Documentation
¶
Overview ¶
Package redaction provides utilities for redacting sensitive information from requests and responses for safe debug logging.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ComputeContentHash ¶
ComputeContentHash computes a cryptographic hash for content uniqueness tracking. This hash is used for debugging purposes and unique content detection, particularly for: - Tracking cache hits/misses by correlating identical content across requests - Identifying duplicate or similar requests without exposing actual content - Debugging issues by matching redacted logs to specific content patterns - Unique detection of content for deduplication and analysis
We use SHA256 for: - Strong collision resistance for reliable unique detection - Cryptographic properties suitable for content identification - Standard hash function widely used for content addressing
Returns a 16-character hex string (first 64 bits of SHA256 hash) for compact representation while maintaining strong collision resistance.
func RedactJSONTree ¶ added in v1.1.0
RedactJSONTree redacts every string leaf in a JSON-compatible value, returning a new value.
It walks the standard JSON tree shapes produced by encoding/json's default unmarshaler into `any`: string, []any, and map[string]any, replacing each string leaf with the [REDACTED …] placeholder from RedactString. Numbers, bools, and nil are kept as-is.
The value of a "type" key is preserved (not redacted): in the request schemas redacted here, "type" is a JSON-union discriminator (e.g. "message", "text", "image", "tool_use"), not user data. Redacting it would make the redacted value fail to round-trip back into the typed union during redaction, and discriminator values carry no sensitive content.
It is intended for endpoint request fields whose values are untyped unions populated by custom unmarshalers (e.g. prompt/input content), so that no sensitive nested string is missed when redacting for debug logs. Non-sensitive structural strings other than "type" (role values, task_type, …) may be redacted — this over-redaction is acceptable and safe for debug logging, and it means the redactor never has to track which nested fields are user data.
RedactJSONTree does not mutate its input; it returns a new tree (slices/maps are copied as it descends).
func RedactString ¶
RedactString replaces sensitive string content with a placeholder containing length and hash. The hash allows correlating logs with specific content for debugging without exposing the actual sensitive data.
Format: [REDACTED LENGTH=n HASH=xxxxxxxx]
Example: "secret API key 12345" becomes "[REDACTED LENGTH=19 HASH=a3f5e8c2]"
Types ¶
This section is empty.
Source Files