Errors travel: they get logged, serialized, sent to error trackers, and
+ * occasionally echoed back to an HTTP client by a route handler that catches
+ * them. None of those places is a good home for a token. The real one only ever
+ * reaches the `Authorization` header of the request.
+ */
+function redactToken<Options extends BuildRequestHeadersOptions>(
+  options: Options,
+): Options {
+  if (!options.token) {
+    return options;
+  }
+
+  return {
+    ...options,
+    // The last 4 characters are enough to tell two tokens apart while
+    // debugging, and useless to whoever gets hold of the log.
+    token: `[REDACTED, ending in ${options.token.slice(-4)}]`,
+  };
+}
+
+/**
+ * Hides properties from anything that walks own enumerable keys —
+ * `console.error()`, `JSON.stringify()`, object spread, `serialize-error`,
+ * error trackers. Reading `error.options` explicitly keeps working exactly as
+ * before; the data just stops travelling by accident.
+ */
+function hideProperties(target: object, keys: string[]) {
+  for (const key of keys) {
+    Object.defineProperty(target, key, { enumerable: false });
+  }
+}
+
 export class ApiError extends Error {
   public query: string;
   public options: BuildRequestHeadersOptions;
@@ -85,6 +120,8 @@ export class ApiError extends Error {
     this.name = 'ApiError';
     this.response = response;
     this.query = query;
-    this.options = options;
+    this.options = redactToken(options);
+
+    hideProperties(this, ['query', 'options', 'response']);
   }
 }

src/__test__/ApiError.test.ts

@@ -48,7 +48,24 @@ describe('ApiError', () => {
 
     expect(error.response.status).toBe(422);
     expect(error.query).toBe('{ allArticles { id } }');
-    expect(error.options.token).toBe('fake-token');
+  });
+
+  it('keeps the API token out of the error', () => {
+    const error = buildError();
+
+    expect(error.options.token).toBe('[REDACTED, ending in oken]');
+    expect(JSON.stringify(error)).not.toContain('fake-token');
+  });
+
+  // `console.error()`, `serialize-error` and most error trackers walk own
+  // enumerable keys: the details of the failed request must not be among them.
+  it('does not travel through incidental serialization', () => {
+    const error = buildError();
+
+    expect(Object.keys(error)).not.toContain('options');
+    expect(Object.keys(error)).not.toContain('query');
+    expect(Object.keys(error)).not.toContain('response');
+    expect(JSON.stringify({ ...error })).not.toContain('allArticles');
   });
 
   // The package ships parallel CJS and ESM builds, so a bundler can load two