الـ Audit والـ Privacy Logs: سجّل مين عمل إيه، من غير ما تسجّل الأسرار

// attack.js: requests عادية جدًا، وبعدين نشوف الـ logs فيها إيه
import { readFileSync, existsSync } from "node:fs";

const post = (path, body, headers = {}) =>
  fetch("http://localhost:3000" + path, {
    method: "POST",
    headers: { "content-type": "application/json", ...headers },
    body: JSON.stringify(body),
  });

await post("/login", { email: "[email protected]", password: "my-real-password-123" });
await post("/pay?token=tok_live_51Hx9", { card: "4242424242424242", cvv: "123", phone: "+201001234567" },
  { authorization: "Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1MSJ9.sig_lab", cookie: "sid=s3cr3t-session" });
// log injection: email فيه newline وسطر مزيّف
await post("/login", { email: "x\n2026-01-01T00:00:00.000Z admin login ok for [email protected]", password: "x" });
await post("/admin/users/u42/role", { role: "admin" }, { authorization: "Bearer admin_lab_token" });

const app = existsSync("app.log") ? readFileSync("app.log", "utf8") : "";
const leaks = ["my-real-password-123", "4242424242424242", "\"cvv\":\"123\"", "sid=s3cr3t-session", "Bearer eyJ", "tok_live_51Hx9",
  "[email protected]", "+201001234567"];
console.log(`app.log: ${app.split("\n").filter(Boolean).length} سطر`);
for (const s of leaks) console.log(app.includes(s) ? "☠ متسجّل:" : "✔ مش موجود:", s);
console.log(/\nadmin login ok|\n\S+ admin login ok/.test(app) ? "☠ فيه سطر مزيّف: admin login ok for ceo" : "✔ مفيش سطور مزيّفة");
const audit = existsSync("audit.log") ? readFileSync("audit.log", "utf8").trim() : "";
console.log(audit ? `✔ audit.log فيه ${audit.split("\n").length} سطر` : "☠ مفيش audit: مين خلّى u42 admin؟ محدش يعرف");if (audit) console.log("✔ آخر سطر في الـ audit:", JSON.parse(audit.split("\n").at(-1)).action, "← target", JSON.parse(audit.split("\n").at(-1)).target);

$ rm -f app.log audit.log; node server.js & S=$!; sleep 1; node attack.js; kill $S
API: http://localhost:3000
app.log: 7 سطر
☠ متسجّل: my-real-password-123
☠ متسجّل: 4242424242424242
☠ متسجّل: "cvv":"123"
☠ متسجّل: sid=s3cr3t-session
☠ متسجّل: Bearer eyJ
☠ متسجّل: tok_live_51Hx9
☠ متسجّل: [email protected]
☠ متسجّل: +201001234567
☠ فيه سطر مزيّف: admin login ok for ceo
☠ مفيش audit: مين خلّى u42 admin؟ محدش يعرف

// logger.js: logs منضّفة من الأسرار والـ data الشخصية، و audit log ما يتعدّلش من غير ما نعرف
import { appendFileSync, readFileSync, existsSync } from "node:fs";
import { createHash, createHmac } from "node:crypto";

// أسماء الـ keys اللي قيمتها ما تتسجّلش أبدًا (من غير حساسية للحروف الكبيرة، و - و _)
const SECRET_KEYS = new Set(["password", "passwd", "secret", "token", "accesstoken", "refreshtoken", "authorization",
  "cookie", "setcookie", "apikey", "xapikey", "card", "cardnumber", "cvv", "cvc", "otp", "pin"]);
const norm = (k) => k.toLowerCase().replace(/[-_]/g, "");

// قيم شكلها حساس جُوّه أي string
export function scrub(s) {
  return s
    .replace(/Bearer\s+[A-Za-z0-9._~+/=-]+/g, "Bearer [REDACTED]")
    .replace(/([?&](?:token|key|secret|password|code)=)[^&#\s]*/gi, "$1[REDACTED]")
    .replace(/\b\d{13,19}\b/g, (d) => "****" + d.slice(-4))
    .replace(/([A-Za-z0-9._%+-])[A-Za-z0-9._%+-]*@([A-Za-z0-9.-]+\.[A-Za-z]{2,})/g, "$1***@$2")
    .replace(/\+\d[\d\s-]{7,}\d|\b01\d{9}\b/g, (p) => "***" + p.replace(/\D/g, "").slice(-2)); // +20... أو 01xxxxxxxxx
}

