Documentation
¶
Overview ¶
Package redaction provides shared audit-payload redaction helpers that can be consumed both by application/usecase implementations and by presentation-layer callers (e.g. the transcript hook) without the presentation layer having to import usecase-impl packages.
The built-in redactor set masks private keys, auth headers, and common token / secret / password assignment shapes. Callers that wire user-supplied extra_redact_patterns should compile them via CompileExtraPatterns and pass the result to Apply.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Apply ¶
Apply runs the built-in redactors followed by the caller-supplied extras against value and reports whether any substitution fired.
func ApplyBuiltin ¶
ApplyBuiltin is a convenience for callers that only want the built-in redactors and do not care whether anything fired.
Types ¶
type Redactor ¶
Redactor is a single redaction rule: a regex pattern and its replacement template.
func BuiltinRedactors ¶
func BuiltinRedactors() []Redactor
BuiltinRedactors returns a defensive copy of the default redactor set. Callers may safely prepend or append without mutating package state.
func CompileExtraPatterns ¶
CompileExtraPatterns compiles caller-supplied regex source strings into Redactor entries that Apply can consume. Empty / whitespace- only patterns are skipped silently; invalid patterns return an error naming the offending source string.
type RuleConfig ¶ added in v0.10.0
type RuleConfig struct {
Name string `json:"name"`
Type string `json:"type"`
Pattern string `json:"pattern"`
Replacement string `json:"replacement"`
Targets []string `json:"targets"`
Fields []string `json:"fields"`
Paths []string `json:"paths"`
QueryParams []string `json:"query_params"`
MinLength int `json:"min_length"`
}
RuleConfig is the configuration-facing structured redaction rule shape. Type may be "regex", "field", "url", or "context". When Type is empty, a pattern implies regex, fields / paths imply field, and query_params implies url. Replacement defaults to [REDACTED]. Targets are optional dotted pipeline names such as audit.input or audit.output; omitted targets mean the rule applies everywhere.
type Rules ¶ added in v0.10.0
type Rules struct {
RegexRules []Redactor
StructuredRules []structuredRule
}
Rules contains compiled structured redaction rules. RegexRules includes legacy extra_patterns-compatible regex entries plus regex typed rules.
func CompileRules ¶ added in v0.10.0
func CompileRules(patterns []string, configs []RuleConfig) (Rules, error)
CompileRules compiles legacy extra_patterns and structured rules into the runtime rule set. extra_patterns are appended as all-target regex rules with the default replacement, preserving the previous behavior.
Source Files