Documentation
¶
Overview ¶
Package protoredact masks the fields of a protobuf message that are marked [debug_redact = true] in the schema, so the message can be logged without exposing the secrets it carries. The label is set next to the field in the .proto file; this package is the reader for it, since the Go protobuf runtime does not act on the option itself.
Index ¶
Constants ¶
const Placeholder = "[REDACTED]"
Placeholder replaces the value of a singular string field marked debug_redact. Names and structure are kept so a log line still shows which fields were set.
Variables ¶
This section is empty.
Functions ¶
func Clone ¶
Clone returns a deep copy of m with every debug_redact field masked. m is not modified.
TODO: memoize, per message descriptor, whether the type can reach a debug_redact field at all. Most of our RPC messages cannot (Actor, ListActorsResponse, Worker, ...), and for those the clone and the walk are pure overhead: they could be returned as-is after a cache lookup. The same answer lets Redact skip sub-messages whose type has no redacted fields instead of traversing them. Benchmarks for both are linked from #1743.
func ForLog ¶
ForLog returns a value safe to log. A proto message is cloned and every field carrying the debug_redact option is masked in the copy; any other value is returned unchanged. The original message is never modified.
func IsRedacted ¶
func IsRedacted(fd protoreflect.FieldDescriptor) bool
IsRedacted reports whether fd carries [debug_redact = true].
func Redact ¶
func Redact(msg protoreflect.Message)
Redact masks, in place, every populated field of msg that carries the debug_redact option, recursing through nested messages, lists and map values. Singular string fields are replaced with Placeholder; any other kind (bytes, repeated, map, message, ...) is cleared, because no honest placeholder exists for them.
Types ¶
This section is empty.
Source Files