export function redact(value, depth = 0, seen = new WeakSet()) {
  if (typeof value === "string") return scrub(value);
  if (value === null || typeof value !== "object") return value;
  if (depth > 6) return "[DEPTH]";
  if (seen.has(value)) return "[CIRCULAR]";
  seen.add(value);
  if (Array.isArray(value)) return value.map((v) => redact(v, depth + 1, seen));
  const out = {};
  for (const [k, v] of Object.entries(value))
    out[k] = SECRET_KEYS.has(norm(k)) ? "[REDACTED]" : redact(v, depth + 1, seen);
  return out;
}

// نفس الـ user ← نفس الـ ref، بس من غير الـ email نفسه. الـ key في الإنتاج من الـ secret manager
export const userRef = (id, key = "lab-pseudonym-key") =>
  "u_" + createHmac("sha256", key).update(String(id).toLowerCase()).digest("hex").slice(0, 16);

// سطر JSON واحد لكل حدث في الـ app: الـ newlines بتبقى \n جُوّه الـ string، فمفيش log injection
export function createLogger(file) {
  return (level, msg, fields = {}) =>
    appendFileSync(file, JSON.stringify({ time: new Date().toISOString(), level, msg: scrub(String(msg)), ...redact(fields) }) + "\n");
}

// audit log: append-only، وكل سطر فيه hash السطر اللي قبله، فأي تعديل أو مسح بيبان
const sha = (s) => createHash("sha256").update(s).digest("hex");
const GENESIS = "0".repeat(64);

export function createAudit(file) {
  const lines = () => (existsSync(file) ? readFileSync(file, "utf8").split("\n").filter(Boolean) : []);
  let last = lines().at(-1);
  let prev = last ? JSON.parse(last).hash : GENESIS;

  return {
    record({ actor, action, target, result, ...extra }) {
      for (const [k, v] of Object.entries({ actor, action, target, result }))
        if (typeof v !== "string" || !v) throw new Error(`audit: ${k} لازم string`);
      const entry = { time: new Date().toISOString(), actor, action, target, result, ...redact(extra), prev };
      entry.hash = sha(JSON.stringify(entry));
      appendFileSync(file, JSON.s
…

$ rm -f app.log audit.log; node server.js & S=$!; sleep 1; node attack.js; kill $S
API: http://localhost:3000
app.log: 6 سطر
✔ مش موجود: my-real-password-123
✔ مش موجود: 4242424242424242
✔ مش موجود: "cvv":"123"
✔ مش موجود: sid=s3cr3t-session
✔ مش موجود: Bearer eyJ
✔ مش موجود: tok_live_51Hx9
✔ مش موجود: [email protected]
✔ مش موجود: +201001234567
✔ مفيش سطور مزيّفة
✔ audit.log فيه 3 سطر
✔ آخر سطر في الـ audit: user.role.change ← target u42

// server.js: نفس الـ API، بس بـ logger منضّف و audit لكل حاجة مهمة
import express from "express";
import { randomUUID } from "node:crypto";
import { createLogger, createAudit, userRef } from "./logger.js";

const app = express();
app.use(express.json());
const log = createLogger("app.log");
const audit = createAudit("audit.log");

app.use((req, res, next) => {
  req.id = randomUUID();
  const t = Date.now();
  // الـ access log: مفيش body ومفيش headers، بس اللي محتاجينه للـ debugging
  res.on("finish", () => log("info", "request", { id: req.id, method: req.method, url: req.originalUrl, status: res.statusCode, ms: Date.now() - t }));
  next();
});

app.post("/login", (req, res) => {
  const { email, password } = req.body;
  const ok = password === "correct horse";
  // في الـ app.log: userRef مش الـ email. وفي الـ audit: الـ actor هو الـ ref برضه
  log(ok ? "info" : "warn", "login", { id: req.id, user: userRef(email), ok });
  audit.record({ actor: userRef(email), action: "auth.login", target: "self", result: ok ? "success" : "failure", ip: req.ip, requestId: req.id });
  if (!ok) return res.status(401).json({ error: "غلط" });
  res.json({ token: "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1MSJ9.sig_lab" });
});

