From 4d4aba57f25dfecefd045485f19be9daa40a44f1 Mon Sep 17 00:00:00 2001 From: swithek <52840391+swithek@users.noreply.github.com> Date: Mon, 31 Aug 2026 11:11:16 +0200 Subject: [PATCH] update docker files --- Makefile | 5 +- docker/prod/Dockerfile | 29 +++- docker/prod/README.md | 24 ++- docker/prod/launcher/src/sentry.test.ts | 15 +- docker/prod/launcher/src/sentry.ts | 29 ++++ server/auth-realtime/src/sentry.ts | 14 ++ server/core/pkg/sentryutil/sentryutil.go | 23 +++ web/packages/README.lezer-promql.md | 5 + web/packages/lezer-promql/.gitignore | 1 - web/packages/lezer-promql/LICENSE | 201 +++++++++++++++++++++++ web/packages/lezer-promql/NOTICE | 24 +++ web/sentry.client.config.ts | 16 +- web/sentry.server.config.ts | 16 +- 13 files changed, 380 insertions(+), 22 deletions(-) create mode 100644 web/packages/lezer-promql/LICENSE create mode 100644 web/packages/lezer-promql/NOTICE diff --git a/Makefile b/Makefile index a72663ef..b4a92881 100644 --- a/Makefile +++ b/Makefile @@ -154,7 +154,8 @@ prod-build: # is built from the tag instead of as a snapshot — a snapshot would report # itself as version dev in a dev environment — and the result is pushed as # latest and the version rather than loaded locally. These are the only two -# tags the registry gets. +# tags the registry gets. The version and commit also become OCI labels, +# which is what links the package to this repository on ghcr. .PHONY: prod-publish prod-publish: @test -n "$(RELEASE_VERSION)" || { echo "RELEASE_VERSION is required, e.g. 1.2.3"; exit 1; } @@ -163,6 +164,8 @@ prod-publish: cp server/core/bin/oxynote-core docker/prod/.build/oxynote-core docker buildx build --platform linux/amd64 $(PROD_BUILD_EXTRA) \ -f docker/prod/Dockerfile \ + --build-arg IMAGE_VERSION=$(RELEASE_VERSION) \ + --build-arg IMAGE_REVISION=$$(git rev-parse HEAD) \ -t ghcr.io/oxynote/oxynote:latest \ -t ghcr.io/oxynote/oxynote:$(RELEASE_VERSION) \ --push . diff --git a/docker/prod/Dockerfile b/docker/prod/Dockerfile index a6fc32cc..e54a08ff 100644 --- a/docker/prod/Dockerfile +++ b/docker/prod/Dockerfile @@ -81,10 +81,10 @@ ARG SENTRY_LAUNCHER_DSN="" RUN pnpm run check-types && pnpm run build:bundle -# caddy and tini at pinned versions, checksum-verified before use. The -# caddy release tarball also carries the Apache-2.0 LICENSE the final image -# ships (the name "Caddy" is trademarked; the binary is bundled unmodified -# and unrebranded). +# caddy and tini at pinned versions, checksum-verified before use. Both +# licenses ship in the final image: caddy's Apache-2.0 rides in its release +# tarball, tini's MIT is fetched from the same tag as its binary. The name +# "Caddy" is trademarked; the binary is bundled unmodified and unrebranded. FROM node:24.19.0-bookworm-slim@sha256:a9f5f7c91a432850b2a8a7797adf5eadb6c733ceed61167806cee7ea7fbc29df AS fetch ARG CADDY_VERSION=2.11.4 @@ -99,8 +99,10 @@ WORKDIR /fetch RUN curl -fsSLo caddy.tar.gz "https://github.com/caddyserver/caddy/releases/download/v${CADDY_VERSION}/caddy_${CADDY_VERSION}_linux_amd64.tar.gz" \ && echo "${CADDY_SHA512} caddy.tar.gz" | sha512sum -c - \ && tar -xzf caddy.tar.gz caddy LICENSE \ + && mv LICENSE caddy-LICENSE \ && curl -fsSLo tini "https://github.com/krallin/tini/releases/download/v${TINI_VERSION}/tini-static-amd64" \ && echo "${TINI_SHA256} tini" | sha256sum -c - \ + && curl -fsSLo tini-LICENSE "https://raw.githubusercontent.com/krallin/tini/v${TINI_VERSION}/LICENSE" \ && chmod 0755 caddy tini # the runtime node is alpine's own build — v24 linked against shared @@ -129,7 +131,8 @@ RUN apk add --no-cache "nodejs=${NODE_APK_VERSION}" "icu-data-full=${ICU_DATA_AP COPY --from=fetch /fetch/tini /tini COPY --from=fetch /fetch/caddy /usr/local/bin/caddy -COPY --from=fetch /fetch/LICENSE /oxynote/licenses/caddy/LICENSE +COPY --from=fetch /fetch/caddy-LICENSE /oxynote/licenses/caddy/LICENSE +COPY --from=fetch /fetch/tini-LICENSE /oxynote/licenses/tini/LICENSE # staged by `make prod-build` from goreleaser's output. COPY docker/prod/.build/oxynote-core /oxynote/core/server @@ -140,6 +143,22 @@ COPY --from=launcher-builder /launcher/dist/launcher.mjs /oxynote/prod/launcher. COPY