chore(core/schema): use schema log filter when available

kuhe · kuhe · commit 4a3397aa6cfd · 2025-08-07T16:30:44.000-04:00
diff --git a/.changeset/lemon-wasps-itch.md b/.changeset/lemon-wasps-itch.md
@@ -0,0 +1,5 @@
+---
+"@smithy/smithy-client": minor
+---
+
+default schema log filter
diff --git a/packages/smithy-client/src/command.ts b/packages/smithy-client/src/command.ts
@@ -20,6 +20,8 @@ import type {
 } from "@smithy/types";
 import { SMITHY_CONTEXT_KEY } from "@smithy/types";
 
+import { schemaLogFilter } from "./schemaLogFilter";
+
 /**
  * @public
  */
@@ -28,7 +30,7 @@ export abstract class Command<
   Output extends ClientOutput,
   ResolvedClientConfiguration,
   ClientInput extends object = any,
-  ClientOutput extends MetadataBearer = any,
+  ClientOutput extends MetadataBearer = any
 > implements ICommand<ClientInput, Input, ClientOutput, Output, ResolvedClientConfiguration>
 {
   public abstract input: Input;
@@ -44,7 +46,7 @@ export abstract class Command<
     O extends SO,
     C extends { logger: Logger; requestHandler: RequestHandler<any, any, any> },
     SI extends object = any,
-    SO extends MetadataBearer = any,
+    SO extends MetadataBearer = any
   >() {
     return new ClassBuilder<I, O, C, SI, SO>();
   }
@@ -120,7 +122,7 @@ class ClassBuilder<
   O extends SO,
   C extends { logger: Logger; requestHandler: RequestHandler<any, any, any> },
   SI extends object = any,
-  SO extends MetadataBearer = any,
+  SO extends MetadataBearer = any
 > {
   private _init: (_: Command<I, O, C, SI, SO>) => void = () => {};
   private _ep: EndpointParameterInstructions = {};
@@ -130,8 +132,8 @@ class ClassBuilder<
   private _clientName = "";
   private _additionalContext = {} as HandlerExecutionContext;
   private _smithyContext = {} as Record<string, unknown>;
-  private _inputFilterSensitiveLog = (_: any) => _;
-  private _outputFilterSensitiveLog = (_: any) => _;
+  private _inputFilterSensitiveLog: any = undefined;
+  private _outputFilterSensitiveLog: any = undefined;
   private _serializer: (input: I, context: SerdeContext | any) => Promise<IHttpRequest> = null as any;
   private _deserializer: (output: IHttpResponse, context: SerdeContext | any) => Promise<O> = null as any;
   private _operationSchema?: OperationSchema;
@@ -268,8 +270,12 @@ class ClassBuilder<
           middlewareFn: closure._middlewareFn,
           clientName: closure._clientName,
           commandName: closure._commandName,
-          inputFilterSensitiveLog: closure._inputFilterSensitiveLog,
-          outputFilterSensitiveLog: closure._outputFilterSensitiveLog,
+          inputFilterSensitiveLog:
+            closure._inputFilterSensitiveLog ??
+            (closure._operationSchema ? schemaLogFilter.bind(null, closure._operationSchema!.input) : (_) => _),
+          outputFilterSensitiveLog:
+            closure._outputFilterSensitiveLog ??
+            (closure._operationSchema ? schemaLogFilter.bind(null, closure._operationSchema!.output) : (_) => _),
           smithyContext: closure._smithyContext,
           additionalContext: closure._additionalContext,
         });
@@ -299,7 +305,7 @@ export interface CommandImpl<
   O extends SO,
   C extends { logger: Logger; requestHandler: RequestHandler<any, any, any> },
   SI extends object = any,
-  SO extends MetadataBearer = any,
+  SO extends MetadataBearer = any
 > extends Command<I, O, C, SI, SO> {
   readonly input: I;
   resolveMiddleware(stack: IMiddlewareStack<SI, SO>, configuration: C, options: any): Handler<I, O>;
diff --git a/packages/smithy-client/src/schemaLogFilter.ts b/packages/smithy-client/src/schemaLogFilter.ts
@@ -0,0 +1,46 @@
+import { NormalizedSchema } from "@smithy/core/schema";
+import type { SchemaRef } from "@smithy/types";
+
+const SENSITIVE_STRING = "***SensitiveInformation***";