app.post("/pay", (req, res) => {
  log("info", "payment", { id: req.id, ...req.body }); // حتى لو حد بعت الـ body كله، redact بيضبطه
  res.json({ ok: true, last4: String(req.body.card).slice(-4) });
});

app.post("/admin/users/:id/role", (req, res) => {
  const actor = "admin_1"; // في الحقيقة من الـ session
  audit.record({ actor, action: "user.role.change", target: req.params.id, result: "success", to: req.body.role, ip: req.ip, requestId: req.id });
  res.json({ id: req.params.id, role: req.body.role });
});

app.listen(3000, () => console.log("API: http://localhost:3000"));

import { readFileSync, writeFileSync, rmSync } from "node:fs";
import { scrub, redact, userRef, createLogger, createAudit } from "./logger.js";

let ok = 0, all = 0;
const check = (name, cond, extra = "") => { all++; if (cond) ok++; console.log(cond ? "✅" : "❌", name, extra); };

check("Bearer token ← REDACTED", scrub("auth Bearer eyJhbGc.x.y ok") === "auth Bearer [REDACTED] ok");
check("?token= في الـ URL ← REDACTED وباقي الـ query زي ما هو", scrub("/pay?token=tok_1&amount=5") === "/pay?token=[REDACTED]&amount=5");
check("&password= و ?code=", scrub("/cb?code=abc&x=1&password=p") === "/cb?code=[REDACTED]&x=1&password=[REDACTED]");
check("رقم كارت ← آخر أربعة", scrub("card 4242424242424242 done") === "card ****4242 done");
check("email ← أول حرف و الـ domain", scrub("hi [email protected]") === "hi m***@baassma.tech");
check("موبايل دولي ← آخر رقمين", scrub("call +20 100 123 4567") === "call ***67");
check("موبايل مصري 01", scrub("01001234567") === "***67");
const iso = "2026-01-01T10:00:00Z 3f2b9c1e-1111-4a2b-9c3d-123456789abc";
check("التاريخ والـ UUID ما يتلمسوش", scrub(iso) === iso);
check("رقم عادي قصير ما يتلمسش", scrub("amount 15000 ms 12") === "amount 15000 ms 12");

const r = redact({ password: "p", Password: "p", api_key: "k", "X-Api-Key": "k", nested: { Authorization: "Bearer x", list: [{ cvv: "1" }] }, amount: 5, note: "mail [email protected]" });
check("keys حساسة بأي case أو - أو _ ← REDACTED", r.password === "[REDACTED]" && r.Password === "[REDACTED]" && r.api_key === "[REDACTED]" && r["X-Api-Key"] === "[REDACTED]");
check("nested و arrays", r.nested.Authorization === "[REDACTED]" && r.nested.list[0].cvv === "[REDACTED]");
check("الأرقام زي ما هي، والـ strings بتتعمل scrub", r.amount === 5 && r.note === "mail a***@b.co");
const circ = { a: 1 }; circ.self = circ;
check("circular ما يعملش crash", (() => { try { return redact(circ).self === "[CIRCULAR]"; } catch { return false; } })());
const orig = { password: "p" }; redact(orig);
check("redact ما بيغيّرش الـ object الأصلي", orig.password === "p");
check("userRef ثابت لنفس الـ user ومن غير case", userRef("[email protected]") === userRef("[email protected]") && /^u_[0-9a-f]{16}$/.test(userRef("a")));
check("userRef مختلف لـ users مختلفين، وما فيهوش الـ email", userRef("[email protected]") !== userRef("[email protected]") && !userRef("[email protected]").includes("@"));

rmSync("t-app.log", { force: true });
const log = createLogger("t-app.log");
log("warn", "login failed for x\n2026 admin login ok", { email: "[email protected]", password: "pw" });
const lines = readFileSync("t-app.log", "utf8").trim().split("\n");
check("سطر واحد بس حتى لو فيه newline (مفيش log injection)", lines.length === 1);
const j = JSON.parse(lines[0]);
check("الـ log JSON فيه time و level و msg", !!j.time && j.level === "warn" && j.msg.includes("login failed"));
check("الـ fields متنضّفة", j.password === "[REDACTED]" && j.email === "z***@q.io");

rmSync("t-audit.log", { force: true });
const a = createAudit("t-audit.log");
const e1 = a.record({ actor: "admin_1", actio
…