Documentation
¶
Overview ¶
Package redact removes sensitive values from connector configurations before they are persisted to the state file or written to logs. Redaction is always-on and one-way: the original value is never recoverable from the redacted output. Matching is fail-closed — a key that looks sensitive is redacted even at the cost of occasionally redacting a benign value.
Index ¶
Constants ¶
const Placeholder = "<kcp-redacted>"
Placeholder is the literal value substituted for a redacted config value.
Variables ¶
This section is empty.
Functions ¶
func AnyMapContainsRedacted ¶
AnyMapContainsRedacted reports whether any value in in has already been redacted, recursing into nested maps and lists so that placeholders buried in structured values are also found. As with MapContainsRedacted, a value counts only when it equals Placeholder exactly. A nil or empty map yields false. The input is not mutated.
func IsSensitive ¶
IsSensitive reports whether a config key should have its value redacted. A key is sensitive if any blacklist entry (a static sensitive-config name or a broad pattern) appears as a case-insensitive substring of the key.
func MapContainsRedacted ¶
MapContainsRedacted reports whether any value in in has already been redacted, i.e. equals Placeholder exactly. Matching is exact-equality (not substring) because redaction replaces the whole value, so a benign value that merely embeds the placeholder text is not treated as redacted. A nil or empty map yields false. The input is not mutated.
func RedactAnyMap ¶
RedactAnyMap returns a copy of in with sensitive values replaced by Placeholder, plus the number of values redacted. It recurses into nested maps and lists so that secrets nested inside structured values are also caught. A sensitive key is redacted wholesale regardless of its value's type (fail-closed); non-sensitive keys whose values are containers are recursed into. The input is not mutated.
func RedactStringMap ¶
RedactStringMap returns a copy of in with the values of sensitive keys replaced by Placeholder, plus the number of values redacted. The input map is not mutated. A nil input yields an empty map and a count of zero.
Types ¶
This section is empty.
Source Files