+
+/**
+ * Redacts sensitive parts of any data object using its schema, for logging.
+ *
+ * @internal
+ * @param schema - with filtering traits.
+ * @param data - to be logged.
+ */
+export function schemaLogFilter(schema: SchemaRef, data: unknown): any {
+  if (data == null) {
+    return data;
+  }
+  const ns = NormalizedSchema.of(schema);
+  if (ns.getMergedTraits().sensitive) {
+    return SENSITIVE_STRING;
+  }
+
+  if (ns.isListSchema()) {
+    const isSensitive = !!ns.getValueSchema().getMergedTraits().sensitive;
+    if (isSensitive) {
+      return SENSITIVE_STRING;
+    }
+  } else if (ns.isMapSchema()) {
+    const isSensitive =
+      !!ns.getKeySchema().getMergedTraits().sensitive || !!ns.getValueSchema().getMergedTraits().sensitive;
+    if (isSensitive) {
+      return SENSITIVE_STRING;
+    }
+  } else if (ns.isStructSchema() && typeof data === "object") {
+    const object = data as Record<string, unknown>;
+
+    const newObject = {} as any;
+    for (const [member, memberNs] of ns.structIterator()) {
+      if (object[member] != null) {
+        newObject[member] = schemaLogFilter(memberNs, object[member]);
+      }
+    }
+    return newObject;
+  }
+
+  return data;
+}
diff --git a/private/smithy-rpcv2-cbor-schema/src/commands/EmptyInputOutputCommand.ts b/private/smithy-rpcv2-cbor-schema/src/commands/EmptyInputOutputCommand.ts
@@ -66,7 +66,7 @@ export class EmptyInputOutputCommand extends $Command
   })
   .s("RpcV2Protocol", "EmptyInputOutput", {})
   .n("RpcV2ProtocolClient", "EmptyInputOutputCommand")
-  .f(void 0, void 0)
+
   .sc(EmptyInputOutput)
   .build() {
   /** @internal type navigation helper, not in runtime. */
diff --git a/private/smithy-rpcv2-cbor-schema/src/commands/Float16Command.ts b/private/smithy-rpcv2-cbor-schema/src/commands/Float16Command.ts
@@ -68,7 +68,7 @@ export class Float16Command extends $Command
   })
   .s("RpcV2Protocol", "Float16", {})
   .n("RpcV2ProtocolClient", "Float16Command")
-  .f(void 0, void 0)
+
   .sc(Float16)
   .build() {
   /** @internal type navigation helper, not in runtime. */
diff --git a/private/smithy-rpcv2-cbor-schema/src/commands/FractionalSecondsCommand.ts b/private/smithy-rpcv2-cbor-schema/src/commands/FractionalSecondsCommand.ts
@@ -68,7 +68,7 @@ export class FractionalSecondsCommand extends $Command
   })
   .s("RpcV2Protocol", "FractionalSeconds", {})
   .n("RpcV2ProtocolClient", "FractionalSecondsCommand")
-  .f(void 0, void 0)
+
   .sc(FractionalSeconds)
   .build() {
   /** @internal type navigation helper, not in runtime. */
diff --git a/private/smithy-rpcv2-cbor-schema/src/commands/GreetingWithErrorsCommand.ts b/private/smithy-rpcv2-cbor-schema/src/commands/GreetingWithErrorsCommand.ts
@@ -81,7 +81,7 @@ export class GreetingWithErrorsCommand extends $Command
   })
   .s("RpcV2Protocol", "GreetingWithErrors", {})
   .n("RpcV2ProtocolClient", "GreetingWithErrorsCommand")
-  .f(void 0, void 0)
+
   .sc(GreetingWithErrors)
   .build() {
   /** @internal type navigation helper, not in runtime. */
diff --git a/private/smithy-rpcv2-cbor-schema/src/commands/NoInputOutputCommand.ts b/private/smithy-rpcv2-cbor-schema/src/commands/NoInputOutputCommand.ts
@@ -65,7 +65,7 @@ export class NoInputOutputCommand extends $Command
   })
   .s("RpcV2Protocol", "NoInputOutput", {})
   .n("RpcV2ProtocolClient", "NoInputOutputCommand")
-  .f(void 0, void 0)
+
   .sc(NoInputOutput)
   .build() {
   /** @internal type navigation helper, not in runtime. */
diff --git a/private/smithy-rpcv2-cbor-schema/src/commands/OperationWithDefaultsCommand.ts b/private/smithy-rpcv2-cbor-schema/src/commands/OperationWithDefaultsCommand.ts
@@ -134,7 +134,7 @@ export class OperationWithDefaultsCommand extends $Command
   })
   .s("RpcV2Protocol", "OperationWithDefaults", {})
