redact

func Diagnostic ¶ added in v0.21.0

func Diagnostic(message string) string

Diagnostic masks the credentials in a message that is about to be persisted or shown to a user. Unlike Text it needs no registered secret: what a private registry reference or an upstream error quotes is not known up front, so the credentials are matched by shape instead.

func ResetForTest ¶

func ResetForTest()

ResetForTest clears the error redaction registry. It is intended for tests in other packages that need deterministic state.

func SetSecrets ¶

func SetSecrets(key string, secrets ...string)

SetSecrets associates a set of secrets with the given key. Calling again with the same key replaces the previous secrets, so rotating credentials (e.g. access tokens) are handled naturally without explicit unregistration.

The key should identify the credential scope, e.g. "qq-token:<appID>" or "telegram:<configID>". For multiple instances of the same adapter, include a stable instance identifier in the key.

Callers decide where redaction is appropriate. Logs and normal outbound messages should retain their original text unless their own contract says otherwise.

func Text ¶

func Text(text string) string

Text masks registered secrets in text selected by the caller.