From 0f9b21dcce02598b3051e9c8e2763d8e0549fc77 Mon Sep 17 00:00:00 2001
From: Sergi Blanco-Cuaresma <marblestation@users.noreply.github.com>
Date: Wed, 27 Nov 2019 09:14:45 -0500
Subject: [PATCH] Keep auth tokens for logging purposes + filter it out from
 response

- Changed X-Amzn-Trace-Id to use capital letters for consistency with
  the rest of the system
---
 solr/views.py | 36 ++++++++++++++++++++++++++----------
 1 file changed, 26 insertions(+), 10 deletions(-)

diff --git a/solr/views.py b/solr/views.py
index dfd6f81..f5c3977 100644
--- a/solr/views.py
+++ b/solr/views.py
@@ -38,6 +38,7 @@ class SolrInterface(Resource):
     def __init__(self, *args, **kwargs):
         Resource.__init__(self, *args, **kwargs)
         self._host = None
+        self.internal_logging_params = ('X-Amzn-Trace-Id', 'Authorization', 'X-Forwarded-Authorization') # Pass to solr/clean from response, only for logging purposes
 
     def get(self):
         query, headers = self.cleanup_solr_request(dict(request.args))
@@ -80,7 +81,7 @@ def get(self):
                 cookies=SolrInterface.set_cookies(request),
             )
         current_app.logger.info("Received response from from endpoint '{}' with status code '{}'".format(current_app.config[self.handler], r.status_code))
-        return r.text, r.status_code, r.headers
+        return self.cleanup_solr_response_text(r.text), r.status_code, r.headers
 
     @staticmethod
     def set_cookies(request):
@@ -126,6 +127,19 @@ def apply_protective_filters(self, payload, user_id, protected_fields):
                     payload['fl'] = fl
             session.commit()
 
+    def cleanup_solr_response_text(self, text):
+        """
+        Remove internal logging parameters from solr response
+        """
+        try:
+            r = json.loads(text)
+            params = r.get('responseHeader', {}).get('params', {})
+            for internal_param in self.internal_logging_params:
+                params.pop(internal_param, None)
+            clean_text = unicode(json.dumps(r)+'\n')
+            return clean_text
+        except:
+            return text
 
     def cleanup_solr_request(self, payload, user_id=None):
         """
@@ -147,15 +161,12 @@ def cleanup_solr_request(self, payload, user_id=None):
             _h = 'application/x-www-form-urlencoded'
         headers['Content-Type'] =  _h
 
-        # trace id and Host header are important for proper routing/logging
+        # trace id, Host, token header are important for proper routing/logging
         headers['Host'] = self.get_host(current_app.config.get(self.handler))
-
-        if 'X-Amzn-Trace-Id' in request.headers:
-            payload['x-amzn-trace-id'] = request.headers['X-Amzn-Trace-Id']
-            headers['X-Amzn-Trace-Id'] = request.headers['X-Amzn-Trace-Id']
-        elif 'x-amzn-trace-id' in request.headers:
-            payload['x-amzn-trace-id'] = request.headers['x-amzn-trace-id']
-            headers['X-Amzn-Trace-Id'] = request.headers['x-amzn-trace-id']
+        for internal_param in self.internal_logging_params:
+            if internal_param in request.headers:
+                payload[internal_param] = request.headers[internal_param]
+                headers[internal_param] = request.headers[internal_param]
 
         payload['wt'] = 'json'
         max_rows = current_app.config.get('SOLR_SERVICE_MAX_ROWS', 100)
@@ -317,6 +328,11 @@ def _get_stream_data(self, params, streams, request):
                 value = s
 
             new_headers = {'Authorization': request.headers['Authorization']}
+            # trace id, Host, token header are important for proper routing/logging
+            new_headers['Host'] = self.get_host(current_app.config.get(self.handler))
+            for internal_param in self.internal_logging_params:
+                if internal_param in request.headers:
+                    new_headers[internal_param] = request.headers[internal_param]
             docs = None
 
             if prefix == 'library':
@@ -451,7 +467,7 @@ def post(self):
             message = "Malformed request"
             current_app.logger.error(message)
             return json.dumps({'error': message}), 400
-        return r.text, r.status_code, r.headers
+        return self.cleanup_solr_response_text(r.text), r.status_code, r.headers
 
 
 def _safe_int(val, default=0):