gorkem-bwl
e26825ef99
Follow-up to the initial redaction pass, addressing four defects: Class instances bypassed redaction entirely. The prototype guard was meant to skip FormData/Blob but caught every non-literal object, returning it by reference — so a credential on a DTO or form-state instance was logged verbatim, and the deep-copy contract was violated. The check is now an explicit deny-list of opaque types; everything else is walked. The raw Error was still logged by the debug branch. An AxiosError carries config.data (the serialized request body) and config.headers.Authorization (set for every request in ApiClient), so the password redacted from the context was printed straight back out via the error object. Errors now go through toSafeError(). Because Axios serializes the body to a string, which key-based redaction cannot see into, it is parsed before redaction; a body that is not JSON is replaced wholesale rather than logged raw. The Blob guard was gated on `typeof FormData !== "undefined"`, so in an environment with FormData but no Blob the instanceof check threw a ReferenceError — from inside a catch block, turning a handled API error into an unhandled crash. Each constructor is now resolved defensively. Also widened the key list (cookie, jwt, privateKey, sessionId, csrf, pwd) and dropped a redundant type annotation. Verified with 18 assertions covering the reported payload, class instances, cycles, shared siblings, axios error shapes, and a missing Blob global.
This directory contains the client side (frontend) of Checkmate.