docker/prod/healthcheck.mjs /oxynote/prod/healthcheck.mjs COPY docker/prod/Caddyfile /oxynote/prod/Caddyfile +# what ghcr reads to link the package to this repository, and what a +# scanner reads to tell one build from another. IMAGE_VERSION and +# IMAGE_REVISION come from `make prod-publish`; a local build leaves them +# at dev/unknown. +ARG IMAGE_VERSION=dev +ARG IMAGE_REVISION=unknown +LABEL org.opencontainers.image.title="Oxynote" \ + org.opencontainers.image.description="Collaborative documentation, in one container" \ + org.opencontainers.image.source="https://github.com/oxynote/oxynote" \ + org.opencontainers.image.url="https://github.com/oxynote/oxynote" \ + org.opencontainers.image.documentation="https://github.com/oxynote/oxynote/blob/main/docker/prod/README.md" \ + org.opencontainers.image.licenses="Apache-2.0" \ + org.opencontainers.image.vendor="Oxynote" \ + org.opencontainers.image.version="${IMAGE_VERSION}" \ + org.opencontainers.image.revision="${IMAGE_REVISION}" + ENV NODE_ENV=production ENV HOME=/oxynote diff --git a/docker/prod/README.md b/docker/prod/README.md index cc4dde04..54d1da7e 100644 --- a/docker/prod/README.md +++ b/docker/prod/README.md @@ -102,18 +102,26 @@ GitHub/Slack install-state keys) are generated on first boot and stored under ## Error reporting Official images carry Sentry DSNs baked in at build time, so crashes in -self-hosted deployments can reach the Oxynote team. DSNs are write-only -ingest addresses — they expose nothing about your instance. Set -`OXYNOTE_CRASH_REPORTING_DISABLED=true` to switch reporting off entirely. -Locally built images carry no DSNs and report nothing. +self-hosted deployments can reach the Oxynote team. A DSN is a write-only +ingest address: it lets the image send events, never read them, and nothing +can be queried through it. + +What an event carries is the crash itself — the error, its stack trace, the +component and release, the container's hostname, and the request path that +failed. Every component runs with personal-data collection off, so no +cookies, request bodies or client IPs are attached, and no document content +is sent. An error message can still quote what it was working on, so treat the +reports as diagnostic data leaving your deployment, and switch them off with +`OXYNOTE_CRASH_REPORTING_DISABLED=true` if that is not acceptable. Locally +built images carry no DSNs and report nothing. ## Bundled software The image bundles [the Caddy web server](https://github.com/caddyserver/caddy) -unmodified (Apache-2.0; its license ships at `/oxynote/licenses/caddy/LICENSE`) -and [tini](https://github.com/krallin/tini) (MIT) as the init process. Both -are downloaded at pinned versions and checksum-verified during the image -build. Node.js comes from the pinned Alpine base (the v24 line, with full +unmodified (Apache-2.0) and [tini](https://github.com/krallin/tini) (MIT) as +the init process. Both are downloaded at pinned versions and +checksum-verified during the image build, and both licenses ship under +`/oxynote/licenses/`. Node.js comes from the pinned Alpine base (the v24 line, with full ICU locale data). Currently the image is built for `linux/amd64`. diff --git a/docker/prod/launcher/src/sentry.test.ts b/docker/prod/launcher/src/sentry.test.ts index ed032e11..7699ad65 100644 --- a/docker/prod/launcher/src/sentry.test.ts +++ b/docker/prod/launcher/src/sentry.test.ts @@ -32,7 +32,7 @@ function harness(overrides: { flush?: () => Promise } = {}): { } describe("createCrashReporter", () => { - it("initializes sentry with the baked dsn and no tracing", ({ + it("initializes sentry with the baked dsn, no tracing and no data collection", ({ expect, }) => { const h = harness() @@ -47,6 +47,19 @@ describe("createCrashReporter", () => { dsn: "https://key@sentry.test/1", environment: "production", tracesSampleRate: 0, + dataCollection: { + userInfo: false, + cookies: false, + httpHeaders: { + request: false, + response: false, + }, + httpBodies: [], + urlQueryParams: false, + genAI: { inputs: false, outputs: false }, + databaseQueryData: false, + stackFrameVariables: false, + }, }) }) diff --git