fix(logger): keep hostile child metadata from throwing into the caller

Author: waleedlatif1

packages/logger/src/index.test.ts

@@ -254,5 +254,46 @@ describe('Logger', () => {
       expect(parsed.module).toBe('Test')
       expect(parsed.serializationError).toBe(true)
     })
+
+    test('should not throw when withMetadata receives a throwing getter', () => {
+      const hostile = {
+        safe: 'kept',
+        get boom() {
+          throw new Error('getter exploded')
+        },
+      } as unknown as Parameters<Logger['withMetadata']>[0]
+
+      let child: Logger | undefined
+      expect(() => {
+        child = createEnabledLogger().withMetadata(hostile)
+      }).not.toThrow()
+
+      expect(() => child?.info('hello')).not.toThrow()
+      const parsed = JSON.parse(consoleLogSpy.mock.calls[0][0] as string)
+      expect(parsed.message).toBe('hello')
+      expect(parsed.safe).toBe('kept')
+      expect(parsed.boom).toBe('[Unreadable]')
+    })
+
+    test('should not throw when withMetadata receives a hostile proxy', () => {
+      const hostile = new Proxy(
+        {},
+        {
+          ownKeys() {
+            throw new Error('ownKeys exploded')
+          },
+        }
+      ) as Parameters<Logger['withMetadata']>[0]
+
+      let child: Logger | undefined
+      expect(() => {
+        child = createEnabledLogger().withMetadata(hostile)
+      }).not.toThrow()
+
+      expect(() => child?.info('hello')).not.toThrow()
+      const parsed = JSON.parse(consoleLogSpy.mock.calls[0][0] as string)
+      expect(parsed.message).toBe('hello')
+      expect(parsed.metadataError).toBe(true)
+    })
   })
 })

packages/logger/src/index.ts

@@ -188,6 +188,34 @@ const serializeEntry = (base: Record<string, unknown>, args: unknown[]): string
   return JSON.stringify({ ...base, serializationError: true }, tolerantReplacer())
 }
 
+/**
+ * Copies caller-supplied metadata into a plain object without ever throwing.
+ *
+ * `LoggerMetadata` is structurally typed, so nothing stops a caller from handing
+ * over an object carrying a throwing getter or a hostile proxy. A spread invokes
+ * those traps, so the copy degrades key-by-key and finally to a marker rather
+ * than raising inside the caller's code path.
+ */
+const materializeMetadata = (metadata: LoggerMetadata): LoggerMetadata => {
+  try {
+    return { ...metadata }
+  } catch {}
+
+  const safe: LoggerMetadata = {}
+  try {
+    for (const key of Object.keys(metadata)) {
+      try {
+        safe[key] = metadata[key]
+      } catch {
+        safe[key] = '[Unreadable]'
+      }
+    }
+    return safe
+  } catch {}
+
+  return { metadataError: true }
+}
+
 /**
  * Logger class for standardized console logging
  *
@@ -240,7 +268,7 @@ export class Logger {
     child.module = this.module
     child.config = this.config
     child.isDev = this.isDev
-    child.metadata = { ...this.metadata, ...metadata }
+    child.metadata = { ...this.metadata, ...materializeMetadata(metadata) }
     return child
   }