Documentation
¶
Overview ¶
Package envredact decides which environment values are sensitive and masks them for every read surface. Consumers that need the real value (deploy, reconcile, step-up reveal) read the store directly.
Index ¶
- Constants
- func Classify(key, value string, override *bool) (sensitive bool, reason string)
- func IsPlaceholder(v string) bool
- func IsPublicName(key string) bool
- func Map(env map[string]string, overrides map[string]bool) (map[string]string, map[string]Meta)
- func Merge(submitted, stored map[string]string) (map[string]string, error)
- func Preview(value string) string
- func SensitiveName(key string) bool
- func SensitiveValue(key, value string) bool
- type Meta
- type PlaceholderError
Constants ¶
const ( ReasonName = "name" ReasonValue = "value" ReasonOverride = "override" ReasonPublic = "public" )
Reasons a value was classified sensitive or plain.
const Placeholder = "••••••••"
Placeholder stands in for a sensitive value on every read surface. A write that sends it back for an existing key keeps the stored value.
Variables ¶
This section is empty.
Functions ¶
func Classify ¶
Classify reports whether key=value is sensitive and why. override, when non-nil, is the operator's explicit choice and always wins.
func IsPlaceholder ¶
IsPlaceholder reports whether v is the masked placeholder.
func IsPublicName ¶
IsPublicName reports whether key carries a browser-public framework prefix.
func Merge ¶
Merge resolves a submitted env against the stored one: a Placeholder keeps the stored value, and a Placeholder with nothing stored fails.
func Preview ¶
Preview returns a short hint of value: at most four characters from each end, and nothing at all for values shorter than sixteen.
func SensitiveName ¶
SensitiveName reports whether key's name alone marks it sensitive.
func SensitiveValue ¶
SensitiveValue reports whether value looks like key material on its own.
Types ¶
type Meta ¶
type Meta struct {
Sensitive bool `json:"sensitive"`
Set bool `json:"set"`
Preview string `json:"preview,omitempty"`
ValueRedacted bool `json:"value_redacted"`
Reason string `json:"reason,omitempty"`
Override *bool `json:"override,omitempty"`
}
Meta describes one variable on a read surface without its value.
type PlaceholderError ¶
type PlaceholderError struct{ Key string }
PlaceholderError names a key that was sent as Placeholder but has no stored value to keep.
func (*PlaceholderError) Error ¶
func (e *PlaceholderError) Error() string
Source Files