   .n("RpcV2ProtocolClient", "OperationWithDefaultsCommand")
-  .f(void 0, void 0)
+
   .sc(OperationWithDefaults)
   .build() {
   /** @internal type navigation helper, not in runtime. */
diff --git a/private/smithy-rpcv2-cbor-schema/src/commands/OptionalInputOutputCommand.ts b/private/smithy-rpcv2-cbor-schema/src/commands/OptionalInputOutputCommand.ts
@@ -70,7 +70,7 @@ export class OptionalInputOutputCommand extends $Command
   })
   .s("RpcV2Protocol", "OptionalInputOutput", {})
   .n("RpcV2ProtocolClient", "OptionalInputOutputCommand")
-  .f(void 0, void 0)
+
   .sc(OptionalInputOutput)
   .build() {
   /** @internal type navigation helper, not in runtime. */
diff --git a/private/smithy-rpcv2-cbor-schema/src/commands/RecursiveShapesCommand.ts b/private/smithy-rpcv2-cbor-schema/src/commands/RecursiveShapesCommand.ts
@@ -94,7 +94,7 @@ export class RecursiveShapesCommand extends $Command
   })
   .s("RpcV2Protocol", "RecursiveShapes", {})
   .n("RpcV2ProtocolClient", "RecursiveShapesCommand")
-  .f(void 0, void 0)
+
   .sc(RecursiveShapes)
   .build() {
   /** @internal type navigation helper, not in runtime. */
diff --git a/private/smithy-rpcv2-cbor-schema/src/commands/RpcV2CborDenseMapsCommand.ts b/private/smithy-rpcv2-cbor-schema/src/commands/RpcV2CborDenseMapsCommand.ts
@@ -111,7 +111,7 @@ export class RpcV2CborDenseMapsCommand extends $Command
   })
   .s("RpcV2Protocol", "RpcV2CborDenseMaps", {})
   .n("RpcV2ProtocolClient", "RpcV2CborDenseMapsCommand")
-  .f(void 0, void 0)
+
   .sc(RpcV2CborDenseMaps)
   .build() {
   /** @internal type navigation helper, not in runtime. */
diff --git a/private/smithy-rpcv2-cbor-schema/src/commands/RpcV2CborListsCommand.ts b/private/smithy-rpcv2-cbor-schema/src/commands/RpcV2CborListsCommand.ts
@@ -149,7 +149,7 @@ export class RpcV2CborListsCommand extends $Command
   })
   .s("RpcV2Protocol", "RpcV2CborLists", {})
   .n("RpcV2ProtocolClient", "RpcV2CborListsCommand")
-  .f(void 0, void 0)
+
   .sc(RpcV2CborLists)
   .build() {
   /** @internal type navigation helper, not in runtime. */
diff --git a/private/smithy-rpcv2-cbor-schema/src/commands/RpcV2CborSparseMapsCommand.ts b/private/smithy-rpcv2-cbor-schema/src/commands/RpcV2CborSparseMapsCommand.ts
@@ -111,7 +111,7 @@ export class RpcV2CborSparseMapsCommand extends $Command
   })
   .s("RpcV2Protocol", "RpcV2CborSparseMaps", {})
   .n("RpcV2ProtocolClient", "RpcV2CborSparseMapsCommand")
-  .f(void 0, void 0)
+
   .sc(RpcV2CborSparseMaps)
   .build() {
   /** @internal type navigation helper, not in runtime. */
diff --git a/private/smithy-rpcv2-cbor-schema/src/commands/SimpleScalarPropertiesCommand.ts b/private/smithy-rpcv2-cbor-schema/src/commands/SimpleScalarPropertiesCommand.ts
@@ -88,7 +88,7 @@ export class SimpleScalarPropertiesCommand extends $Command
   })
   .s("RpcV2Protocol", "SimpleScalarProperties", {})
   .n("RpcV2ProtocolClient", "SimpleScalarPropertiesCommand")
-  .f(void 0, void 0)
+
   .sc(SimpleScalarProperties)
   .build() {
   /** @internal type navigation helper, not in runtime. */
diff --git a/private/smithy-rpcv2-cbor-schema/src/commands/SparseNullsOperationCommand.ts b/private/smithy-rpcv2-cbor-schema/src/commands/SparseNullsOperationCommand.ts
@@ -80,7 +80,7 @@ export class SparseNullsOperationCommand extends $Command
   })
   .s("RpcV2Protocol", "SparseNullsOperation", {})
   .n("RpcV2ProtocolClient", "SparseNullsOperationCommand")
-  .f(void 0, void 0)
+
   .sc(SparseNullsOperation)
   .build() {
   /** @internal type navigation helper, not in runtime. */
diff --git a/smithy-typescript-codegen/src/main/java/software/amazon/smithy/typescript/codegen/CommandGenerator.java b/smithy-typescript-codegen/src/main/java/software/amazon/smithy/typescript/codegen/CommandGenerator.java
@@ -453,9 +453,10 @@ private void generateEndpointParameterInstructionProvider() {
 
