Documentation
¶
Overview ¶
Package redact masks the values of secret flow inputs and secret node outputs in everything the runner reports back — node results, the flow result, and progress events. It is applied once, at the boundary where results leave the runner, so the engine keeps working with the real values while a flow runs.
Index ¶
- Constants
- func ErrorMessage(ctx context.Context, err error) string
- func LearnOutput(ctx context.Context, nodeID, name string, value any)
- func WithLearner(ctx context.Context, r *Redactor) context.Context
- func Withheld(ctx context.Context, ref string) bool
- func Withhold(ctx context.Context, nodeID, name string)
- type Redactor
- func (r *Redactor) Error(err error) error
- func (r *Redactor) FlowResult(result *spi.FlowExecutionResult) *spi.FlowExecutionResult
- func (r *Redactor) LearnOutput(nodeID, name string, value any)
- func (r *Redactor) Map(values map[string]any) map[string]any
- func (r *Redactor) Result(result spi.AnyResult) spi.AnyResult
- func (r *Redactor) Text(s string) string
- func (r *Redactor) Value(v any) any
- func (r *Redactor) Withheld(ref string) bool
- func (r *Redactor) Withhold(nodeID, name string)
- type Source
Constants ¶
const Mask = "***"
Mask is what a secret value is replaced with.
const MaxLearnedValues = 500
MaxLearnedValues caps the distinct secret output values one run masks by value. Each one is matched against every string the run reports.
const MinLearnedLength = 6
MinLearnedLength is the fewest characters a secret output value needs to be masked by value. Shorter text, such as true, 1 or a status word, occurs everywhere in a run's reports, so masking it by value would wipe them out while protecting nothing a guess could not recover.
Variables ¶
This section is empty.
Functions ¶
func ErrorMessage ¶ added in v0.80.0
ErrorMessage returns spi.SafeErrorMessage(err) masked by the Redactor ctx carries, for a log line. A UserError message can quote a value a node compared, such as an assertion's actual value, and logs are written outside the reporting boundary that masks results.
func LearnOutput ¶ added in v0.79.0
LearnOutput adds a secret output to the Redactor ctx carries, and does nothing when ctx carries none. See Redactor.LearnOutput.
func WithLearner ¶ added in v0.77.0
WithLearner returns ctx carrying r, so code running anywhere under it, including nested module, loop and poll bodies, can add secret outputs to the run's redaction with LearnOutput.
Types ¶
type Redactor ¶
type Redactor struct {
// contains filtered or unexported fields
}
Redactor masks a set of secret values. A nil or zero Redactor is a valid no-op. LearnOutput grows the set while a run executes, so a value a node extracts into a secret output is masked in everything reported after it.
func New ¶
New returns a Redactor for the values of the inputs named by secretKeys, or nil when none of them holds a non-empty value.
func NewFromSources ¶ added in v0.52.0
NewFromSources returns one Redactor for secret values drawn from multiple independent input maps. Duplicate values are kept only once.
func (*Redactor) Error ¶
Error returns err with its message masked, preserving a UserError's code so the engine's user-fault classification survives.
func (*Redactor) FlowResult ¶
func (r *Redactor) FlowResult(result *spi.FlowExecutionResult) *spi.FlowExecutionResult
FlowResult returns a masked copy of the flow result and of every node result it carries.
func (*Redactor) LearnOutput ¶ added in v0.79.0
LearnOutput makes the value of output name of node nodeID secret. Each leaf of a map or slice counts on its own. A leaf of at least MinLearnedLength characters is masked by value from now on, up to MaxLearnedValues per run. Any other leaf withholds the output instead: it is masked by name wherever the run reports it, and its node's report drops the fields that could carry it. Empty text is ignored, as is a value already masked.
func (*Redactor) Map ¶
Map is Value for a map, keeping the map type. A value that cannot be normalized yields an empty map rather than the original.
func (*Redactor) Result ¶
Result returns a masked copy of result. The original is left untouched: while a flow runs it is still the engine's live value, feeding downstream nodes.
func (*Redactor) Value ¶
Value returns a masked copy of v.
v is first normalized to the JSON shape it reports on the wire, then every string leaf of that tree is masked. Scanning the decoded tree rather than the encoded text is what makes the scan sound: json.Marshal escapes &, <, >, " and \, so a secret holding any of them has no literal form in the encoded bytes. Object keys are left alone, so no contract field can be renamed or dropped, and the result is always valid JSON.
A value that cannot be normalized is replaced by the mask. This is a security seam: it fails closed.
Source Files