Documentation
¶
Overview ¶
Package msgmask masks the personal data of RabbitMQ messages: body, headers (application properties) and properties, from the rules of .lockmq/pii.toml, the profile's body mode, field-name heuristics and value detectors (lockkit's pii).
Index ¶
Constants ¶
const ( ModeRedactUnknown = "redact-unknown" ModeDetect = "detect" )
Body modes (the profile's body_mode).
Variables ¶
This section is empty.
Functions ¶
func AppendMask ¶
AppendMask adds r as a [[mask]] table at the end of the rules file at path (created when missing), leaving the rest of the file as it is.
Types ¶
type Masked ¶
type Masked struct {
Properties map[string]any `json:"properties,omitempty"`
Headers map[string]any `json:"headers,omitempty"`
// Body is the parsed JSON, a string, or "<bytes:N sha256:H type:T>".
Body any `json:"body"`
Truncated bool `json:"truncated,omitempty"`
Proposals []string `json:"proposals,omitempty"`
}
Masked is a message fit for a client: every personal value masked.
func Clear ¶ added in v0.2.0
Clear is msg unmasked, for an approved unmask or the console's clear view: headers and properties as read, the body parsed JSON or text, and opaque when binary, encoded, too deep or cut by the source (a cut body still shows as text, marked truncated). The body is capped at maxBody.
type Masker ¶
type Masker struct {
// contains filtered or unexported fields
}
Masker masks the messages of one console session.
func NewMasker ¶
func NewMasker(r Rules, detectors []pii.Detector, bodyMode string, refs *pii.RefStore, maxBody int) *Masker
NewMasker returns a masker. bodyMode is redact-unknown or detect (any other value is redact-unknown: fail closed); refs keeps the clear values behind the references; maxBody caps a body after masking.
type Message ¶
type Message struct {
Properties map[string]any
// Headers are the AMQP headers or the stream's application properties.
Headers map[string]any
Body []byte
// Cut marks a body the source shortened (peek's truncate): it is
// opaque, whatever its type, never parsed or read as text.
Cut bool
ContentType string
ContentEncoding string
// Exchange is the exchange the message was published to, "" if unknown.
Exchange string
// Origin is the queue named by the message's first x-death entry; ""
// takes it from Headers.
Origin string
}
Message is one message as read from the broker.
type Rule ¶
type Rule struct {
// Queues and Exchanges are "vhost/name" globs ("*/*", "orders/order-*");
// the vhost "/" is written as a leading "/" ("//orders").
Queues, Exchanges []string
// Exactly one of Body (a JSON path), Header (a name glob) and Property.
Body, Header, Property string
// Mode is the mask mode of a mask rule (redact, partial, email); empty
// in an allow rule.
Mode string
// contains filtered or unexported fields
}
Rule masks (or, in an allow list, clears) one body path, header name glob or property of the messages of some queues or exchanges.
type Rules ¶
type Rules struct {
Mask, Allow []Rule
}
Rules are the mask and allow rules of a project.
func FromTexts ¶
FromTexts rebuilds rules from their canonical texts and the modes of the mask rules (the policy's form, Texts).
Source Files