     private void generateCommandMiddlewareResolver(String configType) {
         Symbol serde = TypeScriptDependency.MIDDLEWARE_SERDE.createSymbol("getSerdePlugin");
+        boolean schemaMode = SchemaGenerationAllowlist.allows(service.getId(), settings);
 
         Function<StructureShape, String> getFilterFunctionName = input -> {
-            if (sensitiveDataFinder.findsSensitiveDataIn(input)) {
+            if (sensitiveDataFinder.findsSensitiveDataIn(input) && !schemaMode) {
                 Symbol inputSymbol = symbolProvider.toSymbol(input);
                 String filterFunctionName = inputSymbol.getName() + "FilterSensitiveLog";
                 writer.addRelativeImport(
@@ -496,7 +497,7 @@ private void generateCommandMiddlewareResolver(String configType) {
         );
         {
             // Add serialization and deserialization plugin.
-            if (!SchemaGenerationAllowlist.allows(service.getId(), settings)) {
+            if (!schemaMode) {
                 writer.write("$T(config, this.serialize, this.deserialize),", serde);
             }
 
@@ -518,15 +519,16 @@ private void generateCommandMiddlewareResolver(String configType) {
             })"""
         ); // end middleware.
 
+        String filters = schemaMode ? "" : ".f($inputFilter:L, $outputFilter:L)";
+
         // context, filters
         writer.openBlock(
             """
             .s($service:S, $operation:S, {
             """,
             """
             })
-            .n($client:S, $command:S)
-            .f($inputFilter:L, $outputFilter:L)""",
+            .n($client:S, $command:S)""" + filters,
             () -> {
                 writer.pushState(SmithyContextCodeSection.builder()
                     .settings(settings)
diff --git a/smithy-typescript-codegen/src/main/java/software/amazon/smithy/typescript/codegen/DirectedTypeScriptCodegen.java b/smithy-typescript-codegen/src/main/java/software/amazon/smithy/typescript/codegen/DirectedTypeScriptCodegen.java
@@ -364,12 +364,16 @@ private void generateServiceInterface(GenerateServiceDirective<TypeScriptCodegen
     public void generateStructure(GenerateStructureDirective<TypeScriptCodegenContext, TypeScriptSettings> directive) {
         directive.context().writerDelegator().useShapeWriter(directive.shape(), writer -> {
             StructureGenerator generator = new StructureGenerator(
-                    directive.model(),
-                    directive.symbolProvider(),
-                    writer,
-                    directive.shape(),
-                    directive.settings().generateServerSdk(),
-                    directive.settings().getRequiredMemberMode()
+                directive.model(),
+                directive.symbolProvider(),
+                writer,
+                directive.shape(),
+                directive.settings().generateServerSdk(),
+                directive.settings().getRequiredMemberMode(),
+                SchemaGenerationAllowlist.allows(
+                    directive.settings().getService(),
+                    directive.settings()
+                )
             );
             generator.run();
         });
@@ -379,12 +383,16 @@ public void generateStructure(GenerateStructureDirective<TypeScriptCodegenContex
     public void generateError(GenerateErrorDirective<TypeScriptCodegenContext, TypeScriptSettings> directive) {
         directive.context().writerDelegator().useShapeWriter(directive.shape(), writer -> {
             StructureGenerator generator = new StructureGenerator(
-                    directive.model(),
-                    directive.symbolProvider(),
-                    writer,
-                    directive.shape(),
-                    directive.settings().generateServerSdk(),
-                    directive.settings().getRequiredMemberMode()
+                directive.model(),
+                directive.symbolProvider(),
+                writer,