a/docker/prod/launcher/src/sentry.ts b/docker/prod/launcher/src/sentry.ts index 8fb17546..93b50021 100644 --- a/docker/prod/launcher/src/sentry.ts +++ b/docker/prod/launcher/src/sentry.ts @@ -7,11 +7,26 @@ // never alive, and without this the operator sees only a container that // exited. +// the categories the SDK collects, as passed below. Spelled out here +// rather than imported so the injected client stays a structural type a +// test can satisfy with three functions. +export interface DataCollection { + userInfo: boolean + cookies: boolean + httpHeaders: { request: boolean; response: boolean } + httpBodies: never[] + urlQueryParams: boolean + genAI: { inputs: boolean; outputs: boolean } + databaseQueryData: boolean + stackFrameVariables: boolean +} + export interface SentryClient { init(options: { dsn: string environment: string tracesSampleRate: number + dataCollection: DataCollection }): void captureException(error: unknown): void flush(timeout: number): Promise @@ -52,6 +67,20 @@ export function createCrashReporter( client.init({ dsn, environment: "production", + // every category the SDK may attach, stated in full: an + // omitted field takes a default that collects. Errors and + // stack traces only, since anything else here would carry + // document content. + dataCollection: { + userInfo: false, + cookies: false, + httpHeaders: { request: false, response: false }, + httpBodies: [], + urlQueryParams: false, + genAI: { inputs: false, outputs: false }, + databaseQueryData: false, + stackFrameVariables: false, + }, // tracing stays off, as in auth-realtime: the bundle folds // sentry in, which loses the require hooks tracing relies on, // and error capture is the only thing this process wants. diff --git a/server/auth-realtime/src/sentry.ts b/server/auth-realtime/src/sentry.ts index d6c9b4ee..3a4cb86f 100644 --- a/server/auth-realtime/src/sentry.ts +++ b/server/auth-realtime/src/sentry.ts @@ -4,6 +4,20 @@ if (process.env.SENTRY_DSN) { Sentry.init({ dsn: process.env.SENTRY_DSN, environment: process.env.NODE_ENV ?? "development", + // every category the SDK may attach, stated in full: an + // omitted field takes a default that collects. Errors and + // stack traces only, since anything else here would carry + // document content. + dataCollection: { + userInfo: false, + cookies: false, + httpHeaders: { request: false, response: false }, + httpBodies: [], + urlQueryParams: false, + genAI: { inputs: false, outputs: false }, + databaseQueryData: false, + stackFrameVariables: false, + }, // tracing stays off, deliberately and unconfigurably: the // production bundle folds sentry into the app, which loses the // require hooks tracing relies on, and error capture is the diff --git a/server/core/pkg/sentryutil/sentryutil.go b/server/core/pkg/sentryutil/sentryutil.go index 1ca9024d..e4ecda68 100644 --- a/server/core/pkg/sentryutil/sentryutil.go +++ b/server/core/pkg/sentryutil/sentryutil.go @@ -63,6 +63,29 @@ func Setup(cfg Config) (func(), error) { Dsn: cfg.DSN, Release: cfg.Release, Environment: cfg.Environment, + // every category the SDK may attach, stated in full: an + // omitted field takes a default that collects. Errors and + // stack traces only, since anything else here would carry + // document content. The same set is spelled out in the three + // node services. + DataCollection: &sentry.DataCollection{ + UserInfo: sentry.Set(false), + Cookies: &sentry.KeyValueCollectionBehavior{ + Mode: sentry.CollectionOff, + }, + HTTPHeaders: &sentry.HeaderCollectionConfig{ + Request: &sentry.KeyValueCollectionBehavior{ + Mode: sentry.CollectionOff, + }, + Response: &sentry.KeyValueCollectionBehavior{ + Mode: sentry.CollectionOff, + }, + }, + HTTPBodies: []sentry.BodyType{}, + QueryParams: &sentry.KeyValueCollectionBehavior{ + Mode: sentry.CollectionOff, + }, + }, // nothing in this codebase emits Sentry Logs, so keep the // default-on telemetry machinery switched off. DisableLogs: true, diff --git a/web/packages/README.lezer-promql.md b/web/packages/README.lezer-promql.md index 4da08996..93dbcefa 100644 --- a/web/packages/README.lezer-promql.md +++ b/web/packages/README.lezer-promql.md @@ -26,6 +26,11 @@ mv web/ui/module/lezer-promql/* . rm -rf web .git ``` +### Keep the license files +`LICENSE` (Apache-2.0) and `NOTICE` are redistributed with the grammar and +must survive a re-sync. `NOTICE` also lists the changes below — update it +when they change. + ### In package.json, rename the package: `"name": "@oxynote/lezer-promql",` diff --git a/web/packages/lezer-promql/.gitignore b/web/packages/lezer-promql/.gitignore index d4f11c63..8fc9da89 100644 --- a/web/packages/lezer-promql/.gitignore +++ b/web/packages/lezer-promql/.gitignore @@ -4,5 +4,4 @@ lib/ src/parser.js src/parser.terms.js -LICENSE CHANGELOG.md diff --git a/web/packages/lezer-promql/LICENSE b/web/packages/lezer-promql/LICENSE new file mode 100644 index 00000000..f49a4e16 --- /dev/null +++ b/web/packages/lezer-promql/LICENSE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. \ No newline at end of file diff --git a/web/packages/lezer-promql/NOTICE b/web/packages/lezer-promql/NOTICE new file mode 100644 index 00000000..e79acffa --- /dev/null +++ b/web/packages/lezer-promql/NOTICE @@ -0,0 +1,24 @@ +The Prometheus systems and service monitoring server +Copyright 2012-2015 The Prometheus Authors + +This product includes software developed at +SoundCloud Ltd. (https://soundcloud.com/). + +The full upstream notice, covering components not included here, is at +https://github.com/prometheus/prometheus/blob/main/NOTICE + +--- + +This package is a modified copy of the lezer-promql grammar from +https://github.com/prometheus/prometheus/tree/main/web/ui/module/lezer-promql +distributed under the Apache License, Version 2.0. + +Changes from upstream, published as @oxynote/lezer-promql: + + - src/promql.grammar: added the DynamicDurationPlaceholder token and + accepted it as a number, so Grafana-style placeholders ($__interval, + $__range, $__rate_interval) parse as durations. + - src/highlight.js: styled DynamicDurationPlaceholder as a number. + - package.json: renamed the package. + +See packages/README.lezer-promql.md for the upstream sync procedure. diff --git a/web/sentry.client.config.ts b/web/sentry.client.config.ts index c0499c60..6957312c 100644 --- a/web/sentry.client.config.ts +++ b/web/sentry.client.config.ts @@ -7,9 +7,19 @@ Sentry.init({ // Enable logs to be sent to Sentry enableLogs: true, - // Enable sending of user PII (Personally Identifiable Information) - // https://docs.sentry.io/platforms/javascript/guides/nuxt/configuration/options/#sendDefaultPii - sendDefaultPii: false, + // every category the SDK may attach, stated in full: an omitted field + // takes a default that collects. Errors and stack traces only, since + // anything else here would carry document content. + dataCollection: { + userInfo: false, + cookies: false, + httpHeaders: { request: false, response: false }, + httpBodies: [], + urlQueryParams: false, + genAI: { inputs: false, outputs: false }, + databaseQueryData: false, + stackFrameVariables: false, + }, // Setting this option to true will print useful information to the console while you're setting up Sentry. debug: false, diff --git a/web/sentry.server.config.ts b/web/sentry.server.config.ts index 3f350ea2..dda4f99a 100644 --- a/web/sentry.server.config.ts +++ b/web/sentry.server.config.ts @@ -10,9 +10,19 @@ Sentry.init({ // Enable logs to be sent to Sentry enableLogs: true, - // Enable sending of user PII (Personally Identifiable Information) - // https://docs.sentry.io/platforms/javascript/guides/nuxt/configuration/options/#sendDefaultPii - sendDefaultPii: false, + // every category the SDK may attach, stated in full: an omitted field + // takes a default that collects. Errors and stack traces only, since + // anything else here would carry document content. + dataCollection: { + userInfo: false, + cookies: false, + httpHeaders: { request: false, response: false }, + httpBodies: [], + urlQueryParams: false, + genAI: { inputs: false, outputs: false }, + databaseQueryData: false, + stackFrameVariables: false, + }, // Setting this option to true will print useful information to the console while you're setting up Sentry. debug: false,