PR feedback, back to simplified approach, no export on client as well

packages/cache/src/internal/shared/cacheTwirpClient.ts

@@ -25,7 +25,7 @@ interface Rpc {
  *
  * This class is used to interact with cache service v2.
  */
-export class CacheServiceClient implements Rpc {
+class CacheServiceClient implements Rpc {
   private httpClient: HttpClient
   private baseUrl: string
   private maxAttempts = 5

packages/cache/src/internal/shared/util.ts

@@ -10,166 +10,44 @@ export function maskSigUrl(url: string): string {
   if (!url) return url
 
   try {
-    const rawSigRegex = /[?&](sig)=([^&=#]+)/gi
-    let match
+    const parsedUrl = new URL(url)
+    const signature = parsedUrl.searchParams.get('sig')
 
-    while ((match = rawSigRegex.exec(url)) !== null) {
-      const rawSignature = match[2]
-      if (rawSignature) {
-        setSecret(rawSignature)
-      }
-    }
-
-    let parsedUrl: URL
-    try {
-      parsedUrl = new URL(url)
-    } catch {
-      try {
-        parsedUrl = new URL(url, 'https://example.com')
-      } catch (error) {
-        debug(`Failed to parse URL: ${url}`)
-        return maskSigWithRegex(url)
-      }
-    }
-
-    let masked = false
-    const paramNames = Array.from(parsedUrl.searchParams.keys())
-
-    for (const paramName of paramNames) {
-      if (paramName.toLowerCase() === 'sig') {
-        const signature = parsedUrl.searchParams.get(paramName)
-        if (signature) {
-          setSecret(signature)
-          setSecret(encodeURIComponent(signature))
-          parsedUrl.searchParams.set(paramName, '***')
-          masked = true
-        }
-      }
-    }
-    if (masked) {
+    if (signature) {
+      setSecret(signature)
+      setSecret(encodeURIComponent(signature))
+      parsedUrl.searchParams.set('sig', '***')
       return parsedUrl.toString()
     }
-
-    if (/([:?&]|^)(sig)=([^&=#]+)/i.test(url)) {
-      return maskSigWithRegex(url)
-    }
   } catch (error) {
     debug(
-      `Error masking URL: ${
+      `Failed to parse URL: ${url} ${
         error instanceof Error ? error.message : String(error)
       }`
     )
-    return maskSigWithRegex(url)
   }
-
   return url
 }
 
-/**
- * Fallback method to mask signatures using regex when URL parsing fails
- */
-function maskSigWithRegex(url: string): string {
-  try {
-    const regex = /([:?&]|^)(sig)=([^&=#]+)/gi
-
-    return url.replace(regex, (fullMatch, prefix, paramName, value) => {
-      if (value) {
-        setSecret(value)
-        try {
-          setSecret(decodeURIComponent(value))
-        } catch (error) {
-          debug(
-            `Failed to decode URL parameter: ${
-              error instanceof Error ? error.message : String(error)
-            }`
-          )
-        }
-        return `${prefix}${paramName}=***`
-      }
-      return fullMatch
-    })
-  } catch (error) {
-    debug(
-      `Error in maskSigWithRegex: ${
-        error instanceof Error ? error.message : String(error)
-      }`
-    )
-    return url
-  }
-}
-
 /**
  * Masks any URLs containing signature parameters in the provided object
- * Recursively searches through nested objects and arrays
  */
-export function maskSecretUrls(
-  body: Record<string, unknown> | unknown[] | null
-): void {
+export function maskSecretUrls(body: Record<string, unknown> | null): void {
   if (typeof body !== 'object' || body === null) {
     debug('body is not an object or is null')
     return
   }
 
-  type NestedValue =
-    | string
-    | number
-    | boolean
-    | null
-    | undefined
-    | NestedObject
-    | NestedArray
-  interface NestedObject {
-    [key: string]: NestedValue
-    signed_upload_url?: string
-    signed_download_url?: string
+  if (
+    'signed_upload_url' in body &&
+    typeof body.signed_upload_url === 'string'
+  ) {
+    maskSigUrl(body.signed_upload_url)
   }
-  type NestedArray = NestedValue[]
-
-  const processUrl = (url: string): void => {
-    maskSigUrl(url)
+  if (
+    'signed_download_url' in body &&
+    typeof body.signed_download_url === 'string'
+  ) {
+    maskSigUrl(body.signed_download_url)
   }
-
-  const processObject = (
-    obj: Record<string, NestedValue> | NestedValue[]
-  ): void => {
-    if (typeof obj !== 'object' || obj === null) {
-      return
-    }
-
-    if (Array.isArray(obj)) {
-      for (const item of obj) {
-        if (typeof item === 'string') {
-          processUrl(item)
-        } else if (typeof item === 'object' && item !== null) {
-          processObject(item as Record<string, NestedValue> | NestedValue[])
-        }
-      }
-      return
-    }
-
-    if (
-      'signed_upload_url' in obj &&
-      typeof obj.signed_upload_url === 'string'
-    ) {
-      maskSigUrl(obj.signed_upload_url)
-    }
-    if (
-      'signed_download_url' in obj &&
-      typeof obj.signed_download_url === 'string'
-    ) {
-      maskSigUrl(obj.signed_download_url)
-    }
-
-    for (const key in obj) {
-      const value = obj[key]
-      if (typeof value === 'string') {
-        if (/([:?&]|^)(sig)=/i.test(value)) {
-          maskSigUrl(value)
-        }
-      } else if (typeof value === 'object' && value !== null) {
-        processObject(value as Record<string, NestedValue> | NestedValue[])
-      }
-    }
-  }
-  processObject(body as Record<string, NestedValue> | NestedValue[])
 }