Documentation
¶
Overview ¶
Package redact detects and redacts sensitive information — emails, phone numbers, IP addresses, credit card numbers, and custom entities — in arbitrary text. It runs the same WebAssembly component as the @arcjet/redact (JavaScript) and arcjet.redact (Python) packages, so all three SDKs redact identically.
Redaction happens entirely in-process: the text is never sent to the Arcjet service. This makes redact suitable for scrubbing prompts and responses before they reach a third-party LLM, sanitising logs, and similar tasks.
A Redactor compiles the wasm component once and is safe to reuse across many Redact calls. Closing it releases the wasm runtime.
Index ¶
Constants ¶
const ( EntityEmail = "email" EntityPhoneNumber = "phone-number" EntityIPAddress = "ip-address" EntityCreditCardNumber = "credit-card-number" )
Standard sensitive-information entity names recognised by the component. Any other string passed in Options.Entities or returned from Options.Detect is treated as a custom entity.
Variables ¶
var ErrClosed = errors.New("arcjet/redact: redactor is closed")
ErrClosed is returned by Redact when the Redactor has been closed.
Functions ¶
This section is empty.
Types ¶
type Options ¶
type Options struct {
// Entities restricts redaction to the named entity types. When empty, every
// detected entity is redacted. Names not in the standard set (see the Entity
// constants) are treated as custom entities surfaced by Detect.
Entities []string
// ContextWindowSize is the number of adjacent tokens passed to Detect at a
// time. Defaults to 1 when zero or negative.
ContextWindowSize int
// Detect optionally classifies tokens the built-in detectors miss. It is
// called with a window of tokens (see ContextWindowSize) and must return one
// entry per input token, in order; an empty string means "not sensitive".
// Detected names may be custom. When nil, only the built-in detectors run.
Detect func(tokens []string) []string
// Replace optionally supplies replacement text for a detected entity, given
// the entity name and the matched plaintext. Return ok=false to fall back to
// the component's built-in redaction (e.g. "<Redacted email #0>"). When nil,
// the built-in redaction is always used.
//
// For Unredact to round-trip, replacements must be non-empty and unique per
// distinct original value; the built-in redaction guarantees this with a
// "#N" suffix. Empty or duplicated replacements cannot be reversed and are
// dropped from the Unredact mapping.
Replace func(entity, plaintext string) (replacement string, ok bool)
}
Options configures a Redactor.
type Redactor ¶
type Redactor struct {
// contains filtered or unexported fields
}
Redactor redacts sensitive information using the Arcjet wasm component. It is safe for concurrent use: many Redact calls may run at once, and Close waits for in-flight calls to finish before tearing down the runtime.
func New ¶
New compiles the redact component and returns a reusable Redactor. Compiling the wasm module is expensive, so create one Redactor and share it; call Close when done.
func (*Redactor) Close ¶
Close releases the wasm runtime backing the Redactor. It blocks until any in-flight Redact calls finish; subsequent Redact calls return ErrClosed. Close is idempotent.
func (*Redactor) Redact ¶
func (r *Redactor) Redact(ctx context.Context, candidate string) (redacted string, unredact Unredact, err error)
Redact returns candidate with every detected sensitive value replaced, along with an Unredact function that restores the original values. When nothing is detected, candidate is returned unchanged and Unredact is the identity.
Source Files