Function sanitizeAuditMetadata

packages/server/src/utils/sanitize.util.ts:116–175

(metadata: Record<string, any> | undefined | null)

 * @returns A sanitized metadata object safe for audit logging
 */
export function sanitizeAuditMetadata(metadata: Record<string, any> | undefined | null): Record<string, any> {
    if (!metadata) return {}

    const sensitiveFields = [
        'password',
        'pwd',
        'pass',
        'secret',
        'token',
        'apikey',
        'api_key',
        'accesstoken',
        'access_token',
        'refreshtoken',
        'refresh_token',
        'clientsecret',
        'client_secret',
        'privatekey',
        'private_key',
        'secretkey',
        'secret_key',
        'auth',
        'authorization',
        'credential',
        'credentials',
        'ssn',
        'socialsecurity',
        'creditcard',
        'cvv'
    ]

    function sanitizeValue(value: any, key: string): any {
        const lowerKey = key.toLowerCase()
        const isSensitive = sensitiveFields.some((field) => lowerKey.includes(field))

        if (isSensitive) {
            return '********'
        }

        if (value && typeof value === 'object' && !Array.isArray(value)) {
            return sanitizeObject(value)
        }

        if (Array.isArray(value)) {
            return value.map((item, index) => sanitizeValue(item, `${key}[${index}]`))
        }

        return value
    }

    function sanitizeObject(obj: Record<string, any>): Record<string, any> {
        const result: Record<string, any> = {}
        for (const key of Object.keys(obj)) {
            result[key] = sanitizeValue(obj[key], key)
        }
        return result
    }