Documentation
¶
Overview ¶
Package security provides token security and credential sanitization utilities to prevent accidental leakage of sensitive data in logs and error messages.
The package provides three layers of protection:
- SecureToken: wraps sensitive strings so fmt operations return masked values
- SanitizeString / SanitizeError: regex-based redaction of known token patterns
- MaskSSHKeyPath: obfuscates file paths for safe logging
Usage:
token := security.NewSecureToken("glpat-secret123456")
fmt.Println(token) // "[token:****3456]"
safe := security.SanitizeString("auth: glpat-abcdef1234567890")
// "auth: [gitlab-token-redacted]"
Index ¶
- func DebugAuth(logger *bullets.Logger, authType string, details map[string]string)
- func DebugSSHKey(logger *bullets.Logger, keyFile string, success bool)
- func MaskSSHKeyPath(path string) string
- func SanitizeError(err error) error
- func SanitizeMap(m map[string]any) map[string]any
- func SanitizeString(s string) string
- type SecureToken
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DebugAuth ¶
DebugAuth logs authentication information safely. All details are sanitized before logging to prevent token leakage.
Example:
DebugAuth(logger, "GitLab", map[string]string{
"method": "token",
"url": "https://gitlab.com/org/repo.git",
})
func DebugSSHKey ¶
DebugSSHKey logs SSH key usage safely with masked paths.
Example:
DebugSSHKey(logger, "/Users/john/.ssh/id_ed25519", true) // Logs: "SSH authentication configured with key: ~/.ssh/id_ed25519"
func MaskSSHKeyPath ¶
MaskSSHKeyPath obfuscates SSH key file paths for safe logging. Converts absolute paths to relative paths from home directory.
Example:
/Users/john/.ssh/id_ed25519 -> ~/.ssh/id_ed25519 /home/jane/.ssh/id_rsa -> ~/.ssh/id_rsa
func SanitizeError ¶
SanitizeError wraps an error with SanitizeString applied to its message. Returns nil if err is nil. The original error chain is not preserved; the returned error wraps an internal errSanitized sentinel.
func SanitizeMap ¶
SanitizeMap redacts values whose keys match common sensitive names (token, password, secret, api_key, auth, credential, authorization). Non-sensitive string values are also passed through SanitizeString. Returns nil if m is nil.
func SanitizeString ¶
SanitizeString removes sensitive tokens from a string using compiled regex patterns. It detects and redacts GitLab tokens (glpat-*), GitHub tokens (ghp_/gho_/ghs_*), authorization headers, and generic bearer tokens. This provides defense-in-depth protection against token leakage.
Thread Safety: Safe for concurrent use after first call (regex patterns compiled via sync.Once).
Types ¶
type SecureToken ¶
type SecureToken struct {
// contains filtered or unexported fields
}
SecureToken wraps sensitive tokens to prevent accidental logging. The String() method returns a masked value, making it safe to use in logs, error messages, and fmt operations.
Example:
token := NewSecureToken("glpat-secret123456")
fmt.Printf("Token: %s", token) // Output: "Token: [token:****3456]"
fmt.Printf("Token: %v", token) // Output: "Token: [token:****3456]"
fmt.Printf("Token: %+v", token) // Output: "Token: [token:****3456]"
func NewSecureToken ¶
func NewSecureToken(token string) SecureToken
NewSecureToken creates a new SecureToken from a string value.
func (SecureToken) GoString ¶
func (t SecureToken) GoString() string
GoString implements fmt.GoStringer to prevent leaking in %#v formatting.
func (SecureToken) IsEmpty ¶
func (t SecureToken) IsEmpty() bool
IsEmpty returns true if the token is empty.
func (SecureToken) String ¶
func (t SecureToken) String() string
String implements fmt.Stringer and returns a masked representation. This ensures tokens cannot leak through string formatting operations.
func (SecureToken) Value ¶
func (t SecureToken) Value() string
Value returns the actual token value. WARNING: Use with caution. Only call this when you need the real token for authentication purposes. Never log or print the result.
Source Files