Documentation
¶
Overview ¶
Package redact sanitizes error messages and strings before they are returned to an LLM. It strips sensitive information such as Bearer tokens, API keys, file paths, IP addresses, stack traces, and long base64 strings.
Index ¶
- Constants
- func ContainsSensitive(s string) bool
- func SanitizeError(msg string) string
- func StripGoStackTraces(s string) string
- type PatternEntry
- type Redactor
- type Rule
- type Store
- func (s *Store) AddPattern(name, pattern, replace string) error
- func (s *Store) AddWhitelist(name, pattern string) error
- func (s *Store) Init() error
- func (s *Store) ListPatterns() ([]PatternEntry, error)
- func (s *Store) ListWhitelist() ([]WhitelistEntry, error)
- func (s *Store) Reload() error
- func (s *Store) RemovePattern(name string) error
- func (s *Store) RemoveWhitelist(name string) error
- func (s *Store) Sanitize(input string) string
- type StoreOption
- type WhitelistEntry
Constants ¶
const StoreSchema = `` /* 541-byte string literal not displayed */
StoreSchema creates the tables for runtime-manageable redaction rules.
Table redact_patterns: blacklist patterns (things to redact). Table redact_whitelist: whitelist patterns (things to preserve, skip redaction).
Both tables support is_active for enable/disable without deletion.
Variables ¶
This section is empty.
Functions ¶
func ContainsSensitive ¶
ContainsSensitive returns true if any default rule matches in the string. Useful for pre-checks before logging or returning errors.
func SanitizeError ¶
SanitizeError is a convenience function that applies Defaults() to an error message.
func StripGoStackTraces ¶
StripGoStackTraces is a fast-path helper that only removes Go stack traces without applying the full rule set.
Types ¶
type PatternEntry ¶
PatternEntry is a row from redact_patterns.
type Redactor ¶
type Redactor struct {
// contains filtered or unexported fields
}
Redactor applies a pipeline of rules to sanitize strings.
func (*Redactor) RedactMap ¶
RedactMap applies the redactor to all string values in a map (shallow). Non-string values are left as-is. Returns a new map.
func (*Redactor) SanitizeLines ¶
SanitizeLines applies the redactor to each line of a multi-line string, preserving the line structure. Empty lines are kept.
type Rule ¶
Rule defines a single redaction pattern.
func Defaults ¶
func Defaults() []Rule
Defaults returns the standard set of redaction rules covering tokens, paths, addresses, stack traces, and encoded strings.
func MustCompileRule ¶
MustCompileRule creates a Rule, panicking if the pattern is invalid. Intended for package-level var declarations.
func SQLitePaths ¶
func SQLitePaths() []Rule
SQLitePaths returns rules that redact SQLite database file paths.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store is a SQLite-backed, runtime-updatable redaction engine. It loads blacklist patterns (what to redact) and whitelist patterns (what to preserve) from the database. Patterns can be added, removed, or toggled at runtime and reloaded without restart.
func NewStore ¶
func NewStore(db *sql.DB, opts ...StoreOption) *Store
NewStore creates a Store backed by the given database. Call Init() to create the tables, then Reload() to load patterns.
func (*Store) AddPattern ¶
AddPattern inserts or replaces a blacklist pattern in the database. Call Reload() after to pick up changes.
func (*Store) AddWhitelist ¶
AddWhitelist inserts or replaces a whitelist pattern in the database.
func (*Store) ListPatterns ¶
func (s *Store) ListPatterns() ([]PatternEntry, error)
ListPatterns returns all blacklist patterns (active and inactive).
func (*Store) ListWhitelist ¶
func (s *Store) ListWhitelist() ([]WhitelistEntry, error)
ListWhitelist returns all whitelist patterns (active and inactive).
func (*Store) Reload ¶
Reload reads all active patterns from the database and compiles them. Invalid regex patterns are logged and skipped.
func (*Store) RemovePattern ¶
RemovePattern deactivates a blacklist pattern.
func (*Store) RemoveWhitelist ¶
RemoveWhitelist deactivates a whitelist pattern.
func (*Store) Sanitize ¶
Sanitize applies the full pipeline: static rules + dynamic blacklist, but preserves substrings matching any whitelist pattern.
Order: whitelisted substrings are temporarily replaced with placeholders, then all rules (static + dynamic) are applied, then placeholders are restored.
type StoreOption ¶
type StoreOption func(*Store)
StoreOption configures a Store.
func WithStaticRules ¶
func WithStaticRules(rules ...[]Rule) StoreOption
WithStaticRules sets the static (code-defined) rules that are always applied in addition to the dynamic database rules.
type WhitelistEntry ¶
WhitelistEntry is a row from redact_whitelist.
Source Files