+                directive.shape(),
+                directive.settings().generateServerSdk(),
+                directive.settings().getRequiredMemberMode(),
+                SchemaGenerationAllowlist.allows(
+                    directive.settings().getService(),
+                    directive.settings()
+                )
             );
             generator.run();
         });
@@ -394,11 +402,15 @@ public void generateError(GenerateErrorDirective<TypeScriptCodegenContext, TypeS
     public void generateUnion(GenerateUnionDirective<TypeScriptCodegenContext, TypeScriptSettings> directive) {
         directive.context().writerDelegator().useShapeWriter(directive.shape(), writer -> {
             UnionGenerator generator = new UnionGenerator(
-                    directive.model(),
-                    directive.symbolProvider(),
-                    writer,
-                    directive.shape(),
-                    directive.settings().generateServerSdk()
+                directive.model(),
+                directive.symbolProvider(),
+                writer,
+                directive.shape(),
+                directive.settings().generateServerSdk(),
+                SchemaGenerationAllowlist.allows(
+                    directive.settings().getService(),
+                    directive.settings()
+                )
             );
             generator.run();
         });
diff --git a/smithy-typescript-codegen/src/main/java/software/amazon/smithy/typescript/codegen/StructureGenerator.java b/smithy-typescript-codegen/src/main/java/software/amazon/smithy/typescript/codegen/StructureGenerator.java
@@ -74,29 +74,32 @@ final class StructureGenerator implements Runnable {
     private final boolean includeValidation;
     private final RequiredMemberMode requiredMemberMode;
     private final SensitiveDataFinder sensitiveDataFinder;
+    private final boolean schemaMode;
 
     /**
      * sets 'includeValidation' to 'false' and requiredMemberMode
      * to {@link RequiredMemberMode#NULLABLE}.
      */
     StructureGenerator(Model model, SymbolProvider symbolProvider, TypeScriptWriter writer, StructureShape shape) {
         this(model, symbolProvider, writer, shape, false,
-                RequiredMemberMode.NULLABLE);
+                RequiredMemberMode.NULLABLE, false);
     }
 
     StructureGenerator(Model model,
             SymbolProvider symbolProvider,
             TypeScriptWriter writer,
             StructureShape shape,
             boolean includeValidation,
-            RequiredMemberMode requiredMemberMode) {
+            RequiredMemberMode requiredMemberMode,
+            boolean schemaMode) {
         this.model = model;
         this.symbolProvider = symbolProvider;
         this.writer = writer;
         this.shape = shape;
         this.includeValidation = includeValidation;
         this.requiredMemberMode = requiredMemberMode;
         sensitiveDataFinder = new SensitiveDataFinder(model);
+        this.schemaMode = schemaMode;
     }
 
     @Override
@@ -190,7 +193,7 @@ private void renderStructureNamespace(StructuredMemberWriter structuredMemberWri
         Symbol symbol = symbolProvider.toSymbol(shape);
         String objectParam = "obj";
 
-        if (sensitiveDataFinder.findsSensitiveDataIn(shape)) {
+        if (sensitiveDataFinder.findsSensitiveDataIn(shape) && !schemaMode) {
             writer.writeDocs("@internal");
             writer.openBlock("export const $LFilterSensitiveLog = ($L: $L): any => ({", "})",
                     symbol.getName(),
diff --git a/smithy-typescript-codegen/src/main/java/software/amazon/smithy/typescript/codegen/UnionGenerator.java b/smithy-typescript-codegen/src/main/java/software/amazon/smithy/typescript/codegen/UnionGenerator.java

-Original file line number
+Diff line change
@@ @@ -0,0 +1,5 @@ @@
 +---
 +"@smithy/smithy-client": minor
 +---
++
 +default schema log filter