Documentation
¶
Index ¶
- type DetectorMetricsReporter
- type InMemoryMetrics
- func (m *InMemoryMetrics) AddCredentialVerificationsSaved(count int)
- func (m *InMemoryMetrics) AddFromDataVerifyTimeSpent(wallTime time.Duration)
- func (m *InMemoryMetrics) AddResultCacheHits(count int)
- func (m *InMemoryMetrics) AddResultCacheHitsWasted(count int)
- func (m *InMemoryMetrics) AddResultCacheMisses(count int)
- type MetricsReporter
- type ResultCache
- type VerificationCache
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type DetectorMetricsReporter ¶ added in v3.97.8
type DetectorMetricsReporter interface {
// AddDetectorVerifyTimeSpent records wall time spent verifying credentials remotely for one detector. It is not
// called for results served from the cache.
AddDetectorVerifyTimeSpent(detectorType detector_typepb.DetectorType, wallTime time.Duration)
}
DetectorMetricsReporter is an optional interface that a MetricsReporter can additionally implement to receive verification timing attributed to the detector that incurred it. Implementations must be thread-safe.
What one sample covers depends on the path taken. When the result cache is consulted, a detectors.ResultVerifier records one sample per remote VerifyResult call on a cache miss. Every other case records one sample per whole FromData(verify=true) pass, including its regex pass: detectors that do not implement detectors.ResultVerifier, targeted rescans (forceCacheUpdate), and a VerificationCache with no result cache. The last two apply to ResultVerifier detectors too, so one such detector can produce whole-pass samples that cover many remote calls alongside its per-call samples. A detector that starts implementing detectors.ResultVerifier shifts its distribution, which resets its baseline rather than signaling a provider change.
type InMemoryMetrics ¶
type InMemoryMetrics struct {
CredentialVerificationsSaved atomic.Int32
FromDataVerifyTimeSpentMS atomic.Int64
ResultCacheHits atomic.Int32
ResultCacheHitsWasted atomic.Int32
ResultCacheMisses atomic.Int32
}
InMemoryMetrics is a MetricsReporter that stores reported metrics in memory for retrieval at the end of a scan.
func (*InMemoryMetrics) AddCredentialVerificationsSaved ¶
func (m *InMemoryMetrics) AddCredentialVerificationsSaved(count int)
func (*InMemoryMetrics) AddFromDataVerifyTimeSpent ¶
func (m *InMemoryMetrics) AddFromDataVerifyTimeSpent(wallTime time.Duration)
func (*InMemoryMetrics) AddResultCacheHits ¶
func (m *InMemoryMetrics) AddResultCacheHits(count int)
func (*InMemoryMetrics) AddResultCacheHitsWasted ¶
func (m *InMemoryMetrics) AddResultCacheHitsWasted(count int)
func (*InMemoryMetrics) AddResultCacheMisses ¶
func (m *InMemoryMetrics) AddResultCacheMisses(count int)
type MetricsReporter ¶
type MetricsReporter interface {
// AddCredentialVerificationsSaved records "saved" verification attempts, which is when credential verification
// status is loaded from the cache instead of retrieved from a remote verification endpoint. This number might be
// smaller than the cache hit count due to cache hit "wasting"; see AddResultCacheHitsWasted for more information.
AddCredentialVerificationsSaved(count int)
// AddFromDataVerifyTimeSpent records wall time spent verifying credentials remotely, either in a call to
// detector.FromData with verify=true or, for detectors that implement detectors.ResultVerifier, in the
// per-result verification of cache misses.
AddFromDataVerifyTimeSpent(wallTime time.Duration)
// AddResultCacheHits records result cache hits. Not all cache hits result in elided remote verification requests
// due to cache hit "wasting"; see AddResultCacheHitsWasted for more information.
AddResultCacheHits(count int)
// AddResultCacheMisses records result cache misses.
AddResultCacheMisses(count int)
// AddResultCacheHitsWasted records "wasted" result cache hits. A "wasted" result cache hit is a result cache hit
// that does not elide a remote verification request because there are other secret findings in the relevant chunk
// that are not cached. When this happens, the detector's FromData method must be called anyway, so the cache hit
// doesn't save any remote requests.
AddResultCacheHitsWasted(count int)
}
MetricsReporter is an interface used by a verification cache to report various metrics related to its operation. Implementations must be thread-safe.
type ResultCache ¶
ResultCache is a cache that holds individual detector results. It serves as a component of a VerificationCache.
type VerificationCache ¶
type VerificationCache struct {
// contains filtered or unexported fields
}
VerificationCache is a structure that can be used to cache verification results from detectors so that a given credential does not trigger multiple identical remote verification attempts.
func New ¶
func New(resultCache ResultCache, metrics MetricsReporter) *VerificationCache
New creates a new verification cache with the provided result cache and metrics reporter. If resultCache is nil, the verification cache will be a no-op passthrough, although it will still record relevant metrics to the provided metrics reporter in this case.
func (*VerificationCache) FromData ¶
func (v *VerificationCache) FromData( ctx context.Context, detector detectors.Detector, verify bool, forceCacheUpdate bool, data []byte, ) ([]detectors.Result, error)
FromData is a cache-aware facade in front of the provided detector's FromData method.
If the verification cache's underlying result cache is nil, or verify is false, or forceCacheUpdate is true, this method invokes the provided detector's FromData method with the provided arguments and returns the result. If the result cache is non-nil and forceCacheUpdate is true, the result cache is updated with the results before they are returned.
Otherwise, the detector's FromData method is called with verify=false. The result cache is then checked for each returned result. If there is a cache hit for each result, these cached values are all returned. Otherwise, the detector's FromData method is called again, but with verify=true, and the results are stored in the cache and then returned.
Detectors that implement detectors.ResultVerifier are handled by verifyCacheMisses instead, which verifies only the results that missed the cache rather than re-running the detector over the whole chunk.