Documentation
¶
Overview ¶
Package mask defines field masking for sensitive data. A Masker applies a named rule (configured per attribute) to a value before it is returned, instead of excluding the column outright — so the agent sees shape, not secrets (e.g. email -> "a***@x.com"). Masking never raises: an unknown rule passes the value through unchanged so a misconfiguration cannot break reads.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Masker ¶
Masker applies a named masking rule to a value. Implementations must not panic on unknown rules or nil values.
type NoopMasker ¶
type NoopMasker struct{}
NoopMasker passes values through unchanged; used when masking is disabled.
type Rule ¶
Rule masks a single value. It returns the masked value; errors are reserved for rule-internal failures (most rules never error).
type RuleMasker ¶
type RuleMasker struct {
// contains filtered or unexported fields
}
RuleMasker maps rule names to Rules. The zero value masks nothing.
func NewRuleMasker ¶
func NewRuleMasker(custom map[string]Rule) *RuleMasker
NewRuleMasker returns a Masker with the built-in rules (email, phone, idcard, secret) plus any custom rules. Custom rules override built-ins on name clash.
func (*RuleMasker) Has ¶
func (m *RuleMasker) Has(name string) bool
Has reports whether a rule name is registered. Assemblers call it to reject a misconfigured mask rule at startup rather than silently leaking plaintext at read time.
Source Files